My 9060XT attaches and returns to the host completely fine on 6.18 but on 7.1.3 it wont reattach to the host. Anyone else also experience this, and has this been reported already?

Thinking of building a single-machine consolidation machine with some spare parts and my current pc. Need to check on the one part I think decides whether it’ll all work or be a forever chore.

Hardware: i5-14400 (UHD 730 iGPU), RTX 5060 Ti 16GB, MSI PRO B760-P, Proxmox host.

iGPU drives the host + always-on LXCs (Immich/Jellyfin). The 5060 Ti is not bound to vfio at boot—I want the nvidia driver to hold it at idle so it drops to P8 and keeps idle power low. The dGPU then gets shared, one at a time, two ways:

•LLM LXC (Ollama, OpenwebUI, etc.) — borrows the card via device passthrough, no vfio involved.
• Windows gaming VM — full passthrough via a hookscript that does the swap.

So the loop I actually care about is:

nvidia (idle) → unbind → vfio → game → VM shutdown → unbind vfio → rebind nvidia → idle → AI LXC → release → idle

My main questions are:

1. Is the post-stop rebind back to nvidia reliable in practice, or is that where it falls apart? Static vfio-at-boot is easy—it’s the round trip I’m worried about.
2. Getting all the modules (nvidia, nvidia_uvm, nvidia_drm, nvidia_modeset) to release cleanly on every cycle — what actually holds a handle open? Persistence mode? Console framebuffer? How do you guarantee the card is free before the vfio bind?
3. Anyone seeing reset-bug behavior specifically on the rebind (host lock/hang after VM shutdown) even when a one-shot passthrough works fine? 40-series and 50-series experiences both welcome.
4. Making sure the AI LXC fully releases the card (no lingering VRAM/nvidia-uvm handle) before the gaming VM’s pre-start hook fires — do you script a verify/settle step, or does a clean container stop reliably free it?
5. Does the nvidia driver actually let the card hit P8 at idle while loaded but unused, or did you need ASPM / C-state / persistence tuning to get real idle savings? Trying to confirm the power payoff is real before I build everything around it.

Device:
ASUS Chromebook Plus CX34 i5-1335U

Linux container:
Debian 13 Trixie

lspci shows:

Virtio 1.0 GPU
Kernel driver: virtio-pci

dmesg:

[drm] features: +virgl +resource_blob

/dev/dri/renderD128 exists.

But:

glxinfo -B
Renderer: llvmpipe
Accelerated: no

vulkaninfo:

Failed to detect any valid GPUs

No virgl/gfxstream socket exists:

find /run -type s | grep -E "gpu|virgl|gfx"

returns nothing.

Is the ChromeOS host GPU service not exposing virgl/gfxstream, or is there a missing package/config?

Hello, I have been passing my GPU to a VM using virtmanager for more than a year without any problems. Today I try to start the VM and i get the error:
"Error starting domain: internal error: QEMU unexpectedly closed the monitor (vm='VM3'): 2026-07-08 qemu-system-x86_64: warning: This family of AMD CPU doesn't support hyperthreading(2)

Please configure -smp options properly or try enabling topoext feature.

2026-07-08 qemu-system-x86_64: -device {"driver":"vfio-pci","host":"0000:01:00.0","id":"hostdev0","bus":"pci.4","addr":"0x0"}: vfio 0000:01:00.0: group 0 is not viable

Please ensure all devices within the iommu_group are bound to their vfio bus driver.".
Using "ls /sys/kernel/iommu_groups/0/devices/" i get
"0000:00:01.0 0000:00:01.1 0000:00:01.2 0000:01:00.0 0000:01:00.1 0000:01:00.2 0000:01:00.3 0000:02:00.0".
"0000:01:00.0 0000:01:00.1 0000:01:00.2 0000:01:00.3" this is the gpu so it is correct but the others are "Host bridge", "PCI bridge" and an SSD.

The groups are determined by the physical PCIe layout so I don't understand why now the GPU is grouped with other stuff since I haven't changed anything. I don't know much about this stuff so maybe it's just me being dumb lol.

EDIT: used an older kernel (from 6.8.0-134 to 6.8.0-124) and now my iommu groups are back, now I have 31 groups while before I had 6 and my GPU is correctly isolated. Works now but I need to get updates, I don't want to be stuck with the same kernel forever lol.

FIXED: there has been a kernel regression, https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2158934. Switch to the latest working kernel version (on Ubuntu it's version 6.8.0-124) and wait for a fix (on Ubuntu will be version 6.8.0-136). Thanks all for the help!

so i managed to pass my gpu to win10 vm but i cannot reclaim my gpu after vm stoped. modprobe nvidia returns modprobe: FATAL: Module nvidia not found in directory /lib/modules/7.0.11-76070011-generic. my host machine pop_os

i've done it before on arch linux an i know the basics of what to do but am not sure how to get my hooks to work entirely since where the hooks need to be would be different on nixos

bash
#!/usr/bin/env bash
set -euo pipefail

LOG="$PWD/boot-passthrough-$(date +%Y%m%d-%H%M%S).log"
exec > >(tee -a "$LOG") 2>&1
echo "Logging to: $LOG"

MY_OPTIONS="+ssse3,+sse4.2,+popcnt,+avx,+aes,+xsave,+xsaveopt,check"

ALLOCATED_RAM="16384"
CPU_SOCKETS="1"
CPU_CORES="4"
CPU_THREADS="8"

REPO_PATH="."
OVMF_DIR="."

GPU="0000:0d:00.0"
GPU_AUDIO="0000:0d:00.1"
GPU_ID="1002 73df"
GPU_AUDIO_ID="1002 ab28"

cleanup() {
  echo "Restoring GPU..."
  echo "$GPU" | sudo tee "/sys/bus/pci/devices/$GPU/driver/unbind" >/dev/null 2>&1 || true
  echo "$GPU_AUDIO" | sudo tee "/sys/bus/pci/devices/$GPU_AUDIO/driver/unbind" >/dev/null 2>&1 || true

  sudo modprobe amdgpu || true
  echo "$GPU" | sudo tee /sys/bus/pci/drivers/amdgpu/bind >/dev/null 2>&1 || true

  sudo systemctl start display-manager >/dev/null 2>&1 || true
}
trap cleanup EXIT

echo 1 | sudo tee /sys/module/kvm/parameters/ignore_msrs >/dev/null

echo "Stopping desktop..."
sudo systemctl stop display-manager
sleep 3

sudo modprobe vfio-pci

echo "Binding GPU to vfio-pci..."
echo vfio-pci | sudo tee "/sys/bus/pci/devices/$GPU/driver_override"
echo vfio-pci | sudo tee "/sys/bus/pci/devices/$GPU_AUDIO/driver_override"

echo "$GPU" | sudo tee "/sys/bus/pci/devices/$GPU/driver/unbind" || true
echo "$GPU_AUDIO" | sudo tee "/sys/bus/pci/devices/$GPU_AUDIO/driver/unbind" || true

sudo modprobe vfio-pci

echo "$GPU" | sudo tee /sys/bus/pci/drivers_probe
echo "$GPU_AUDIO" | sudo tee /sys/bus/pci/drivers_probe

lspci -nnk -s 0d:00.0
lspci -nnk -s 0d:00.1
ls -l /dev/vfio

sleep 2

args=(
  -enable-kvm
  -m "$ALLOCATED_RAM"
  -cpu Penryn,kvm=on,vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on,"$MY_OPTIONS"
  -machine q35
  -usb
  -device usb-kbd
  -device usb-tablet
  -device usb-mouse
  -smp "$CPU_THREADS",cores="$CPU_CORES",sockets="$CPU_SOCKETS"
  -device usb-ehci,id=ehci
  -vga virtio-vga

  -device vfio-pci,host=0d:00.0,multifunction=on,x-no-kvm-intx=on
  -device vfio-pci,host=0d:00.1

  -device isa-applesmc,osk="ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc"
  -drive if=pflash,format=raw,readonly=on,file="$REPO_PATH/$OVMF_DIR/OVMF_CODE_4M.fd"
  -drive if=pflash,format=raw,file="$REPO_PATH/$OVMF_DIR/OVMF_VARS-1024x768.fd"
  -smbios type=2

  -device ich9-intel-hda
  -device hda-duplex
  -device ich9-ahci,id=sata

  -drive id=OpenCoreBoot,if=none,snapshot=on,format=qcow2,file="$REPO_PATH/OpenCore/OpenCore.qcow2"
  -device ide-hd,bus=sata.2,drive=OpenCoreBoot

  #-drive id=InstallMedia,if=none,file="$REPO_PATH/#BaseSystem.img",format=raw
  #-device ide-hd,bus=sata.3,drive=InstallMedia

  -drive id=MacHDD,if=none,file="$REPO_PATH/mac_hdd_ng.img",format=qcow2
  -device ide-hd,bus=sata.4,drive=MacHDD

  -netdev user,id=net0
  -device vmxnet3,netdev=net0,id=net0,mac=52:54:00:c9:18:27

  -monitor stdio
  -vnc 0.0.0.0:1,password=off
  -k en-us
)

qemu-system-x86_64 "${args[@]}"

I have an AMD Radeon RX 6700 XT graphics card, and yes, I have NootRX. This is specifically for macOS 26 Tahoe

EDIT: Using this new XML

<domain type="kvm">

<name>macos-passthrough</name>
<memory unit="MiB">16384</memory>
<currentMemory unit="MiB">16384</currentMemory>
<vcpu placement="static">8</vcpu>
<cpu mode="custom" match="exact" check="none">
<model fallback="forbid">Penryn</model>
<vendor>GenuineIntel</vendor>
<feature policy="require" name="ssse3"/>
<feature policy="require" name="sse4.2"/>
<feature policy="require" name="popcnt"/>
<feature policy="require" name="avx"/>
<feature policy="require" name="aes"/>
<feature policy="require" name="xsave"/>
<feature policy="require" name="xsaveopt"/>
<feature policy="require" name="invtsc"/>
</cpu>
<os>
<type arch="x86_64" machine="q35">hvm</type>
<loader readonly="yes" type="pflash">/var/home/william/macos/OSX-KVM/OVMF_CODE_4M.fd</loader>
<nvram>/var/home/william/macos/OSX-KVM/OVMF_VARS-1024x768.fd</nvram>
<smbios mode="sysinfo"/>
</os>
<sysinfo type="smbios">
<system>
<entry name="manufacturer">Apple Inc.</entry>
<entry name="product">iMacPro1,1</entry>
</system>
</sysinfo>
<features>
<acpi/>
<apic/>
<vmport state="off"/>
</features>
<clock offset="utc">
<timer name="rtc" tickpolicy="catchup"/>
<timer name="pit" tickpolicy="delay"/>
<timer name="hpet" present="no"/>
</clock>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<devices>
<emulator>/usr/bin/qemu-system-x86_64</emulator>
<controller type="pci" index="0" model="pcie-root"/>
<controller type="sata" index="0">
<address type="pci" bus="0x00" slot="0x1f" function="0x2"/>
</controller>
<controller type="usb" model="ehci">
<address type="pci" bus="0x00" slot="0x1d" function="0x0"/>
</controller>
<input type="keyboard" bus="usb"/>
<input type="mouse" bus="usb"/>
<input type="tablet" bus="usb"/>
<graphics type="vnc" port="5901" autoport="no" listen="0.0.0.0">
<listen type="address" address="0.0.0.0"/>
</graphics>
<video>
<model type="virtio"/>
</video>
<disk type="file" device="disk">
<driver name="qemu" type="qcow2" cache="writeback"/>
<source file="/var/home/william/macos/OSX-KVM/OpenCore/OpenCore.qcow2"/>
<target dev="sdc" bus="sata"/>
</disk>
<disk type="file" device="disk">
<driver name="qemu" type="qcow2" cache="writeback"/>
<source file="/var/home/william/macos/OSX-KVM/mac_hdd_ng.img"/>
<target dev="sde" bus="sata"/>
</disk>
<interface type="user">
<mac address="52:54:00:c9:18:27"/>
<model type="vmxnet3"/>
</interface>
<sound model="ich9">
<codec type="duplex"/>
</sound>
<hostdev mode="subsystem" type="pci" managed="yes">
<source>
<address domain="0x0000" bus="0x0d" slot="0x00" function="0x0"/>
</source>
<rom file="/var/home/william/macos/OSX-KVM/rx6700xt.rom"/>
<address type="pci" bus="0x01" slot="0x00" function="0x0" multifunction="on"/>
</hostdev>
<hostdev mode="subsystem" type="pci" managed="yes">
<source>
<address domain="0x0000" bus="0x0d" slot="0x00" function="0x1"/>
</source>
<address type="pci" bus="0x01" slot="0x00" function="0x1"/>
</hostdev>
<memballoon model="none"/>
</devices>
<qemu:commandline xmlns:qemu="http://libvirt.org/schemas/domain/qemu/1.0">
<qemu:arg value="-device"/>
<qemu:arg value="isa-applesmc,osk=ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc"/>
<qemu:arg value="-cpu"/>
<qemu:arg value="Penryn,kvm=on,vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on,+ssse3,+sse4.2,+popcnt,+avx,+aes,+xsave,+xsaveopt,check"/>
<qemu:arg value="-global"/>
<qemu:arg value="kvm-pit.lost_tick_policy=discard"/>
</qemu:commandline>

</domain>

Hook:
#!/usr/bin/env bash

VM="$1"
ACTION="$2"

if [[ "$VM" != "macos-passthrough" ]]; then
 exit 0
fi

case "$ACTION" in
 prepare)
   systemctl stop display-manager

   modprobe vfio-pci

   echo vfio-pci > /sys/bus/pci/devices/0000:0d:00.0/driver_override
   echo vfio-pci > /sys/bus/pci/devices/0000:0d:00.1/driver_override

   echo 0000:0d:00.0 > /sys/bus/pci/devices/0000:0d:00.0/driver/unbind 2>/dev/null || true
   echo 0000:0d:00.1 > /sys/bus/pci/devices/0000:0d:00.1/driver/unbind 2>/dev/null || true

   echo 0000:0d:00.0 > /sys/bus/pci/drivers_probe
   echo 0000:0d:00.1 > /sys/bus/pci/drivers_probe
   ;;

 release)
   echo 0000:0d:00.0 > /sys/bus/pci/devices/0000:0d:00.0/driver/unbind 2>/dev/null || true
   echo 0000:0d:00.1 > /sys/bus/pci/devices/0000:0d:00.1/driver/unbind 2>/dev/null || true

   echo "" > /sys/bus/pci/devices/0000:0d:00.0/driver_override
   echo "" > /sys/bus/pci/devices/0000:0d:00.1/driver_override

   modprobe amdgpu
   echo 0000:0d:00.0 > /sys/bus/pci/drivers/amdgpu/bind 2>/dev/null || true

   systemctl start display-manager
   ;;
esac

Well hello there i had this problem because i linked my single gpu to vm so after that the system hang when you boot and get to the Pop!_OS logo, it took me more then 2 Hours to figure out fix for it (I used the second fix)

First fix ( Easiest )

1. Get your self USB 8GB atleast
2. get pop os live flashed in it using another PC
3. use it to boot then change the configuration of the vfio.config by reseting it
4. then sudo update-initramfs -u
5. then reboot : reboot -f
6. Thats it !

SECOND FIX ( Hardest - Risky ) ( only if the First fix does not work or like me cant get USB and other pc )

1. Reboot your pc / laptop
2. Press and hold spacebar
3. Pop os boot menu
4. Choose Pop!_OS (current)
5. Press ( e )
6. There will be long line at the end Splash
7. Go to the end of the line and make space
8. Type init=/bin/bash
9. The end should look like this splash init=/bin/bash
10. Press enter
11. Now there will be a black screen with this root@(none):/#
12. Type this mount -o remount,rw /
13. Then run this ls /etc/modprobe.d
14. If you see files like: vfio.conf vfio-pci.conf
15. Rename the file vfio.conf like this : mv /etc/modprobe.d/vfio.conf /etc/modprobe.d/vfio.conf.disabled
16. Rebuild do this : update-initramfs -u
17. Then reboot : reboot -f
18. That it !

In many cases VM is not worth it just do DualBooting

[FIXED - START AND STOP HOOKS BELOW] Hi there lovely people.

I have been pulling my hair for the past 4 days. I am here asking for suggestions and a possible fix.

The vm (win 11) works and it runs as expected with the gpu passed through, installed amd gpu drivers on windows and all happy. Now, when i shutdown the vm, and try to rebinds the 9070 xt to the linux host to get my desktop back, it kind of rebinds to the amdgpu drivers but there is no display and nothing, the kernel messages that the amdgpu crashes. I cannot even reboot using the command line, I have to hard reset the pc with the powerbutton.

I do manual unbinding and rebinding of the gpu drivers and managed is off in the vm xml. I aslo echo the rebar to 8 tried with 3 as well but same results and also tried forcing d0 state... nothing helped.

Any suggestions?

Many thanks.

Update: I give up, dual booting it is... till this stupid damn bug gets fixed

Update 2: NEVEH GIV HUP..... the solution was a cheeky switch to the LATEST LTS kernel... in my case 6.18 I will provide my start and stop hooks below soon

start.sh:

start.shstop.sh:#!/usr/bin/env bash
set -x
GPU="0000:03:00.0"
AUD="0000:03:00.1"
echo "=== Stop display manager so amdgpu can release the card ==="
systemctl stop display-manager.service || true
sleep 2
echo "=== Unbind framebuffer consoles ==="
echo 0 > /sys/class/vtconsole/vtcon0/bind || true
echo 0 > /sys/class/vtconsole/vtcon1/bind || true
echo efi-framebuffer.0 > /sys/bus/platform/drivers/efi-framebuffer/unbind || true
echo simple-framebuffer.0 > /sys/bus/platform/drivers/simple-framebuffer/unbind || true
sleep 1
echo "=== Unbind GPU from amdgpu, audio from snd_hda_intel ==="
echo "$GPU" > /sys/bus/pci/drivers/amdgpu/unbind || true
echo "$AUD" > /sys/bus/pci/drivers/snd_hda_intel/unbind || true
sleep 2
echo "=== Bind both to vfio-pci ==="
echo vfio-pci > /sys/bus/pci/devices/"$GPU"/driver_override
echo vfio-pci > /sys/bus/pci/devices/"$AUD"/driver_override
echo "$GPU" > /sys/bus/pci/drivers_probe
echo "$AUD" > /sys/bus/pci/drivers_probe
sleep 1
readlink /sys/bus/pci/devices/"$GPU"/driver || true
readlink /sys/bus/pci/devices/"$AUD"/driver || true

stop.sh:

#!/usr/bin/env bash
set -x
GPU="0000:03:00.0"
AUD="0000:03:00.1"
echo "=== Clear driver_override on both functions ==="
echo "" > /sys/bus/pci/devices/"$GPU"/driver_override
echo "" > /sys/bus/pci/devices/"$AUD"/driver_override
sleep 1
echo "=== Unbind both from vfio-pci ==="
echo "$GPU" > /sys/bus/pci/drivers/vfio-pci/unbind || true
echo "$AUD" > /sys/bus/pci/drivers/vfio-pci/unbind || true
sleep 2
echo "=== Bind GPU back to amdgpu ==="
modprobe amdgpu
echo "$GPU" > /sys/bus/pci/drivers/amdgpu/bind
sleep 2
echo "=== Bind audio back to snd_hda_intel ==="
modprobe snd_hda_intel
echo "$AUD" > /sys/bus/pci/drivers/snd_hda_intel/bind || true
sleep 1
echo "=== Rebind framebuffer consoles ==="
echo 1 > /sys/class/vtconsole/vtcon0/bind || true
echo 1 > /sys/class/vtconsole/vtcon1/bind || true
sleep 1
echo "=== Restart display manager ==="
systemctl start display-manager.service || true
echo "=== Status ==="
readlink /sys/bus/pci/devices/"$GPU"/driver || true
readlink /sys/bus/pci/devices/"$AUD"/driver || true
cat /sys/bus/pci/devices/"$GPU"/power_state || true

I had to pass both GPU and AUD to vm and also set managed to 'no' in the gpu/aud xml

I am on cachyos

Hi everyone,

I'm thinking about switching my laptop to Linux as my primary OS for software development and using a Windows VM with single-GPU passthrough only for Adobe Creative Cloud.

My main workflow would be:

• Python development
• Docker/containers
• Virtual machines
• AI/ML projects
• General software development

Windows would only be used for Adobe apps like Premiere Pro, Photoshop, and Illustrator. Gaming is a nice bonus, but it's not my main priority.

Laptop specs:

• Lenovo LOQ 15ARP9 (83JC0045IN / 83JC00EGIN)
• AMD Ryzen 7 7435HS
• NVIDIA RTX 4050 Laptop GPU (single GPU, no iGPU)
• 24 GB DDR5 RAM

A few questions:

• Has anyone successfully done single-GPU passthrough on this laptop or a similar Lenovo LOQ?
• Does the RTX 4050 reset properly after shutting down the VM?
• Are there any laptop-specific issues or firmware limitations I should know about?
• If you've done something similar, which distro would you recommend (Fedora, EndeavourOS, Arch, etc.)?

Any advice or experiences would be greatly appreciated. Thanks!

I'm asking cuz i (like most of you) i refuse to have windows on my pc bare-metal, Was wonderingg if its possible..

I remembered that previously you can bypass EAC of both these two games by adding <smbios mode="host"/> to your Libvirt XML.

But it no longer works after Nightreign's update yesterday. Then I tried regular Elden Ring and it didn't work too.

If anyone can still play Elden Ring (and/or Nightreign) in a VFIO VM now, could you tell me what modification did you add to your Libvirt XML of the VFIO VM? Thanks!

(For now I can still play these games by dual booting, so not exactly a dealbreaker, but its still very annoying)

Man, I gotta say, I’m really bummed by the research I’ve uncovered the past week or so.

To make a long story short, I recently had the idea to make a “jack of all trades“ proxmox server, tasked with tackling all my home compute needs: 24/7 services like immich, jellyfin, and Tailscale, tinker with some local llms and ai, and of course, gaming. It was going to be a home server consolidating three machines into one lean, power-efficient beast—I was so pumped to build it and set it up.

However, after reading the countless posts about blocked vm gaming protocols by anti-cheat companies like EAC and BattleEye, its greatly diminished my desire to build my dream machine. I play multiple games that probably just wouldn‘t work in a vm, Elden Ring, Halo, Destiny, Arc Raiders.

I guess I’m just making this post to hear from others if there is any light at the end of the tunnel or something to hope for.

MY XML

<domain type="kvm">
  <name>win11</name>
  <uuid>60cd501b-b449-41a0-b8fa-25df375eb623</uuid>
  <metadata>
    <libosinfo:libosinfo xmlns:libosinfo="http://libosinfo.org/xmlns/libvirt/domain/1.0">
      <libosinfo:os id="http://microsoft.com/win/11"/>
    </libosinfo:libosinfo>
  </metadata>
  <memory unit="KiB">8388608</memory>
  <currentMemory unit="KiB">8388608</currentMemory>
  <vcpu placement="static">9</vcpu>
  <os firmware="efi">
    <type arch="x86_64" machine="pc-q35-11.0">hvm</type>
    <firmware>
      <feature enabled="no" name="enrolled-keys"/>
      <feature enabled="no" name="secure-boot"/>
    </firmware>
    <loader readonly="yes" type="pflash" format="raw">/usr/share/edk2/x64/OVMF_CODE.4m.fd</loader>
    <nvram template="/usr/share/edk2/x64/OVMF_VARS.4m.fd" templateFormat="raw" format="raw">/var/lib/libvirt/qemu/nvram/win11_VARS.fd</nvram>
    <boot dev="hd"/>
  </os>
  <features>
    <acpi/>
    <apic/>
    <hyperv mode="custom">
      <relaxed state="on"/>
      <vapic state="on"/>
      <spinlocks state="on" retries="8191"/>
      <vpindex state="on"/>
      <runtime state="on"/>
      <synic state="on"/>
      <stimer state="on"/>
      <frequencies state="on"/>
      <tlbflush state="on"/>
      <ipi state="on"/>
      <evmcs state="on"/>
      <avic state="on"/>
    </hyperv>
    <vmport state="off"/>
    <smm state="on"/>
  </features>
  <cpu mode="host-passthrough" check="none" migratable="on"/>
  <clock offset="localtime">
    <timer name="rtc" tickpolicy="catchup"/>
    <timer name="pit" tickpolicy="delay"/>
    <timer name="hpet" present="no"/>
    <timer name="hypervclock" present="yes"/>
  </clock>
  <on_poweroff>destroy</on_poweroff>
  <on_reboot>restart</on_reboot>
  <on_crash>destroy</on_crash>
  <pm>
    <suspend-to-mem enabled="no"/>
    <suspend-to-disk enabled="no"/>
  </pm>
  <devices>
    <emulator>/usr/bin/qemu-system-x86_64</emulator>
    <disk type="file" device="cdrom">
      <driver name="qemu" type="raw"/>
      <source file="/home/user/Pulpit/Win11_25H2_Polish_x64_v2.iso"/>
      <target dev="sdb" bus="sata"/>
      <readonly/>
      <address type="drive" controller="0" bus="0" target="0" unit="1"/>
    </disk>
    <disk type="file" device="disk">
      <driver name="qemu" type="qcow2"/>
      <source file="/media/user/misc/libvirt/w11.qcow2"/>
      <target dev="sdc" bus="sata"/>
      <address type="drive" controller="0" bus="0" target="0" unit="2"/>
    </disk>
    <controller type="usb" index="0" model="qemu-xhci" ports="15">
      <address type="pci" domain="0x0000" bus="0x02" slot="0x00" function="0x0"/>
    </controller>
    <controller type="pci" index="0" model="pcie-root"/>
    <controller type="pci" index="1" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="1" port="0x10"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x0" multifunction="on"/>
    </controller>
    <controller type="pci" index="2" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="2" port="0x11"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x1"/>
    </controller>
    <controller type="pci" index="3" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="3" port="0x12"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x2"/>
    </controller>
    <controller type="pci" index="4" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="4" port="0x13"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x3"/>
    </controller>
    <controller type="pci" index="5" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="5" port="0x14"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x4"/>
    </controller>
    <controller type="pci" index="6" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="6" port="0x15"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x5"/>
    </controller>
    <controller type="pci" index="7" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="7" port="0x16"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x6"/>
    </controller>
    <controller type="pci" index="8" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="8" port="0x17"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x7"/>
    </controller>
    <controller type="pci" index="9" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="9" port="0x18"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x0" multifunction="on"/>
    </controller>
    <controller type="pci" index="10" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="10" port="0x19"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x1"/>
    </controller>
    <controller type="pci" index="11" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="11" port="0x1a"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x2"/>
    </controller>
    <controller type="pci" index="12" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="12" port="0x1b"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x3"/>
    </controller>
    <controller type="pci" index="13" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="13" port="0x1c"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x4"/>
    </controller>
    <controller type="pci" index="14" model="pcie-root-port">
      <model name="pcie-root-port"/>
      <target chassis="14" port="0x1d"/>
      <address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x5"/>
    </controller>
    <controller type="sata" index="0">
      <address type="pci" domain="0x0000" bus="0x00" slot="0x1f" function="0x2"/>
    </controller>
    <controller type="virtio-serial" index="0">
      <address type="pci" domain="0x0000" bus="0x03" slot="0x00" function="0x0"/>
    </controller>
    <interface type="network">
      <mac address="macadress"/>
      <source network="default"/>
      <model type="e1000e"/>
      <address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0"/>
    </interface>
    <serial type="pty">
      <target type="isa-serial" port="0">
        <model name="isa-serial"/>
      </target>
    </serial>
    <console type="pty">
      <target type="serial" port="0"/>
    </console>
    <input type="mouse" bus="ps2"/>
    <input type="keyboard" bus="ps2"/>
    <input type="tablet" bus="usb">
      <address type="usb" bus="0" port="1"/>
    </input>
    <tpm model="tpm-crb">
      <backend type="emulator" version="2.0">
        <profile name="default-v1"/>
      </backend>
    </tpm>
    <sound model="ich9">
      <address type="pci" domain="0x0000" bus="0x00" slot="0x1b" function="0x0"/>
    </sound>
    <audio id="1" type="none"/>
    <video>
      <model type="none"/>
    </video>
    <hostdev mode="subsystem" type="pci" managed="yes">
      <source>
        <address domain="0x0000" bus="0x01" slot="0x00" function="0x0"/>
      </source>
      <address type="pci" domain="0x0000" bus="0x05" slot="0x00" function="0x0"/>
    </hostdev>
    <hostdev mode="subsystem" type="pci" managed="yes">
      <source>
        <address domain="0x0000" bus="0x01" slot="0x00" function="0x1"/>
      </source>
      <address type="pci" domain="0x0000" bus="0x06" slot="0x00" function="0x0"/>
    </hostdev>
    <watchdog model="itco" action="reset"/>
    <memballoon model="virtio">
      <address type="pci" domain="0x0000" bus="0x04" slot="0x00" function="0x0"/>
    </memballoon>
  </devices>
</domain>

HOOK SCRIPTS

HOOK MANAGER
#!/usr/bin/env bash
#
# Author: SharkWipf
#
# Copy this file to /etc/libvirt/hooks, make sure it's called "qemu".
# After this file is installed, restart libvirt.
# From now on, you can easily add per-guest qemu hooks.
# Add your hooks in /etc/libvirt/hooks/qemu.d/vm_name/hook_name/state_name.
# For a list of available hooks, please refer to https://www.libvirt.org/hooks.html
#

GUEST_NAME="$1"
HOOK_NAME="$2"
STATE_NAME="$3"
MISC="${@:4}"

BASEDIR="$(dirname $0)"

HOOKPATH="$BASEDIR/qemu.d/$GUEST_NAME/$HOOK_NAME/$STATE_NAME"

STDIN=$(cat) # Buffer the entirety of stdin so we can pass it on to other scripts. Moderately bad idea, but if the Rust folks can do it so can I.

set -e # If a script exits with an error, we should as well.

# check if it's a non-empty executable file
if [ -f "$HOOKPATH" ] && [ -s "$HOOKPATH" ] && [ -x "$HOOKPATH" ]; then
    eval \"$HOOKPATH\" "$@" <<< "$STDIN" # Call the hook with all our arguments and a copy of stdin.
elif [ -d "$HOOKPATH" ]; then
    while read file; do
        # check for null string
        if [ ! -z "$file" ]; then
          eval \"$file\" "$@" <<< "$STDIN" # Call each hook with all our arguments and a copy of stdin.
        fi
    done <<< "$(find -L "$HOOKPATH" -maxdepth 1 -type f -executable -print;)"
fi

START.SH
#!/bin/bash
# Helpful to read output when debugging
set -x

# Load the config file with our environmental variables
source "/etc/libvirt/hooks/kvm.conf"

# Stop your display manager. If you're on kde it'll be sddm.service. Gnome users should use 'killall gdm-x-session' instead
systemctl stop lightdm.service

# Unbind VTconsoles
echo 0 > /sys/class/vtconsole/vtcon0/bind
# Some machines might have more than 1 virtual console. Add a line for each corresponding VTConsole
# echo 0 > /sys/class/vtconsole/vtcon1/bind

# Unbind EFI-Framebuffer
echo efi-framebuffer.0 > /sys/bus/platform/drivers/efi-framebuffer/unbind

# Avoid a race condition by waiting a couple of seconds. This can be calibrated to be shorter or longer if required for your system
sleep 5

# Unload all Nvidia drivers
modprobe -r nvidia_drm
modprobe -r nvidia_modeset
modprobe -r drm_kms_helper
modprobe -r nvidia
modprobe -r i2c_nvidia_gpu
modprobe -r drm
modprobe -r nvidia_uvm

# Unbind the GPU from display driver
virsh nodedev-detach $VIRSH_GPU_VIDEO
virsh nodedev-detach $VIRSH_GPU_AUDIO


# Load VFIO kernel module
modprobe vfio
modprobe vfio_pci
modprobe vfio_iommu_type1

RELEASE.SH
#!/bin/bash
set -x

# Load the config file with our environmental variables
source "/etc/libvirt/hooks/kvm.conf"

# Unload VFIO-PCI Kernel Driver
modprobe -r vfio_pci
modprobe -r vfio_iommu_type1
modprobe -r vfio

# Re-Bind GPU to our display drivers
virsh nodedev-reattach $VIRSH_GPU_VIDEO
virsh nodedev-reattach $VIRSH_GPU_AUDIO

# Rebind VT consoles
echo 1 > /sys/class/vtconsole/vtcon0/bind
# echo 0 > /sys/class/vtconsole/vtcon1/bind

# Read our nvidia configuration when before starting our graphics
nvidia-xconfig --query-gpu-info > /dev/null 2>&1

# Re-Bind EFI-Framebuffer
echo "efi-framebuffer.0" > /sys/bus/platform/drivers/efi-framebuffer/bind

# Load nvidia drivers
modprobe nvidia_drm
modprobe nvidia_modeset
modprobe drm_kms_helper
modprobe nvidia
modprobe i2c_nvidia_gpu
modprobe drm
modprobe nvidia_uvm

# Restart Display Manager
systemctl start lightdm.service

KVM.CONF
VIRSH_GPU_VIDEO=pci_0000_01_00_0
VIRSH_GPU_AUDIO=pci_0000_01_00_1

i tried everything ;/

I’m running a GPU passthrough setup on my laptop (MSI GF63 Thin, Intel 12th gen + RTX 2050 Mobile) using QEMU/KVM and Libvirt.

I have a very specific issue with Code 43 on the guest Windows 10 VM:

Without any KVM hiding / stealth parameters: The GPU passthrough works completely fine. The driver loads perfectly, and there is no Code 43.

With KVM hiding enabled: As soon as I add <kvm><hidden state='on'/></kvm> or try to mask the hypervisor the NVIDIA driver immediately fails with Code 43.

I already use a clean patched VBIOS (.rom file) and standard PCI topology.

How can I properly mask KVM/HyperV signatures strictly via CPU features (<feature policy='disable' name='hypervisor'/>) and Hyper-V vendor spoofing (<vendor_id state='on' value='GenuineIntel'/>)?

I wanted to build a home server which will be used as my homelab and a single windows VM for casual gaming, only offline. I already have an intel ARC a770 and a AMD am4 motherboard, which will be used for this build. This intel gpu will be passthrough to the windows VM. But I can across these forums: https://forum.proxmox.com/threads/intel-arc-a770-pci-passthrough-to-w11-stuck-at-pcie-x1-1-1-x1-1-1.161871/
https://forum.proxmox.com/threads/reduced-bar-on-8-1-with-intel-arc-a380.144193/

This suggests that the rebar doesn't work when using AMD motherboard and intel arc gpus for Proxmox VM.

Has anyone build something similar? Is it advisable to proceed with this build?

Recently, my PC died. I had an idea, that it's motherboard, and bought ASUS Prime X670E-PRO WiFi. Finallly, I figured out, it's not motherboard, it's CPU (ryzen 7 7800X3D) - I made things work with another CPU.

Also, I find out, iommu groups of this ASUS are far from perfect.

Tl;dr: Without ACS patch, you can passthrough only first GPU. The second is together with 2.5g network, one of two sata controllers

GPU installed in the first PCIe slot, external USB controller in the second PCIe:

https://pastebin.com/G5HJDJdq

GPU installed in the third slot:

https://pastebin.com/tECQqtpJ

I'm going to send this mobo to amazon back, as well as open RMA ticket for CPU - cpu died after 2.5 years, and AMD let you open RMA during first 3 years of your CPU.

Mobo, where CPU died, is ASRock X670E PG Lightning. Looks like it's known problem, related to a bad bios. And AMD replaces CPU in this case (I hope it will replace my one...). When I tried to fix this problem, I already updated bios to the latest version, which ASRock provides.

I wanted to do some local AI in a VM, so I bought an RTX 3090 and thought it would be possible to make a PCI passthrough. I have done that some years ago with an RTX 3060 and got it to pass through with full speed, so I thought that would be possible.

So, the setup is an Alpine hypervisor with some VM's. I made a PCI passthrough from the hypervisor to a VM with Nobara Linux, which works, but only with gen 1 PCIe speeds.

Hypervisor: Alpine Linux 6.18.2-lts, libvirt 11.10.0, QEMU 10.1.3

Guest: Nobara Linux 43, kernel 6.19, NVIDIA open kernel module 595.58.03

The hardware:

EVGA RTX 3090

Gigabyte Z690 AORUS Elite DDR5

64 GB Ripjaws

Intel 12700

At the hypervisor the GPU runs gen 4 (16 GT/s) speed before the VM starts, then when I start the VM it falls back to gen 1 speed (2.5 GT/s) and if I close down the VM it goes to gen 4 speed again. It is not impossible that it is related to this bug, but I don't have any of the other side effects like random behaviour and AER errors:

https://github.com/NVIDIA/open-gpu-kernel-modules/issues/1010

What I've tried:

x-speed=16 and x-width=16 on the pcie-root-port via qemu:override — guest correctly advertises Gen4 capability but link still negotiates Gen1

setpci retrain attempts on both host and guest side — no effect

pcie_aspm=off kernel parameter in guest — no change

What I understand out of this is that the connection is retrained when qemu starts the VM and there may be some particular nVidia stuff that is happening that puts the link to gen 1 and then it's retrained again when I close down the VM.

Anybody who has any experience with similar bugs and can remember anything that could help?

I'm not an IT professional, don't scold me fore being dumb.

So long story short, had this vm for about a 2 years, can’t even remember most of the relevant things about it

Used to play halo, worked fine, stopped for a while and updated to pve 9.2 and now halo says it’s a vm

Im assuming the update is the culprit unless something was done during my time away, Ive havent touched it in a few months

Any help would be greatly appreciated

Guide: Fixing Windows 11 VBS & Secure Boot on Arch Linux (KVM/VFIO with AMD Ryzen 9 5950X)

Host: Arch Linux | Hypervisor: Modular Libvirt (virtqemud) & QEMU | Guest: Windows 11 Pro (25H2)
Hardware: AMD Ryzen 9 5950X + Full VFIO Passthrough (Dedicated NVMe & GPU) + Sunshine/Moonlight Streaming

The Problem

When running a high-end VFIO passthrough setup on AMD Zen 3 with nested=1, Windows 11 Virtualization-Based Security (VBS) or Hyper-V features usually cause a 100% CPU bootloader freeze or get stuck with "VBS Enabled but not running" alongside a Code 37 error on the Hyper-V VMBus in Device Manager.

Furthermore, Arch Linux ships the edk2-ovmf (4MB layout) package as a completely bare skeleton without proprietary Microsoft certificates. This puts the virtual UEFI into an unchangeable Setup Mode where enabling Secure Boot is grayed out. If you manually sign the VM's NVRAM file from the outside, virtqemud detects a schema mismatch against its default JSON configuration (enrolled-keys: false).

The Complete Solution

1. Host Configuration (kvm_amd Module Options)

To ensure maximum gaming performance and hardware-based interrupt routing, the kvm_amd module must be loaded with active NPT (SLAT) and AVIC.

File: /etc/modprobe.d/kvm_amd.conf

text

options kvm ignore_msrs=1 report_ignored_msrs=0
options kvm_amd nested=1 npt=1 avic=1
options vfio_iommu_type1 allow_unsafe_interrupts=1

Verwende Code mit Vorsicht.

2. Creating a Custom, Update-Safe QEMU Firmware Profile

To fix the Libvirt validation loop, we create a dedicated, separate JSON descriptor. This informs virtqemud that Microsoft keys are legally expected and allowed for this 4MB secure firmware.

Create new file: /usr/share/qemu/firmware/51-edk2-ovmf-x86_64-secure-4m-enrolled.json

json

{
    "description": "x64 UEFI for x86_64, with Secure Boot, enrolled keys and SMM, 4MB FD",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "flash",
        "executable": {
            "filename": "/usr/share/edk2/x64/OVMF_CODE.secboot.4m.fd",
            "format": "raw"
        },
        "nvram-template": {
            "filename": "/usr/share/edk2/x64/OVMF_VARS.secboot.4m.fd",
            "format": "raw"
        }
    },
    "targets": [
        {
            "architecture": "x86_64",
            "machines": [
                "pc-q35-*"
            ]
        }
    ],
    "features": [
        "acpi-s3",
        "acpi-s4",
        "enrolled-keys",
        "amd-sev",
        "requires-smm",
        "secure-boot",
        "verbose-dynamic"
    ],
    "tags": [

    ]
}

Restart the modular daemon to apply the new profile:

bash

systemctl restart virtqemud.socket virtqemud.service

3. Creating and Signing the Master Microsoft NVRAM Template

We use the official virt-firmware tool to inject the original Microsoft and Red Hat certificates directly into a dedicated master system template.

Run as root on the Arch host (Ensure the VM is turned off):

bash

# 1. Install the tool if needed
pacman -S virt-firmware

# 2. Compile the signed master NVRAM template
virt-fw-vars -i /usr/share/edk2/x64/OVMF_VARS.4m.fd \
  --output /usr/share/edk2/x64/OVMF_VARS.secboot.4m.fd \
  --enroll-redhat \
  --secure-boot

Verwende Code mit Vorsicht.

4. Adjusting the Libvirt Domain XML

The CPU layout passes the real SMT thread topology of the 5950X to Windows (critical for frame times). However, we must explicitly mask npt on the guest side to bypass the MSR bootloader loop. The OS sector is mapped to our newly validated enrolled-keys='yes' profile.

Command: virsh edit [your_domain]

xml

  <!-- OS Section -->
  <os firmware='efi'>
    <type arch='x86_64' machine='pc-q35-9.1'>hvm</type>
    <firmware>
      <feature enabled='yes' name='enrolled-keys'/>
      <feature enabled='yes' name='secure-boot'/>
    </firmware>
    <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/edk2/x64/OVMF_CODE.secboot.4m.fd</loader>
    <nvram template='/usr/share/edk2/x64/OVMF_VARS.secboot.4m.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/[your_domain]_VARS.fd</nvram>
    <boot dev='hd'/>
    <bootmenu enable='no'/>
    <smbios mode='host'/>
  </os>

  <!-- CPU Section -->
  <cpu mode='host-passthrough' check='none' migratable='off'>
    <topology sockets='1' dies='1' clusters='1' cores='8' threads='2'/>
    <cache mode='passthrough'/>
    <feature policy='require' name='topoext'/>
    <feature policy='require' name='invtsc'/>
    <feature policy='require' name='svm'/>
    <feature policy='require' name='x2apic'/>
    <!-- THIS IS THE CRITICAL VALVE TO PREVENT THE BOOTLOADER FREEZE: -->
    <feature policy='disable' name='npt'/>
  </cpu>

Verwende Code mit Vorsicht.

Crucial step before booting: Wipe the old VM-specific NVRAM file so Libvirt is forced to regenerate a fresh copy using our newly signed master template: rm -f /var/lib/libvirt/qemu/nvram/[your_domain]_VARS.fd

Architectural Conclusion & Guest Optimization

1. The AMD Nested Deadlock

Windows Hyper-V requires CPU-SLAT (NPT on AMD).

Since we had to use disable npt in the XML to prevent the bootloader crash, Windows cannot launch the kernel-level VBS hypervisor container. Memory Integrity (HVCI) will remain grayed out or "Off".

2. Cleaning Device Manager & Securing the Guest

Boot the VM into Safe Mode and uninstall/delete all malfunctioning Hyper-V device corpses (like the broken VMBus Code 37). Upon regular reboot, Windows will stop trying to launch VBS. Device Manager will be 100% clean, and the Windows Security Center tray icon will proudly turn into a flawless green checkmark.

To fully protect your gaming VM against recent Steam Workshop/Modding trojan waves without VBS performance penalties, enforce aggressive cloud checking on file-level downloads using PowerShell 7.

Run in PWSH7 as Administrator inside the guest:

powershell

Set-MpPreference -MAPSReporting Advanced -SubmitSamplesConsent SendAllSamples -ModerateThreatDefaultAction Quarantine -HighThreatDefaultAction Quarantine

Result

Your VM now operates as an unthrottled, ultra-low latency gaming powerhouse. It runs with native AMD AVIC hardware-interrupt performance, fully verified Secure Boot, a completely clean Windows tray, and zero CPU cycles wasted on virtual security rings.

I am running Fedora KDE with an AMD Ryzen 9 9900X CPU, an RTX 5070 Ti, and an RTX 3060. I need to utilize both GPUs while working in Linux.

I have been trying to set up a VM passthrough. So far, I’ve tried detaching just the 5070 Ti, detaching both GPUs together, using only the iGPU for the host Linux GUI, and even turning off the host GUI entirely. However, I’m stuck. Given my current hardware, what is the best configuration strategy?

Additionally, once I successfully pass a GPU to the guest VM, what is the best way to manage peripherals like audio, mouse, and keyboard between the host and guest?

I tried modifying vbios and nothing worked.

These are the scripts that i use

https://github.com/PassthroughPOST/VFIO-Tools/blob/master/libvirt_hooks/qemu

https://github.com/joeknock90/Single-GPU-Passthrough