In D59840#1373292, @bnovkov wrote:

LGTM, I'll give the patch a spin tomorrow before landing it. Have you tested this change somehow already?

Yep, I tested with a small 16-bit payload that loads a null IDT and executes ud2, so the guest takes a hardware triple fault (VMX exit reason 2).

Before: raw VMX dump, then abort.
After patch: no dump, exits 3 (BHYVE_EXIT_TRIPLEFAULT).

Only the VMX side is covered though as you can see, the SVM side still injects #UD for VMCB_EXIT_SHUTDOWN (illumos I believe handles it in 13170), and I have no AMD hardware here.

I can attach the payload image and both serial logs if that's useful.

In D59840#1373358, @hayzam_gmail.com wrote:

In D59840#1373292, @bnovkov wrote:

LGTM, I'll give the patch a spin tomorrow before landing it. Have you tested this change somehow already?

Yep, I tested with a small 16-bit payload that loads a null IDT and executes ud2, so the guest takes a hardware triple fault (VMX exit reason 2).

I can attach the payload image and both serial logs if that's useful.

That would be great, thank you! How did you generate the payload?

Sure. It's a 34-byte multiboot kernel that GRUB loads; no guest OS involved:

cli
lidt    null_idt        /* base 0, limit 0 */
ud2

built with:

clang --target=i386-freebsd -c tfmb.S -o tfmb.o
ld.lld -m elf_i386 -N --image-base 0x100000 -Ttext 0x100000 \
    -e _start -o tfmb.elf tfmb.o

(-N matters: without it lld emits two load segments at the same address and GRUB rejects the ELF with "overlap detected".)

I dropped it on a small FAT image with GRUB as \EFI\BOOT\BOOTX64.EFI and a grub.cfg of:

multiboot /boot/tfmb.elf
boot

and booted that with plain bhyve + BHYVE_UEFI.fd + com1. Same image both times, only the kernel module changed, Please find the attached payload source, the ELF, grub.cfg, the 8 MB image and both serial logs. The README has the full image recipe if you want to rebuild it.

Just for posterity: illumos hit this while running the Windows kernel debugger under propolis (https://www.illumos.org/issues/14664), and their regression test is just a ud2a with an unpopulated IDT. I don't have the bhyve-tests framework here, so this is the equivalent thing with a tiny multiboot payload; and it was a useful excuse to go through the VMX exit path properly.

{F172828669}

{F172828667}

{F172828666}

{F172828665}

{F172828664}

{F172828663}

{F172828662}