CentOS 7 VM is incredibly laggy, then fails to boot

[diagonalb]

frozen.png (20.42 KiB) Viewed 3451 times

I created a new CentOS 7 VM and installed the OS from a stock ISO.

After completing the OS installation, on the final screen of the installation wizard, I clicked the reboot button. On reboot, I got stuck on a screen for several minutes (see attached frozen.png file), but eventually the OS booted and I logged in, and got to the desktop. Once on the desktop, I noticed my mouse pointer was incredibly laggy. I don't know what the reason was for the lag, as the VM was allocated 8000 MB of RAM, and 2 virtual CPU cores.

Without running any commands or installing anything, I performed a clean VM shutdown. After the VM had powered off, I started the VM again. I got stuck on the same screen as before, and after waiting over 11 minutes, I tried sending the shutdown signal a couple times, even though as far as I could tell, the OS hadn't actually booted enough for a shutdown to work. Finally I gave up and powered off the machine.

My host OS is Windows 10 64-bit, and my VirtualBox version is Version 6.1.34 r150636 (Qt5.6.2).

I do not have Guest Additions installed on the guest OS.

The guest OS is Linux CentOS 7 64-bit. The guest was allocated 8000 MB of RAM. My host OS has 46.9 GB of RAM available.

Attaching my log file didn't work for some reason, even though it is a 151 KB .txt file. I can't post URLs yet, so I will come back and provide a link to my log later.

[mpack]

Why did you post in "Windows Guests"? That appears to be a Linux guest on a Win10 host. I will move the topic to the "Linux Guests" forum.

Then please provide a VM log file. Make sure the VM is fully shut down, then right click it in the manager UI. Select "Show Log" and save "VBox.log" (no other file) to a zip file. Attach the zip here.

Another thing you can do to save time is look for the following in your log.
HMR3Init: Attempting fall back to NEM (Hyper-V is active).

[diagonalb]

Thank you for moving my post to Linux Guests, I didn't mean to post under Windows Guests.

I attached a ZIP of my log file.

[mpack]

As expected.

00:00:02.838822 HM: HMR3Init: Attempting fall back to NEM: VT-x is not available
00:00:02.889690 NEM: info: Found optional import WinHvPlatform.dll!WHvQueryGpaRangeDirtyBitmap.
00:00:02.889739 NEM: WHvCapabilityCodeHypervisorPresent is TRUE, so this might work...

See the FAQ I previously linked.

[diagonalb]

I went through your linked FAQ, but continued to see "HMR3Init: Attempting fall back to NEM: VT-x is not available" in my log.

What I did:

1. I ran "bcdedit /set hypervisorlaunchtype off" and "DISM /Online /Disable-Feature:Microsoft-Hyper-V" in an Administrator command prompt, and then shutdown using "shutdown -s -t 2", and then waited 10 seconds before powering my computer back on.

2. I booted into my BIOS/UEFI and checked the virtualization settings. The two options I saw under the virtualization settings were
Enable Intel Virtualization Technology (VT) When ON, the system will be able to run a virtual machine monitor (VMM)", and "Enable Intel VT for Direct I/O When On, the system will be able to perform Virtualization Technology to Directed I/O (VT-d). VT-d is an Intel method that provides virtualization for memory map I/O." Both of these options were turned on. I exited the BIOS/UEFI without changing any settings and let Windows boot.

3. I looked at the fourth post on the "I have a 64bit host, but can't install 64bit guests" thread and realized my WSL2 could be interfering with VirtualBox. I uninstalled Windows Subsystem for Linux Update, then I uninstalled Ubuntu (i.e., the Ubuntu WSL2 subsystem). Next I opened "Turn Windows features on or off", and made sure that Hyper-V, Windows Hypervisor Platform, and Windows Subsystem for Linux were all unchecked (I had to uncheck Windows Subsystem for Linux), and then I pressed OK. I was prompted to restart, so I did.

4. After the restart completed, I opened an Administrator command prompt and shutdown with the command "shutdown /s /f /t 0". After my computer had powered off, I waited 10 seconds before powering it back on.

5. Once Windows finished booting, I opened VirtualBox and tried to start my CentOS 7 VM again. It showed the green turtle icon again, and seemed to freeze as before. I powered off the VM, and attached are my new logs. As I said, my new logs still contain "HMR3Init: Attempting fall back to NEM: VT-x is not available".

[mpack]

2. I booted into my BIOS/UEFI and checked the virtualization settings.

I don't know why you did that. Virtualization (VT-x) needs to be enabled for VirtualBox to use, and we already knew it was enabled otherwise Hyper-v couldn't have been running.

Regarding the new log, the situation has not changed: Hyper-v is still enabled. If Hyper-v is prevented from loading at boot time then it shouldn't matter what run time features (e.g. WSL2) are enabled.

00:00:06.691975 HM: HMR3Init: Attempting fall back to NEM: VT-x is not available
00:00:06.826351 NEM: info: Found optional import WinHvPlatform.dll!WHvQueryGpaRangeDirtyBitmap.
00:00:06.826426 NEM: WHvCapabilityCodeHypervisorPresent is TRUE, so this might work...

Perhaps you would have more luck with https://github.com/pintend/Hyper-V-toggle-script.

[diagonalb]

I took a look at that script, it doesn't run any commands I haven't already tried. But I tried it anyway, and there was no difference (I attached the updated log anyway).

If Hyper-v is prevented from loading at boot time

I'm pretty sure that Hyper-v is prevented from loading at boot time. I ran "bcdedit /v" in an Administrator command prompt to see all the boot values, and here they are:

Windows Boot Loader
-------------------
identifier {49fda1b2-d385-11eb-b289-c4411e73e17f}
device partition=C:
path \windows\system32\winload.efi
description Windows 10
locale en-US
inherit {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
recoverysequence {eb5dad03-d385-11eb-b6a3-c4411e73e17f}
displaymessageoverride Recovery
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \windows
resumeobject {49fda1b1-d385-11eb-b289-c4411e73e17f}
nx OptIn
bootmenupolicy Standard
hypervisorlaunchtype Off

[scottgus1]

The log still has the 'attempting' phrase, so something using Hyper-V is still active.

1. I ran "bcdedit /set hypervisorlaunchtype off"

3. I looked at the fourth post on the "I have a 64bit host, but can't install 64bit guests" thread and realized my WSL2 could be interfering with VirtualBox

If this was the order in which you did these things, then 3 undid 1.

I did notice this from my colleague Mpack:

If Hyper-v is prevented from loading at boot time then it shouldn't matter what run time features (e.g. WSL2) are enabled.

I wonder if something special was done in 3 that reset 1.

Anyhoo, Hyper-V is still on. Looks like you did the tutorial, good. There's a couple things the tutorial said about ' *guard' things, and corporate overlords. How about those?

[diagonalb]

There's a couple things the tutorial said about ' *guard' things, and corporate overlords. How about those?

I looked through that list, and for each item, I tried searching for it with the Windows search (i.e., using the search you get when see when you type Windows key + S), and I didn't have any of the items installed, except for WSL2, which I uninstalled. I detail the steps I took to uninstall WSL2 and the order I completed these steps in my previous post.

As for IT controls that I can't change, I didn't run into any of these.

[fth0]

FWIW, some of the Windows Security features use the term "Guard" only in their Microsoft-internal names. For example, look for HVCI, Memory Integrity, Core Isolation and VBS.

[diagonalb]

Is there any way I or someone else could move this post to the Windows Hosts section of this forum? I think that would be a more appropriate place, since this Hyper-v issue is specific to Windows hosts, and will be a problem for both Linux and Windows guests.

[mpack]

someone else could move this post to the Windows Hosts section of this forum?

Done. Thanks for the reminder.

[diagonalb]

FWIW, some of the Windows Security features use the term "Guard" only in their Microsoft-internal names. For example, look for HVCI, Memory Integrity, Core Isolation and VBS.

Sure, but if what mpack said (quoted below) is correct, then it doesn't matter what runtime features are enabled.

If Hyper-v is prevented from loading at boot time then it shouldn't matter what run time features (e.g. WSL2) are enabled.

Thanks for pointing out searchable names for the things that do use Hyper-v though.

I think I have Microsoft Defender Credential Guard enabled, at least based on what I see in the Settings app:

Microsoft Defender Guard might be enabled

Screenshot 2022-05-09 115407.png (8.18 KiB) Viewed 3065 times

Assuming this means Microsoft Defender Credential Guard is enabled, I don't know how to disable it (there is no switch to toggle it off). But again, it may not matter if it is enabled, if mpack's statement above is correct.

Memory integrity was already disabled:

Memory Integrity is turned off

Screenshot 2022-05-09 115650.png (8.56 KiB) Viewed 3065 times

When I search for HVCI and VBS on my computer, I don't get any hits.

[scottgus1]

If the log still has the "Attempting" message, it means something requiring Hyper-V is still enabled. I don't recall any instance where the log has been wrong.

When I search for HVCI and VBS on my computer, I don't get any hits.

You might do better searching the web instead of the OS to see how to turn them off.

I think I have Microsoft Defender Credential Guard enabled, at least based on what I see in the Settings app:
...
Credential Guard is protecting....

2. Look into I have a 64bit host, but can't install 64bit guests, 2nd post, points 2 & 3 and ensure that none of these things are running:
DeviceGuard
CredentialGuard
Windows Defender's Core Isolation

Ding ding!

[fth0]

On my Windows 10 Pro 21H2 host, I did some experiments today, with an interesting key takeaway:

VBS (Virtualization Based Security) based features are not prevented from running when the BCD setting hypervisorlaunchtype is set to off!

AFAICS, both FAQ documents used in the VirtualBox forums do not disagree with that and do not need to be changed.

Examples: Start > Settings > Update & Security > Windows Security > Device security > Core isolation > Memory integrity can be turned on successfully. The same holds true for the Group Policy setting Computer Configuration > Administrative Templates > System > Device Guard > Turn On Virtualization Based Security.

---

Assuming this means Microsoft Defender Credential Guard is enabled, I don't know how to disable it (there is no switch to toggle it off).

You'll find the setting under the Group Policy setting shown in the examples above.