Re: [PATCH 1/2] VMware detection support for x86 and x86-64

Ingo Molnar
2008-09-08T14:04:47Z

* Yan Li <elliot.li.tech@gmail.com> wrote:

> +/* Backdoor def from open-vm-tools/lib/include/backdoor_def.h */
> +#define BDOOR_MAGIC 0x564D5868
> +/* Low-bandwidth backdoor port. --hpreg */
> +#define BDOOR_PORT 0x5658
> +#define BDOOR_CMD_GETVERSION 10
> +#define VERSION_MAGIC 0x6
> +
> +/*
> + * getVersion - Read VM version & product code through backdoor
> + */
> +void getVersion(u32 *version)
> +{
> + u32 eax, ebx, ecx, edx;
> +
> + asm volatile("inl (%%dx)" :
> + "=a"(eax), "=c"(ecx), "=d"(edx), "=b"(ebx) :
> + "0"(BDOOR_MAGIC), "1"(BDOOR_CMD_GETVERSION),
> + "2"(BDOOR_PORT) : "memory");

hm, i know it's not your fault as you just took this vmware code, but
this is really not an acceptable method of detection. The above is
totally unsafe to do on native hardware - we dont know whether there's
anything on that port.

vmware could have used one of the following methods to communicate to
the guest kernel:

- a CPUID and an MSR range - like a good virtual CPU should. That way
even bootloaders could detect the presence of vmware.
- or a PCI ID and a PCI driver like KVM does
- or a system call hypercall gateway like Xen and KVM does
- or it could even have used a DMI signature of some sort

but no, vmware had to use 30 year old unsafe ISA port magic...

To add insult to injury that port is named 'backdoor' - very smart and
confidence raising naming. Plus it does not even use some well-known PC
port that is harmless to read - it has to be from the middle of the
generic IO port resource range where a real PCI card could sit: 0x5658.
Brilliant.

is there really no vmware PCI ID to query? Could you post the lspci -v
output of your vmware guest? We could add an early-quirk for one of the
core vmware PCI devices (in case there are any - i bet there are).

Ingo