linux-kernel - Re: [BUG] [KVM/VMX] Level triggered interrupts mishandled on Windows w/ nested virt(Credential Guard) when using split irqchip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <D373804C-B758-48F9-8178-393034AF12DD@nutanix.com>
Date: Mon, 8 Sep 2025 11:19:55 +0000
From: Khushit Shah <khushit.shah@...anix.com>
To: Vitaly Kuznetsov <vkuznets@...hat.com>
CC: "seanjc@...gle.com" <seanjc@...gle.com>,
        "pbonzini@...hat.com"
	<pbonzini@...hat.com>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Shaju Abraham
	<shaju.abraham@...anix.com>
Subject: Re: [BUG] [KVM/VMX] Level triggered interrupts mishandled on Windows
 w/ nested virt(Credential Guard) when using split irqchip

Thanks you for the comments Vitaly!

> On 8 Sep 2025, at 2:35 PM, Vitaly Kuznetsov <vkuznets@...hat.com> wrote:
> 
> Is there a specific reason to not enable any Hyper-V enlightenments for
> your guest? For nested cases, features like Enightended VMCS
> ('hv-evmcs'), 'hv-vapic', 'hv-apicv', ... can change Windows's behavior
> a lot. I'd even suggest you start with 'hv-passthrough' to see if the
> slowness goes away and if yes, then try to find the required set of
> options you can use in your setup.


Actually in production we use an extensive set of cpu features exposed to the guest, still the issue persists, 
With the following hv-* options also the issue is present:
       hypervisor=on,hv-time=on,hv-relaxed=on,hv-vapic=on,hv-spinlocks=0x2000,hv-vpindex=on,hv-runtime=on,hv-synic=on, 
       hv-stimer=on,hv-tlbflush=on,hv-ipi=on,hv-evmcs=on

> 
> On 8 Sep 2025, at 2:35 PM, Vitaly Kuznetsov <vkuznets@...hat.com> wrote:
> 
> Single CPU Windows guests are always very slow, doubly so when running nested.

The bug was reproducible even with more cpus like (4,8), we use 1 to reduce noise in captured logs.

I should also mention by slow boot we mean extremely slow (>3h).

Thanks,
Khushit