linux-kernel - Re: [PATCH 1/2] VMware detection support for x86 and x86-64

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <48DC09D9.7040204@zytor.com>
Date:	Thu, 25 Sep 2008 14:59:53 -0700
From:	"H. Peter Anvin" <hpa@...or.com>
To:	Zachary Amsden <zach@...are.com>
CC:	Alok Kataria <akataria@...are.com>,
	Alok kataria <alokkataria1@...il.com>,
	Ingo Molnar <mingo@...e.hu>, Yan Li <elliot.li.tech@...il.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"joerg.roedel@....com" <joerg.roedel@....com>,
	"rjmaomao@...il.com" <rjmaomao@...il.com>,
	Yinghai Lu <yhlu.kernel@...il.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Daniel Hecht <dhecht@...are.com>
Subject: Re: [PATCH 1/2] VMware detection support for x86 and x86-64

Zachary Amsden wrote:
> 
> The whole backdoor thing is also broken because it requires
> non-architectural side effects to operate (IN instructions can not
> arbitrarily change all GPRs).  This can confuse applications which are
> very smart and try to single step over the instruction by emulating it,
> logging the port I/O, then restoring GPRs to the state before execution
> and writing the 1 register affected by the IN.  Such clever debuggers
> and profiling tools have been written.
> 

To be fair, SMM sometimes also play these kinds of games -- even though 
it is equally frowned upon there.

However, it is the particular use of this for detection use that is 
utterly damning.  Using random I/O port probes for hardware detect 
should have disappeared in the early 1990's, and it's really disturbing 
that virtualization vendors -- not just VMWare -- are, in effect, 
re-making all the mistakes hardware vendors did in the 1980's.

Fortunately, we can usually use DMI to bail us out.  Just like we used 
to look for magic strings in the VGA BIOS so we could figure out what 
exact kind of SuperVGA card we have.

	-hpa

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/