diff --git a/tools/flask/policy/modules/dom0.te b/tools/flask/policy/modules/dom0.te
index 1f564ff83b..7d0f29f082 100644
--- a/tools/flask/policy/modules/dom0.te
+++ b/tools/flask/policy/modules/dom0.te
@@ -46,6 +46,7 @@ allow dom0_t dom0_t:resource { add remove };
 # Allow dom0 to communicate with a nested Xen hypervisor
 allow dom0_t nestedxen_t:version { xen_version xen_get_features };
 allow dom0_t nestedxen_t:mmu physmap;
+allow dom0_t nestedxen_t:hvm { setparam getparam };
 
 # These permissions allow using the FLASK security server to compute access
 # checks locally, which could be used by a domain or service (such as xenstore)
diff --git a/xen/arch/x86/guest/hypercall_page.S b/xen/arch/x86/guest/hypercall_page.S
index 1a8dd0ea4f..adbb82f4ec 100644
--- a/xen/arch/x86/guest/hypercall_page.S
+++ b/xen/arch/x86/guest/hypercall_page.S
@@ -62,6 +62,7 @@ DECLARE_HYPERCALL(argo_op)
 DECLARE_HYPERCALL(xenpmu_op)
 DECLARE_HYPERCALL(nested_xen_version)
 DECLARE_HYPERCALL(nested_memory_op)
+DECLARE_HYPERCALL(nested_hvm_op)
 
 DECLARE_HYPERCALL(arch_0)
 DECLARE_HYPERCALL(arch_1)
diff --git a/xen/arch/x86/guest/xen-nested.c b/xen/arch/x86/guest/xen-nested.c
index a76983cc2d..82bd6885e6 100644
--- a/xen/arch/x86/guest/xen-nested.c
+++ b/xen/arch/x86/guest/xen-nested.c
@@ -22,6 +22,7 @@
 #include <xen/lib.h>
 #include <xen/sched.h>
 
+#include <public/hvm/hvm_op.h>
 #include <public/memory.h>
 #include <public/version.h>
 #include <public/xen.h>
@@ -160,3 +161,44 @@ int compat_nested_memory_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
     return nested_add_to_physmap(*nat);
 }
 #endif
+
+long do_nested_hvm_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
+{
+    struct xen_hvm_param a;
+    long ret;
+
+    if ( !xen_nested )
+        return -ENOSYS;
+
+    ret = xsm_nested_hvm_op(XSM_PRIV, current->domain, cmd);
+    if ( ret )
+        return ret;
+
+    switch ( cmd )
+    {
+    case HVMOP_set_param:
+    {
+        if ( copy_from_guest(&a, arg, 1) )
+            return -EFAULT;
+
+        return xen_hypercall_hvm_op(cmd, &a);
+    }
+
+    case HVMOP_get_param:
+    {
+        if ( copy_from_guest(&a, arg, 1) )
+            return -EFAULT;
+
+        ret = xen_hypercall_hvm_op(cmd, &a);
+
+        if ( !ret && __copy_to_guest(arg, &a, 1) )
+            return -EFAULT;
+
+        return ret;
+    }
+
+    default:
+        gprintk(XENLOG_ERR, "Nested hvm op %d not implemented.\n", cmd);
+        return -EOPNOTSUPP;
+    }
+}
diff --git a/xen/arch/x86/hypercall.c b/xen/arch/x86/hypercall.c
index 2aa8dc5ac6..268cc9450a 100644
--- a/xen/arch/x86/hypercall.c
+++ b/xen/arch/x86/hypercall.c
@@ -76,6 +76,7 @@ const hypercall_args_t hypercall_args_table[NR_hypercalls] =
 #ifdef CONFIG_XEN_NESTED
     ARGS(nested_xen_version, 2),
     COMP(nested_memory_op, 2, 2),
+    ARGS(nested_hvm_op, 2),
 #endif
     ARGS(mca, 1),
     ARGS(arch_1, 1),
diff --git a/xen/arch/x86/pv/hypercall.c b/xen/arch/x86/pv/hypercall.c
index 96198d3313..e88ecce222 100644
--- a/xen/arch/x86/pv/hypercall.c
+++ b/xen/arch/x86/pv/hypercall.c
@@ -87,6 +87,7 @@ const hypercall_table_t pv_hypercall_table[] = {
 #ifdef CONFIG_XEN_NESTED
     HYPERCALL(nested_xen_version),
     COMPAT_CALL(nested_memory_op),
+    HYPERCALL(nested_hvm_op),
 #endif
     HYPERCALL(mca),
     HYPERCALL(arch_1),
diff --git a/xen/include/public/xen.h b/xen/include/public/xen.h
index e081f52fc4..1731409eb8 100644
--- a/xen/include/public/xen.h
+++ b/xen/include/public/xen.h
@@ -123,6 +123,7 @@ DEFINE_XEN_GUEST_HANDLE(xen_ulong_t);
 #define __HYPERVISOR_dm_op                41
 #define __HYPERVISOR_nested_xen_version   42
 #define __HYPERVISOR_nested_memory_op     43
+#define __HYPERVISOR_nested_hvm_op        44
 
 /* Architecture-specific hypercall definitions. */
 #define __HYPERVISOR_arch_0               48
diff --git a/xen/include/xen/hypercall.h b/xen/include/xen/hypercall.h
index d373bd1763..b09070539e 100644
--- a/xen/include/xen/hypercall.h
+++ b/xen/include/xen/hypercall.h
@@ -158,6 +158,10 @@ extern long do_nested_xen_version(
 extern long do_nested_memory_op(
     int cmd,
     XEN_GUEST_HANDLE_PARAM(void) arg);
+
+extern long do_nested_hvm_op(
+    int cmd,
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 #endif
 
 #ifdef CONFIG_COMPAT
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 17375f6b9f..238b425c49 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -754,6 +754,13 @@ static XSM_INLINE int xsm_nested_add_to_physmap(XSM_DEFAULT_ARG
     XSM_ASSERT_ACTION(XSM_PRIV);
     return xsm_default_action(action, d, NULL);
 }
+
+static XSM_INLINE int xsm_nested_hvm_op(XSM_DEFAULT_ARG const struct domain *d,
+                                        unsigned int cmd)
+{
+    XSM_ASSERT_ACTION(XSM_PRIV);
+    return xsm_default_action(action, d, NULL);
+}
 #endif
 
 #include <public/version.h>
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index 920d2d9088..cc02bf18c7 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -190,6 +190,7 @@ struct xsm_operations {
 #ifdef CONFIG_XEN_NESTED
     int (*nested_xen_version) (const struct domain *d, unsigned int cmd);
     int (*nested_add_to_physmap) (const struct domain *d);
+    int (*nested_hvm_op) (const struct domain *d, unsigned int cmd);
 #endif
 };
 
@@ -741,6 +742,12 @@ static inline int xsm_nested_add_to_physmap(xsm_default_t def,
     return xsm_ops->nested_add_to_physmap(d);
 }
 
+static inline int xsm_nested_hvm_op(xsm_default_t def, const struct domain *d,
+                                    unsigned int cmd)
+{
+    return xsm_ops->nested_hvm_op(d, cmd);
+}
+
 #endif /* CONFIG_XEN_NESTED */
 
 #endif /* XSM_NO_WRAPPERS */
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index 5ce29bcfe5..909d41a81b 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -160,5 +160,6 @@ void __init xsm_fixup_ops (struct xsm_operations *ops)
 #ifdef CONFIG_XEN_NESTED
     set_to_dummy_if_null(ops, nested_xen_version);
     set_to_dummy_if_null(ops, nested_add_to_physmap);
+    set_to_dummy_if_null(ops, nested_hvm_op);
 #endif
 }
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 17a81b85f9..f8d247e28f 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1768,6 +1768,27 @@ static int flask_nested_xen_version(const struct domain *d, unsigned int op)
     return domain_has_xen_version(d, SECINITSID_NESTEDXEN, op);
 }
 
+static int flask_nested_hvm_op(const struct domain *d, unsigned int op)
+{
+    u32 perm;
+
+    switch ( op )
+    {
+    case HVMOP_set_param:
+        perm = HVM__SETPARAM;
+        break;
+
+    case HVMOP_get_param:
+        perm = HVM__GETPARAM;
+        break;
+
+    default:
+        perm = HVM__HVMCTL;
+    }
+
+    return domain_has_nested_perm(d, SECCLASS_HVM, perm);
+}
+
 #endif
 
 long do_flask_op(XEN_GUEST_HANDLE_PARAM(xsm_op_t) u_flask_op);
@@ -1912,6 +1933,7 @@ static struct xsm_operations flask_ops = {
 #ifdef CONFIG_XEN_NESTED
     .nested_xen_version = flask_nested_xen_version,
     .nested_add_to_physmap = flask_nested_add_to_physmap,
+    .nested_hvm_op = flask_nested_hvm_op,
 #endif
 };
 
