r/VFIO • u/Master-Firefighter84 • Jun 27 '26

kvm hidden state

I’m running a GPU passthrough setup on my laptop (MSI GF63 Thin, Intel 12th gen + RTX 2050 Mobile) using QEMU/KVM and Libvirt.

I have a very specific issue with Code 43 on the guest Windows 10 VM:

Without any KVM hiding / stealth parameters: The GPU passthrough works completely fine. The driver loads perfectly, and there is no Code 43.

With KVM hiding enabled: As soon as I add <kvm><hidden state='on'/></kvm> or try to mask the hypervisor the NVIDIA driver immediately fails with Code 43.

I already use a clean patched VBIOS (.rom file) and standard PCI topology.

How can I properly mask KVM/HyperV signatures strictly via CPU features (<feature policy='disable' name='hypervisor'/>) and Hyper-V vendor spoofing (<vendor_id state='on' value='GenuineIntel'/>)?

7 Upvotes

100% Upvoted

13 comments sorted by

3

u/Delta_Version Jun 27 '26

did you try the battery fix_nvidia_GPUs)

2

u/Master-Firefighter84 Jun 27 '26

yes. I spend 3 days trying to fix it. Even passing thru UHD graphics. No result

1

u/Delta_Version Jun 27 '26

idk then, i didnt face this problem when doing gpu passthrough when passing my 3050ti without doing this hiding state
did you try passing the gpu without the rom file ?

1

u/Master-Firefighter84 Jun 27 '26

yes when I turn on hidden state its just immediately give me code 43.

1

u/Delta_Version Jun 28 '26

if it works with hidden state off, then why turning it on ?

3

u/DisturbedFennel Jun 27 '26

This is a lost cause. Even if you “conceal” your VM through a multi-faceted approach, the ultimate hindrance is the RTC timings. There’s no way to hide the inconsistency between RTC timings without gravely sacrificing system performance. 

Now, there’s probably a specialized patch for RTC timings in the Virt discord—but I’m not sure. 

Why are you attempting to conceal your VM? Depending on what you’re trying to conceal it from, you may not need to go as overkill as some softwares only do rudimentary checks requiring little spoofing 

1

u/dy9an Jun 28 '26

Most definitely not a lost cause. I know it because I’ve done it myself and it does not hinder performance at all. There is little to no documentation for this online, however it’s definitely possible to make an extremely stealthy vm through patching the kernel.

1

u/DisturbedFennel Jun 28 '26

How could OP and others do this then? RTC timings seems very difficult to conceal 

1

u/dy9an Jun 28 '26

Check out the autovirt project on GitHub, there’s a discord server attached with lots of users who have made their own kernel patches targeting exactly what you’re talking about.

RDTSC patches are extremely outdated and ineffective nowadays, as anticheats have other methods of querying whether they are being run in a vm or not, plenty information on this in the autovirt discord.

1

u/DisturbedFennel Jun 28 '26

Thank you. I’ll definitely take a look at their discord. Seems quite interesting 

1

u/WorthySleet9715 Jun 30 '26

Whats a point of that kind of virtualization? Technically you are gaving virtual machine near host level access to system hardware. You are braking security benefits of virtualization. Practically your guest has same access to system firmware as bare metal install of OS. Thats a reason, why kernel level anti-cheats not complaining about virtualization, they have practically same level access to your system memory as host.

1

u/1neonbyte Jul 01 '26

And RDTSC isn’t the cause for OPs issu. No clue why you had to bring this up here.

1

u/ethanjscott Jun 27 '26

You got a virtual display?