“Nested virtualization is not supported on this machine”, but it works in Hyper-V

[JojOatXGME]

Windows Version

Microsoft Windows [Version 10.0.19045.4046]

WSL Version

2.0.9.0

Are you using WSL 1 or WSL 2?

• WSL 2
• WSL 1

Kernel Version

5.15.133.1-microsoft-standard-WSL2

Distro Version

Ubuntu 22.04

Other Software

Hyper-V-Manager, Version: 10.0.19041.1

Repro Steps

1. Create %USERPROFILE%\.wslconfig

   [wsl2]
   nestedVirtualization=true
   

2. Install the following Features:
   • Hyper-V/*
   • VM-Plattform
   • Windows-Hypervisor-Platform
   • Windows-Subsystem for Linux
3. Start any distro with WSL

Expected Behavior

Nested virtualization should be working with WSL as long as it is working with Hyper-V. If there are additional requirements not present in Hyper-V, they should be documented.

I tested running Ubuntu in Qemu on NixOS in Hyper-V. I used qemu-system-x86_64 -enable-kvm to lunch Ubuntu within NixOS. Everything worked with reasonable good performance. So, I am sure that nested virtualization actually works on my processor with Hyper-V.

Actual Behavior

WSL reports the following message (German) before starting the distro:

wsl: Geschachtelte Virtualisierung wird auf diesem Computer nicht unterstützt.

(Translates to “Nested virtualization is not supported on this machine.”)

The distro reports that KVM is not supported,

jojo@DellBox-DESKTOP166:/mnt/c/Users/jojo$ dmesg | grep kvm
[    0.115998] kvm: no hardware support
[    0.116001] kvm: no hardware support

Diagnostic Logs

WslLogs-2024-02-27_23-07-35.zip

[github-actions]

Hi I'm an AI powered bot that finds similar issues based off the issue title.

Please view the issues below to see if they solve your problem, and if the issue describes your problem please consider closing this one and thumbs upping the other issue to help us prioritize it. Thank you!

Open similar issues:

• "Nested virtualization is not enabled on this OS build." (#9201), similarity score: 0.83

Closed similar issues:

• Nested virtualization is not supported on this machine. (But, it should be?) (#10106), similarity score: 0.91

Note: You can give me feedback by thumbs upping or thumbs downing this comment.

[JojOatXGME]

FYI, someone actually created a script for WinDbg to hock into the hypervisor and enable nested virtualization for WSL. I haven't tested this script, though.

https://gist.github.com/xtrnc/496da9243bab29629bc0461562bff458

It is also a bit absurd that WSL claims that my machine does not support nested virtualization, but it works when I add another layer of virtualization in between. I can run WSL with nested virtualization on the same machine within a Windows 11-VM on Hyper-V. (It is not very performant, though.)

[elsaco]

Johannes Spangenberg (@JojOatXGME) check this closed issues #9400 for some info:

#9400 (comment)

[JojOatXGME]

Elsaco (@elsaco) So nested virtualization is not supported by WSL on Windows 10, even after WSL has been moved to the store? Is there a reason for it, as it seems that WSL could just set the flag for the VM to enable it. I mean, nested virtualization is definitely supported by Windows 10, as you can see in my screenshots. WSL is just not enabling the flag for the hypervisor. At least this is how it looks to me.

Maybe there was some confusion because nested virtualization is only supported on Windows 11 for AMD CPUs? Maybe the check in WSL was accidentally implemented too strictly, so that it also blocks access on Intel CPUs?

While the documentation of WSL claims that nested virtualization is Windows 11 only, it has the same note for WSLg, which is supported by Windows 10 since it was moved to the MS Store. So the documentation is definitely out of date regarding such claims regarding support in Windows 10, which is why I don't take this claim very seriously.

PS: You can also find posts online from people which claim that nested virtualization did work for them on Windows 10 at some point.

[OneBlue]

Yes Johannes Spangenberg (@JojOatXGME), WSL indeed doesn't support nested virtualization on Windows 10. This is because of a limitation in the virtualization API that WSL uses. If you need nested, the simplest solution would be to upgrade your machine to Windows 11.

[nick-wellinghoff]

It does not support it because Microsoft wants you to upgrade to 11. There is no physical limitation that would prevent them from supporting it if they wanted to.

[JojOatXGME]

FYI: Since WSL is open-source now, I checked the code and experimented a bit. However, there seems to be a problem outside WSL as previously reported.

This is because of a limitation in the virtualization API that WSL uses.
— #11216 (comment)

WSL seems to use the Host Compute System (HCS) API. I tried replacing the following code by hard-coding vmSettings.ComputeTopology.Processor.ExposeVirtualizationExtensions = true.

WSL/src/windows/service/exe/WslCoreVm.cpp

Lines 1620 to 1638 in b87e56c

	if (m_vmConfig.EnableNestedVirtualization)
	try
	{
	std::vector<std::string> processorFeatures{};
	if (wsl::windows::common::helpers::IsWindows11OrAbove())
	{
	processorFeatures = wsl::windows::common::hcs::GetProcessorFeatures();
	}
	auto feature = std::find(processorFeatures.begin(), processorFeatures.end(), "NestedVirt");
	m_vmConfig.EnableNestedVirtualization = (feature != processorFeatures.end());
	vmSettings.ComputeTopology.Processor.ExposeVirtualizationExtensions = m_vmConfig.EnableNestedVirtualization;
	if (!m_vmConfig.EnableNestedVirtualization)
	{
	EMIT_USER_WARNING(wsl::shared::Localization::MessageNestedVirtualizationNotSupported());
	}
	}
	CATCH_LOG()

Unfortunately, it didn't work. The Hyper-V-Worker reported VmCreatePartitionFailed with error code 0xC0350005 (ERROR_HV_INVALID_PARAMETER). When I hardcode ExposeVirtualizationExtensions = false, the VM is created without nested virtualization as usual. HCS should support ExposeVirtualizationExtensions since Windows 10 SDK version 1809 (10.0.17763.0) according to the documentation. However, it doesn't seem to work on Windows 10 in practice. I haven't found anything about this behavior of HCS on the internet. Since HCS is closed-source, I wasn't able to go any deeper.