Good afternoon all,

 

I didn't know where else to ask about this, so I guess I might as well come straight to the source. Here is the deal: currently I am running a Windows VM with a tweaked XML for maximum performance with Hyper-V enabled. I do this because certain games I play check for "VM Status" through Hypervisor and will not work otherwise (Halo Infinite, Genshin Impact are examples).

 

I know that Hyper-V is a Microsoft feature, but recently I've learned that Linux has a similar flag called "VMX" that can be turned on to do the same thing Hyper-V does. I found a couple threads online like this and this in the Arch wiki that explain how to turn the VMX flag on, but no matter what I do, it doesn't seem to work. The grep to CPU inside the Manjaro VM always returns SVM and no VMX.

 

How do I go about tweaking the XML to make sure the Hypervisor in the VM is a Type-1 rather than a Type-2?

 

Thanks in advance!

 

edit:

 

My XML for the VM is currently totally "vanilla" except I've added this line under "features":

 

  <features>
    <vmport state='off'/>
  </features>

 

I tried adding:

 

<feature policy='require' name='vmx'/>

 

But that did not work.

 

Also trying:

 

  <cpu mode='custom' check='none'>
    <feature policy='require' name='vmx'/>
    ..
  </cpu>

 

or

 

<cpu mode='host-model' check='partial'>
   <model fallback='allow'/>
</cpu>

 

Are not allowed by the unraid VM Manager.

Edited October 18, 20223 yr by kftX
clarification(s)

2 hours ago, kftX said:

  <cpu mode='custom' check='none'>
    <feature policy='require' name='vmx'/>
    ..
  </cpu>

Did it allow this in the xml? but didn't work when you started VM?

 

Did you enable nested option in syslinux settings and reboot?

14 minutes ago, SimonF said:

Did it allow this in the xml? but didn't work when you started VM?

 

Nope it didn't. It wouldn't even save the XML, the error was:

 

XML:

 

   <cpu mode='custom' check='none'>
    <feature policy='require' name='vmx'/>
    <topology sockets='1' dies='1' cores='7' threads='2'/>
    <cache mode='passthrough'/>
    <feature policy='require' name='topoext'/>
  </cpu>

 

14 minutes ago, SimonF said:

 

Did you enable nested option in syslinux settings and reboot?

 

Could you go into more detail here? I only have 1 year of and a bit unRAID under my belt 😛 But if you're asking if my unRAID install is running with nested on, it is. I'm running Windows 11 with Hyper-V.

 

root@Tower:~# cat /sys/module/kvm_amd/parameters/nested
1

 

Edited October 18, 20223 yr by kftX

9 minutes ago, kftX said:

 

Nope it didn't. It wouldn't even save the XML, the error was:

 

XML:

 

   <cpu mode='custom' check='none'>
    <feature policy='require' name='vmx'/>
    <topology sockets='1' dies='1' cores='7' threads='2'/>
    <cache mode='passthrough'/>
    <feature policy='require' name='topoext'/>
  </cpu>

 

 

Could you go into more detail here? I only have 1 year of and a bit unRAID under my belt 😛 But if you're asking if my unRAID install is running with nested on, it is. I'm running Windows 11 with Hyper-V.

Mine allowed me to add

  <cpu mode='host-passthrough' check='none' migratable='on'>
    <topology sockets='1' dies='1' cores='4' threads='2'/>
    <cache mode='passthrough'/>
    <feature policy='require' name='vmx'/>
  </cpu>

 

What does you cpu support it? I mean adding kvm-intel.nested=1 in the syslinux as below. Not sure if it is required but was on the thread you specified, but I dont have enabled and could save XML.

 

6 minutes ago, SimonF said:

Mine allowed me to add

  <cpu mode='host-passthrough' check='none' migratable='on'>
    <topology sockets='1' dies='1' cores='4' threads='2'/>
    <cache mode='passthrough'/>
    <feature policy='require' name='vmx'/>
  </cpu>

 

What does you cpu support it? I mean adding kvm-intel.nested=1 in the syslinux as below. Not sure if it is required but was on the thread you specified, but I dont have enabled and could save XML.

 

 

In my case it's a 5950X but nested virtualisation is on as my above edit shows. That's the only reason why I can run Hyper-V on Windows 11 with no issues.

 

As far as:

 

  <cpu mode='host-passthrough' check='none' migratable='on'>
    <topology sockets='1' dies='1' cores='4' threads='2'/>
    <cache mode='passthrough'/>
    <feature policy='require' name='vmx'/>
  </cpu>

 

I tried this exact config (just different cores and threads) and it didn't work, Manjaro still didn't have the VMX flag.

 

edit: here's the grep from Manjaro:

 

Quote

grep -E --color=auto 'vmx|svm' /proc/cpuinfo
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm rep_good nopl cpuid extd_apicid tsc_known_freq pni pclmulqdq ssse3 fma cx16 sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm cmp_legacy svm cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw perfctr_core ssbd ibrs ibpb stibp vmmcall fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdseed adx smap clflushopt clwb sha_ni xsaveopt xsavec xgetbv1 xsaves clzero xsaveerptr wbnoinvd arat npt lbrv nrip_save tsc_scale vmcb_clean pausefilter pfthreshold v_vmsave_vmload vgif umip pku ospke vaes vpclmulqdq rdpid fsrm arch_capabilities

 

Edited October 18, 20223 yr by kftX

vmx is intel, svm is equivalent for amd.

You can't have the vmx flag for a passed amd cpu, as in real hardware.

Just now, ghost82 said:

vmx is intel, svm is equivalent for amd.

You can't have the vmx flag for a passed amd cpu, as in real hardware.

 

Welp, that does make perfect sense.

 

Is there so SVM being on means that Type-1 Hypervisor is active? Or that there's just no way to get a Type-1 Hypervisor on AMD atm?

It's not very clear to me what you want to do..if you want to play games that check if they run in a vm then you need to know what they check and operate accordingly.

Sometimes adding:

<feature policy='disable'name='hypervisor'/>

is enough to bypass the check.

Sometimes custom compilation of qemu is required because the original package has some hardcoded things that applications may check.

I'm not understanding why you are talking about nested virtualization (run a vm in a vm).

 

If in your vm you have svm in your cpu features that means only that nested virtualization should work (for intel it is vmx).

 

Probably you are confusing vmm with vmx flag (for intel)?

 

 

Edited October 18, 20223 yr by ghost82

5 minutes ago, ghost82 said:

It's not very clear to me what you want to do..if you want to play games that check if they run in a vm then you need to know what they check and operate accordingly.

Sometimes adding:

<feature policy='disable'name='hypervisor'/>

is enough to bypass the check.

 

At least on Windows, using this absolutely destroys performance. My XML is somewhat custom but works with no issues in this what I have for Windows

 

  <features>
    <acpi/>
    <apic/>
    <hyperv mode='custom'>
      <relaxed state='on'/>
      <vapic state='on'/>
      <spinlocks state='on' retries='8191'/>
      <vpindex state='on'/>
      <synic state='on'/>
      <stimer state='on'/>
      <reset state='on'/>
      <vendor_id state='on' value='none'/>
      <frequencies state='on'/>
    </hyperv>
  </features>
  <cpu mode='host-passthrough' check='none' migratable='on'>
    <topology sockets='1' dies='1' cores='8' threads='2'/>
    <cache mode='passthrough'/>
    <feature policy='require' name='topoext'/>
    <feature policy='require' name='invtsc'/>
  </cpu>

 

Which allows Windows to run with Hyper-V installed and work with no performance loss.

 

8 minutes ago, ghost82 said:

I'm not understanding why you are talking about nested virtualization (run a vm in a vm).

 

I was given the impression from my research that turning on Hyper-V in Windows (Type-1 Hypervisor) is what allows the VM to bypass the anti-consumer anti-cheats. Without Hyper-V, even with the tweaked XML they will not run. I'm aware Hyper-V is a Microsoft-only feature. Therefore my inquiry is about doing the same, but for Linux.

8 minutes ago, kftX said:

At least on Windows, using this absolutely destroys performance.

Yes this may happen, because you are running a vm, and that flag is needed for efficiency.

8 minutes ago, kftX said:

Which allows Windows to run with Hyper-V installed and work with no performance loss.

Yes, because svm flag is passed from the real cpu since you are passing through the cpu and so if nested virtualization is enabled in the kernel parameters you can run nested vms.

8 minutes ago, kftX said:

I was given the impression from my research that turning on Hyper-V in Windows (Type-1 Hypervisor) is what allows the VM to bypass the anti-consumer anti-cheats

That is a non sense to me, sorry

 

Edited October 18, 20223 yr by ghost82

1 minute ago, ghost82 said:

That is a non sense to me, sorry

 

The best explanation I can give you, is that some game developers code a check into their games that checks if you're running inside a virtualised environment, if you are, the game either gives an error "You can't run this game inside a VM" (Genshin Impact) or just closes itself (Halo Infinite).

 

Installing the Hyper-V feature of Windows allows Windows to report as "virtualization-capable" and therefore the anti-VM check in these games is bypassed and games work as normal.

6 minutes ago, kftX said:

Installing the Hyper-V feature of Windows allows Windows to report as "virtualization-capable" and therefore the anti-VM check in these games is bypassed and games work as normal.

ok, this has no sense to me because I cannot see why an app should check if the software is running in an os which has virtualization capabilities or not: this has nothing to do if the software is running in a vm or not.

Anyway, if you have the svm flag your vm has virtualization capabilities; if it doesn't work (which I expect) the software is checking for something else.

31 minutes ago, ghost82 said:

ok, this has no sense to me because I cannot see why an app should check if the software is running in an os which has virtualization capabilities or not: this has nothing to do if the software is running in a vm or not.

Anyway, if you have the svm flag your vm has virtualization capabilities; if it doesn't work (which I expect) the software is checking for something else.

 

Well I was playing around some more with the XML after what you told me, and got Linux to bypass what I called the "VM check", for future reference if anyone needs it this is what I used in the XML to bypass it:

 

  <cpu mode='host-passthrough' check='none' migratable='on'>
    <topology sockets='1' dies='1' cores='7' threads='2'/>
    <cache mode='passthrough'/>
    <feature policy='require' name='topoext'/>
    <feature policy='require' name='invtsc'/>
  </cpu>
  <clock offset='localtime'>
    <timer name='rtc' present='no' tickpolicy='catchup'/>
    <timer name='pit' present='no' tickpolicy='delay'/>
    <timer name='hpet' present='no'/>
    <timer name='kvmclock' present='no'/>
    <timer name='hypervclock' present='yes'/>
  </clock>

 

Thanks everyone here for the help!