KVM Windows 10 VM Help (TPM, Secure Boot, VBS, HVCI & IOMMU)

[Holemole]

So I kinda need some help setting up TPM 2.0, Secure Boot, VBS, HVCI, and IOMMU for my Windows 10 VM.


I’ve already got TPM 2.0 and Secure Boot working, but I haven’t had any luck with the other three.


I tried using:
options kvm_intel nested=1
options kvm ignore_msrs=1

but the VM ends up being slow as a turtle. My main goal is to game on the VM, so I need as much performance as possible.


Is there any way to enable VBS, HVCI, and IOMMU without taking a big performance hit? Someone told me I could “emulate” them, but they didn’t elaborate on what they meant.


I’m also pretty new to all of this, so if I’m missing something obvious or doing something wrong, I’d really appreciate any advice or explanations.


If anyone knows how to get these features working while keeping good performance, I’d really appreciate the help.


Thanks!

 

[j.theisen]

Hello @Holemole

thanks for posting on the forum!

So first things first, i probably don't need to tell you that Windows 10 is EOL since October of 2025 and such poses a security risk if not properly isolated.

Secondly VBS and HVCI use - as the name implies - nested virtualization, which always comes at a performance penalty, so if you need maximum performance keep these disabled.

Depending on your version of PVE the hit might be bigger or smaller due to supported CPU features. To be specific, since PVE 9 with kernel 7 it is possible to passthrough the MBEC (Intel CPU) and GMET (AMD CPU) flags to VMs which boosts the performance of VBS considerably in most cases.
Beware that there is a known issue with these flags which is fixed with version 9.2.0 of qemu-server and a machine version of 11.0-pve2. Previous machine versions won't benefit of those new flags.

Depending on your workload it might be beneficial to test CPU type host vs. x86_64_v# since host not always generates the best performance.
Beware that without modification nested virtualization features such as VBS will not work with a generalized CPU type (i.e. x86_64_v#)

IOMMU on the other hand is a completely different functionality and is not related to VBS or HVCI.
It is needed for PCI passthrough, see [1]

If you have further questions or need clarification on something, please feel free to ask.

Best regards
Jonas

[1] https://pve.proxmox.com/wiki/PCI_Passthrough#Requirements

 

[Holemole]

Hello @Holemole

thanks for posting on the forum!

So first things first, i probably don't need to tell you that Windows 10 is EOL since October of 2025 and such poses a security risk if not properly isolated.

Secondly VBS and HVCI use - as the name implies - nested virtualization, which always comes at a performance penalty, so if you need maximum performance keep these disabled.

Depending on your version of PVE the hit might be bigger or smaller due to supported CPU features. To be specific, since PVE 9 with kernel 7 it is possible to passthrough the MBEC (Intel CPU) and GMET (AMD CPU) flags to VMs which boosts the performance of VBS considerably in most cases.
Beware that there is a known issue with these flags which is fixed with version 9.2.0 of qemu-server and a machine version of 11.0-pve2. Previous machine versions won't benefit of those new flags.

Depending on your workload it might be beneficial to test CPU type host vs. x86_64_v# since host not always generates the best performance.
Beware that without modification nested virtualization features such as VBS will not work with a generalized CPU type (i.e. x86_64_v#)

IOMMU on the other hand is a completely different functionality and is not related to VBS or HVCI.
It is needed for PCI passthrough, see [1]

If you have further questions or need clarification on something, please feel free to ask.

Best regards
Jonas

[1] https://pve.proxmox.com/wiki/PCI_Passthrough#Requirements

Thanks for the reply and the info.


The reason I want VBS and HVCI enabled is because Riot Vanguard requires them out of the box if you want to play their game. I haven’t had any issues with other games everything else works perfectly.


I kind of gave up on trying to “emulate” or “fake” them because it’s way too complicated, and there isn’t enough information out there from what I’ve been able to find.


If anyone reading this has managed to enable VBS and HVCI without any noticeable performance impact, how did you do it?