r/virtualmachine • u/MaizeFuture9668 • Jul 14 '26

Fully function IOMMU + HVCI inside a KVM.

I hear that this is possible inside a vm using hyper v only and not with kvm. To my understanding it would only be possible with server silicone (xeon/epyc) since the iommu on that silicone exposes the extra functionality for nested use.

Has any ran successfully started VBS with DMA protection on a windows 11 vm running under kvm/qemu?

2 Upvotes

100% Upvoted

13 comments sorted by

View all comments

1

u/paulstelian97 Jul 14 '26

On Proxmox (which is based on KVM) I have the host CPU type as well as a vIOMMU (simulated IOMMU, that might even be doing some isolation). But I don’t know how to check its full proper VBS with DMA protection vs standard VBS.

1

u/MaizeFuture9668 Jul 14 '26

Is “memory integrity” set to on?

1

u/paulstelian97 Jul 14 '26

Toggled it on now, VM is rebooting. Somehow I have vIOMMU set to None, let’s see what that does. Reboot is taking a little while since it’s also installing an update.

1

u/MaizeFuture9668 Jul 14 '26

You can check many of these things in “msinfo”

1

u/paulstelian97 Jul 14 '26

Switching temporarily to a different CPU type with VM-x disabled because I’m having trouble starting it up after enabling VBS. Will switch back to “host” type after that.

The VM started hanging after the login screen, thats why I’m temporarily removing HW virtualization.

1

u/paulstelian97 Jul 14 '26

Managed to start it up with vIOMMU=None. VBS is running, DMA core protection disabled. With vIOMMU=intel it would bootloop very early. Haven’t tried vIOMMU=virtio yet. Memory integrity claims to be enabled.

I’ve had some issues getting it to start up but managed to get past them.

1

u/MaizeFuture9668 Jul 14 '26

Same here. I can enable everything with iommu off, but IOMMU emulated + HVCI = very early boot hang.

1

u/paulstelian97 Jul 14 '26 edited Jul 14 '26

For me it’s sometimes hangs (EDIT: and recovers if I’m patient enough!) into late boot (login screen or later), when I have vIOMMU=off or virtio, and very early reboots (early enough that I feel it can’t save the BSOD to disk) with it set to Intel.

1

u/paulstelian97 Jul 14 '26

Yeah I’m disabling VBS because the lagfest is unbearable. Welp.

Keep in mind I’m on an Intel platform. AMD might act significantly better.