On Sun, Aug 22, 2004 at 04:31:12PM +0200, Petr Vandrovec wrote:
> Whole situation (with originally released vmmon) looked like that vmware binary
> issued ioctl() to allocate memory, marked that page PG_RESERVED, and returned
> physical page number to userspace. Userspace then opened /dev/mem, and mapped
> that page to the process.  On cleanup /dev/mem was unmapped, PG_RESERVED bit
> was cleared, and page released (in my updates PG_RESERVED setting/clearing is
> removed, as it badly intereferes with page's refcounting).

I've sent andrew a patch that allows such mmaps again for PG_RESERVED pages.
The approach vmware did is rather questionable (as you say) and thankfully
fixed later, but breaking it is not entirely required.