Bug 200877

Summary: Low 2D graphics performance with Windows 10 (1803) VGA passthrough VM using "Spectre" protection
Product: Virtualization Reporter: Heiko Sieger (hs7762)
Component: kvmAssignee: virtualization_kvm
Status: NEW ---    
Severity: normal CC: g_amanakis
Priority: P1    
Hardware: x86-64   
OS: Linux   
URL: https://heiko-sieger.info/low-2d-graphics-benchmark-with-windows-10-1803-kvm-vm/
Kernel Version: 4.15.0-32-generic x86_64 Subsystem:
Regression: No Bisected commit-id:
Attachments: Red graph - Windows 10 bare metal; blue graph - Windows 10 VM with Spectre protection enabled; yellow graph - Windows 10 VM with spectre protection disabled

Description Heiko Sieger 2018-08-21 15:44:25 UTC 
Created attachment 278013 [details]
Red graph - Windows 10 bare metal; blue graph - Windows 10 VM with Spectre protection enabled; yellow graph - Windows 10 VM with spectre protection disabled

After upgrading Windows 10 Pro VM to version 1803, or possibly after applying the March security updates from Microsoft, the VM would show low 2D graphics performance (sluggishness in 2D applications and low Passmark results).

Turning off Spectre vulnerability protection in Windows remedies the issue.

Expected behavior:
kvm hypervisor to expose firmware capabilities of host to guest OS - see https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/CVE-2017-5715-and-hyper-v-vms

Background:

Starting in March or April Microsoft began to push driver updates in their updates / security updates. See https://support.microsoft.com/en-us/help/4073757/protect-your-windows-devices-against-spectre-meltdown

One update concerns the Intel microcode - see https://support.microsoft.com/en-us/help/4100347. It is activated by default within Windows.

Once the updates are applied within the Windows guest, 2D graphics performance drops significantly. Other performance benchmarks are not affected.

A bare metal Windows installation does not display a performance loss after the update.

Hardware:

6 core Intel Core i7-3930K (-MT-MCP-)

Host OS:
Linux Mint 19/Ubuntu 18.04
Kernel: 4.15.0-32-generic x86_64
Qemu: QEMU emulator version 2.11.1
Intel microcode (host): 0x714
dmesg | grep microcode
[    0.000000] microcode: microcode updated early to revision 0x714, date = 2018-05-08
[    2.810683] microcode: sig=0x206d7, pf=0x4, revision=0x714
[    2.813340] microcode: Microcode Update Driver: v2.2.

Note: I manually updated the Intel microcode on the host from 0x713 to 0x714. However, both microcode versions produce the same result in the Windows guest.

Guest OS:
Windows 10 Pro 64 bit, release 1803
Comment 2 Georgios Amanakis 2018-09-03 11:50:23 UTC 
I reproduced this easily on two systems:
Xeon E5 2667v2 / X9SRA running Fedora 28, with Windows 10 1803 as KVM guest
Xeon E3 1270v2 / X9SCM running Archlinux, with Windows 10 1803 as KVM guest

Both systems are up to date (4.17.19 or 4.18.3), and the performance degradation doesn't occur when Windows 10 1803 runs on bare metal.

The performance degradation also doesn't occur when the Windows 10 guest disables spectre mitigation using "InSpectre.exe", or when the spec_ctrl flag is disabled in libvirt, or when the cpu-microcode isn't updated in the host.
Comment 3 Heiko Sieger 2018-09-04 18:30:03 UTC 
Does this point to a kernel related problem? Possibly kvm?
Comment 4 Georgios Amanakis 2018-09-14 17:28:22 UTC 

I did a git-bisect between 4.14.18(bad) and 4.14.10(good). Unsurprisingly, this is the first "bad" commit:

  KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL

  commit d28b387fb74da95d69d2615732f50cceb38e9a4d

George