Enabling nested virtualization on Windows 11 VM running nixos via QEMU/KVM

Help
1

Hello, just wanted to share the following information on how I got nested virtualiaztion working on windows 11 guest VM after some trial and error.

Before this, ensure you have enabled nested virtualization on host nixos via

boot.extraModprobeConfig = "options kvm_intel nested=1";

After enabling nested virtualization verify that necessary modules for nested virtualization are loaded (it should return Y):

cat /sys/module/kvm_intel/parameters/nested
Y

1. vm.nix (to be imported in configuration.nix): : https://github.com/TechsupportOnHold/Nixos-VM/blob/52ab01f9a7726c732ae933b131abf94d4f5970ba/vm.nix :

{ config, pkgs, ... }:

{

  # Enable dconf (System Management Tool)
  programs.dconf.enable = true;

  # Add user to libvirtd group
  users.users.<YOURUSERNAME>.extraGroups = [ "libvirtd" ];

  # Install necessary packages
  environment.systemPackages = with pkgs; [
    virt-manager
    virt-viewer
    spice spice-gtk
    spice-protocol
    win-virtio
    win-spice
    gnome.adwaita-icon-theme
  ];

  # Manage the virtualisation services
  virtualisation = {
    libvirtd = {
      enable = true;
      qemu = {
        swtpm.enable = true;
        ovmf.enable = true;
        ovmf.packages = [ pkgs.OVMFFull.fd ];
      };
    };
    spiceUSBRedirection.enable = true;
  };
  services.spice-vdagentd.enable = true;

}

2. Set up windows 11 vm after downloading windows11 iso from microsoft website:https://www.microsoft.com/software-download/windows11
3. IMPORTANT to enable nested virtualization:
- From the main menu OF the virt-manager go to ‘preferences’ and enable editing XML
- Go to the main menu OF the windows11 vm and in the settings choose the ‘cpu’ tab
- Select ‘XML’ tab that exists within the ‘cpu’ tab
- In the XML search for cpu mode settings (<cpu mode = …)
- replace those settings with:

<cpu mode="custom" match="exact" check="partial">
    <model fallback="allow">Skylake-Client-noTSX-IBRS</model>
    <feature policy="disable" name="hypervisor"/>
    <feature policy="require" name="vmx"/>
    <feature policy="disable" name="mpx"/>
  </cpu>

References:

2 Likes