VirtualBox causes host BSOD starting VM under Windows 10. Hyper-V is off

8

4

I have a freshly-installed 64-bit Windows 10 system, with VirtualBox installed and a CentOS 7.0 VM image. Whenever I try to start the VM, Windows BSODs with SYSTEM_SERVICE_EXCEPTION, code 0x0000003b.

After extensive (and frustrating) Googling, I have found many references to this being caused by Windows 10's Hyper-V virtualisation, so I have turned this off via Windows Features; and ensured that no Hyper-V services are running, or set to run on startup. This has not prevented the BSODs.

This exact same setup, including hardware, but with Win 7 32-bit instead of Win 10 64-bit, was working perfectly until IT re-imaged my machine to Windows 10.

Below is the output of VBox.log, although it doesn't look like anything relevant is in it.

VirtualBox VM 5.0.40 r115130 win.amd64 (Apr 28 2017 19:55:07) release log
00:00:00.308913 Log opened 2017-07-10T13:36:10.933562500Z
00:00:00.308914 Build Type: release
00:00:00.308917 OS Product: Windows 10
00:00:00.308918 OS Release: 10.0.14393
00:00:00.308918 OS Service Pack: 
00:00:00.383912 DMI Product Name: B85M-E
00:00:00.386322 DMI Product Version:  
00:00:00.386327 Host RAM: 8063MB total, 3856MB available
00:00:00.386329 Executable: C:\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
00:00:00.386329 Process ID: 9952
00:00:00.386330 Package type: WINDOWS_64BITS_GENERIC
00:00:00.389754 Installed Extension Packs:
00:00:00.389787   None installed!

Can anyone suggest a way forward?

Edit: Minidump available here, for identical failure except on VirtualBox v 5.1.22.

Chowlett

Posted 2017-07-10T14:21:00.680

Reputation: 253

You are not running 1703 is there a reason? Honestly this sounds like a problem only your IT department can diagnose since your unlikely to have the ability/permission require to get the required information to diagnose the crash. Specifically, we would need the dmp file created, otherwise we can't perform any trace analysis – Ramhound – 2017-07-10T14:40:31.000

@Ramhound - 1703 being a version of Windows or VirtualBox? I do have (many) minidump files for the crashes, if you can point me somewhere I should submit them. – Chowlett – 2017-07-10T14:47:00.683

How you get the dmp file to us is entirely up to you, be sure you have permission to release them, it's something you should upload without permission. 1703 is the current feature update of Windows 10, you currently are running 1607, again this is the type of problem your IT staff should be looking into not you. You don't indicate what version of VirtualBox you are even using. – Ramhound – 2017-07-10T14:49:01.880

@Ramhound - ok, thanks. This is the version of Win 10 imaged on to my system by IT; I can check if they're OK with upgrading. I would guess they're unlikely to be able to offer much help with the problem itself, although I am talking to them in parallel. VirtualBox is version 5.0.40 in that log (it says at the top), because a colleague has that as Known Good; it also fails with 5.1.22 (latest stable). I'll check if I can release my DMPs. – Chowlett – 2017-07-10T14:58:20.457

Are you running the latest drivers as provided by your motherboard or computer vendor? – Steven – 2017-07-10T15:01:21.770

Added Minidump link to question. @Steven - I have not updated any drivers beyond those that were imaged on. I'll check if any are out of date. – Chowlett – 2017-07-10T15:06:15.087

@Steven - none of the usual suspects. I've bumped Display and Audio drivers with no effect; SATA, Networking are up-to-date. – Chowlett – 2017-07-10T15:22:16.700

VirtualBox no longer BSODs, but now the VM crashes with the message: Raw-mode is unavailable courtesy of Hyper-V. (VERR_SUPDRV_NO_RAW_MODE_HYPER_V_ROOT). The solution by @n0ha below works (I pasted the error message here to prevent frustration for others when googling this error message). – Georg Jung – 2018-03-28T06:40:56.557

Answers

8

As it turns out, disabling Hyper-V is not enough. There is another Windows feature, called Virtualization Based Security, that employs Hyper-V. You need to disable that as well.

All I needed to do was to change one registry key and reboot:

Use regedit to set

HKEY_LOCAL_MACHINE\SYSTEM\Software\CurrentControlSet\Control\DeviceGuard

to 0, and reboot.

There is a nice description of Device Guard / Virtualization Based Security here: Windows 10 Device Guard and Credential Guard Demystified.

n0ha

Posted 2017-07-10T14:21:00.680

Reputation: 81

4Early indications are good for this fix - except that the key was HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\EnableVirtualizationBasedSecurity on our system (Windows 10 Enterprise Version 1607 (OS Build 14393.1770)) – Chowlett – 2017-10-31T15:46:28.317

3

Have this issue on the new Windows 10 Fall Creator Update (1709) build 16299 and Virtual Box. Both VirtualBox versions were tested also: - Version 5.1.26 r117224 (Qt5.6.2) - Version 5.2.2 r119230 (Qt5.6.2) HyperV features are NOT deployed but by default, MSINFO32 shows up "Hypervisor enforced Code Integrity" on the new Fall Creator Update build.

Result from MSINFO32.EXE enter image description here

It looks like that this feature will lead VirtualBox to a BSOD.

You lucky guys, there is a fast and dirty way to fix this: DISABLE SECURE BOOT.

(Just to test!!! your security department won't like it) If I get a clean solution I'll post it ;-)

Cheers

Laurent Vonau

Posted 2017-07-10T14:21:00.680

Reputation: 31

Hi guys, this issue will happen when Hyper-V is enabled. – Laurent Vonau – 2018-02-23T14:22:44.963

Note that Hyper-V can run even if you disable the feature! This happens if you enable VBS (Virtual Based Security) like for instance Credential Guard. Check output from msinfo32.exe to know if it's running or not. In this case, W10 starts "virtualized" (NVRAM para hypervisorlaunchtype = Auto). So in fact, on W10, when HV or VBS is running, your OS is "virtualized", hence, VirtualBox won't like it. I think these guys should check if W10 is running this mode or not, and display a message "Can I make crash your Windows?" – Laurent Vonau – 2018-02-23T14:32:29.767

Some readings about VBS: https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs

– Laurent Vonau – 2018-02-23T14:33:20.107

0

we can't fix this because Windbg shows the Virtualbox driver as cause, wich tries to execute a command that is not allowed (Privileged instruction):

EXCEPTION_CODE: (NTSTATUS) 0xc0000096 - Privileged instruction.

00 nt!KeBugCheckEx
01 nt!KiBugCheckDispatch
02 nt!KiSystemServiceHandler
03 nt!RtlpExecuteHandlerForException
04 nt!RtlDispatchException
05 nt!KiDispatchException
06 nt!KiExceptionDispatch
07 nt!KiGeneralProtectionFault
08 0x0
09 0x0
0a 0x0
0b VMMR0

    Image path: \??\C:\Program Files\Oracle\VirtualBox\VMMR0.r0
    Image name: VMMR0.r0
    Browse all global symbols  functions  data
    Timestamp:        Fri Apr 28 17:37:03 2017 

try lastest testbuilds and if you still get the issue report it to the developers in their bug tracker .

magicandre1981

Posted 2017-07-10T14:21:00.680

Reputation: 86 560

Apologies if this is a dumb question (I confess to not being knowledgeable about Windows internals), but are apps run as Administrator allowed to execute Privileged instructions? – Chowlett – 2017-07-10T16:02:26.143

Privileged instructions refers to special rings where some calls are not allowed

– magicandre1981 – 2017-07-10T16:21:05.927

Ok. I can log a bug with VirtualBox. I'm a little surprised, though, that a bug like this doesn't affect everyone running that combination of OS and application. Any idea why that would be? – Chowlett – 2017-07-10T16:26:03.897

0

On this Windows 10 Enterprise ("10.0.16299 Build 16299") machine in addition to n0ha's answer I had to disable Device Guard/Credential Guard:

On the host operating system, click Start > Run, type gpedit.msc, and click Ok. The Local group Policy Editor opens.

Go to Local Computer Policy > Computer Configuration > Administrative Templates > System > Device Guard > Turn on Virtualization Based Security.

Select Disabled.

Doing both re-enabled the "Acceleration" tab and stopped the HYPERVISOR_ERROR BSODs on VM start.

genpfault

Posted 2017-07-10T14:21:00.680

Reputation: 390

0

It seems a recent update of Avast causes problems with virtualization (you can check by disabling it for 10 mn, then trying to start up a VM).

To fix, go into Avast settings, then in "problems resolution" disable "enable hardware virtualization assistance" (or something like that).

Zezombye

Posted 2017-07-10T14:21:00.680

Reputation: 1