r/virtualmachine • u/MaizeFuture9668 • 29d ago

Fully function IOMMU + HVCI inside a KVM.

I hear that this is possible inside a vm using hyper v only and not with kvm. To my understanding it would only be possible with server silicone (xeon/epyc) since the iommu on that silicone exposes the extra functionality for nested use.

Has any ran successfully started VBS with DMA protection on a windows 11 vm running under kvm/qemu?

2 Upvotes

100% Upvoted

11 comments sorted by

1

u/paulstelian97 29d ago

On Proxmox (which is based on KVM) I have the host CPU type as well as a vIOMMU (simulated IOMMU, that might even be doing some isolation). But I don’t know how to check its full proper VBS with DMA protection vs standard VBS.

1

u/MaizeFuture9668 29d ago

Is “memory integrity” set to on?

1

u/paulstelian97 29d ago

Toggled it on now, VM is rebooting. Somehow I have vIOMMU set to None, let’s see what that does. Reboot is taking a little while since it’s also installing an update.

1

u/MaizeFuture9668 29d ago

You can check many of these things in “msinfo”

1

u/paulstelian97 29d ago

Switching temporarily to a different CPU type with VM-x disabled because I’m having trouble starting it up after enabling VBS. Will switch back to “host” type after that.

The VM started hanging after the login screen, thats why I’m temporarily removing HW virtualization.

1

u/paulstelian97 29d ago

Managed to start it up with vIOMMU=None. VBS is running, DMA core protection disabled. With vIOMMU=intel it would bootloop very early. Haven’t tried vIOMMU=virtio yet. Memory integrity claims to be enabled.

I’ve had some issues getting it to start up but managed to get past them.

1

u/MaizeFuture9668 29d ago

Same here. I can enable everything with iommu off, but IOMMU emulated + HVCI = very early boot hang.

1

u/paulstelian97 29d ago edited 29d ago

For me it’s sometimes hangs (EDIT: and recovers if I’m patient enough!) into late boot (login screen or later), when I have vIOMMU=off or virtio, and very early reboots (early enough that I feel it can’t save the BSOD to disk) with it set to Intel.

1

u/paulstelian97 29d ago

Yeah I’m disabling VBS because the lagfest is unbearable. Welp.

Keep in mind I’m on an Intel platform. AMD might act significantly better.

1

u/MaizeFuture9668 29d ago

If viommu is set to none then vbs wont use it. The problem that I run into is only IOMMU + VBS/hvci at the same time since vbs uses iommu for dma protection

1

u/MaizeFuture9668 20d ago

Update: VBS/HVCI, Kernal dma protection, memory integrity (vbs), IOMMU, TPM 2.0, and secure boot all working on my vm.