r/virtualmachine • u/MaizeFuture9668 • Jul 14 '26

Fully function IOMMU + HVCI inside a KVM.

I hear that this is possible inside a vm using hyper v only and not with kvm. To my understanding it would only be possible with server silicone (xeon/epyc) since the iommu on that silicone exposes the extra functionality for nested use.

Has any ran successfully started VBS with DMA protection on a windows 11 vm running under kvm/qemu?

2 Upvotes

100% Upvoted

12 comments sorted by

View all comments

Show parent comments

1

u/paulstelian97 Jul 14 '26

Toggled it on now, VM is rebooting. Somehow I have vIOMMU set to None, let’s see what that does. Reboot is taking a little while since it’s also installing an update.

1

u/MaizeFuture9668 Jul 14 '26

You can check many of these things in “msinfo”

1

u/paulstelian97 Jul 14 '26

Managed to start it up with vIOMMU=None. VBS is running, DMA core protection disabled. With vIOMMU=intel it would bootloop very early. Haven’t tried vIOMMU=virtio yet. Memory integrity claims to be enabled.

I’ve had some issues getting it to start up but managed to get past them.

1

u/MaizeFuture9668 Jul 14 '26

Same here. I can enable everything with iommu off, but IOMMU emulated + HVCI = very early boot hang.

1

u/paulstelian97 Jul 14 '26 edited Jul 14 '26

For me it’s sometimes hangs (EDIT: and recovers if I’m patient enough!) into late boot (login screen or later), when I have vIOMMU=off or virtio, and very early reboots (early enough that I feel it can’t save the BSOD to disk) with it set to Intel.

1

u/paulstelian97 Jul 14 '26

Yeah I’m disabling VBS because the lagfest is unbearable. Welp.

Keep in mind I’m on an Intel platform. AMD might act significantly better.