4 ms·

Windows is moving to a model where Windows itself is run as a virtualized OS. I believe this is enabled by default in new installs. So having a Linux VM in Hy

Windows is moving to a model where Windows itself is run as a virtualized OS. I believe this is enabled by default in new installs. So having a Linux VM in Hyper-V isn't opening up much new attack surface.

ylor 6y ago
First I hear of this. Source? Googling for this predictably returned unhelpful results.
- danieldk 6y ago
  In VBS environments, the normal NT kernel runs in a virtualized environment called VTL0, while the secure kernel runs in a more secure and isolated environment called VTL1. https://www.microsoft.com/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/ https://www.microsoft.com/security/blog/2020/07/08/introduci... https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs https://docs.microsoft.com/en-us/windows-hardware/design/dev...
AshamedCaptain 6y ago
It's not enabled by default. Enabling Hyper-V still causes a battery/performance hit that is going to be hard to get rid of.
- smileybarry 6y ago
  Virtualization-based security -- a lighter mode of Hyper-V sans real VMs -- is enabled by default on new installs on recent-enough hardware: https://techcommunity.microsoft.com/t5/virtualization/virtualization-based-security-enabled-by-default/ba-p/890167 https://techcommunity.microsoft.com/t5/virtualization/virtua...
  - AshamedCaptain 6y ago
    The link you posted only contains one device and it happens to be an ARM device. Seeing the impact it still has on battery life at least on x86, I really doubt they have enabled it by default. It was not enabled by default on x86 in 2020 at least.
    - smileybarry 6y ago
      That's just a blog post about the feature being deployed, of course it won't have many examples. Take any PC from the past few years and install Windows 10 x64 on it. It will have VBS enabled and hypervisors that do not support Windows Hypervisor Platform won't work. That's been my experience since at least 2017. If you click through "capable hardware" to here[1], you'll see the list of requirements for VBS, including: > Virtualization-based security (VBS) requires the Windows hypervisor, which is only supported on 64-bit IA processors with virtualization extensions, including Intel VT-X and AMD-v. So it will never be the case on x86/IA32 1: https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs https://docs.microsoft.com/en-us/windows-hardware/design/dev...
      - AshamedCaptain 6y ago
        Well, I'm asking because my experience is exactly the opposite. I've installed Windows countless times on systems with all the requirements and HyperV is not enabled. The day it starts being enabled, I don't even want to imagine the number of support calls.
    - jrockway 6y ago
      Do you have a reference to the increased power consumption that running a hypervisor causes? This thread is the first I've heard about it, and I would like to learn more.
      - AshamedCaptain 6y ago
        No, and I also would like to find some academical test. Try it -- you can even dual boot hypervisor on/off. It's not a small effect. Around 1h extra one on "almost idle" scenarios.

ylor 6y ago

First I hear of this. Source? Googling for this predictably returned unhelpful results.

danieldk 6y ago
In VBS environments, the normal NT kernel runs in a virtualized environment called VTL0, while the secure kernel runs in a more secure and isolated environment called VTL1. https://www.microsoft.com/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/ https://www.microsoft.com/security/blog/2020/07/08/introduci... https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs https://docs.microsoft.com/en-us/windows-hardware/design/dev...

AshamedCaptain 6y ago

It's not enabled by default. Enabling Hyper-V still causes a battery/performance hit that is going to be hard to get rid of.

smileybarry 6y ago
Virtualization-based security -- a lighter mode of Hyper-V sans real VMs -- is enabled by default on new installs on recent-enough hardware: https://techcommunity.microsoft.com/t5/virtualization/virtualization-based-security-enabled-by-default/ba-p/890167 https://techcommunity.microsoft.com/t5/virtualization/virtua...
- AshamedCaptain 6y ago
  The link you posted only contains one device and it happens to be an ARM device. Seeing the impact it still has on battery life at least on x86, I really doubt they have enabled it by default. It was not enabled by default on x86 in 2020 at least.
  - smileybarry 6y ago
    That's just a blog post about the feature being deployed, of course it won't have many examples. Take any PC from the past few years and install Windows 10 x64 on it. It will have VBS enabled and hypervisors that do not support Windows Hypervisor Platform won't work. That's been my experience since at least 2017. If you click through "capable hardware" to here[1], you'll see the list of requirements for VBS, including: > Virtualization-based security (VBS) requires the Windows hypervisor, which is only supported on 64-bit IA processors with virtualization extensions, including Intel VT-X and AMD-v. So it will never be the case on x86/IA32 1: https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs https://docs.microsoft.com/en-us/windows-hardware/design/dev...
    - AshamedCaptain 6y ago
      Well, I'm asking because my experience is exactly the opposite. I've installed Windows countless times on systems with all the requirements and HyperV is not enabled. The day it starts being enabled, I don't even want to imagine the number of support calls.
  - jrockway 6y ago
    Do you have a reference to the increased power consumption that running a hypervisor causes? This thread is the first I've heard about it, and I would like to learn more.
    - AshamedCaptain 6y ago
      No, and I also would like to find some academical test. Try it -- you can even dual boot hypervisor on/off. It's not a small effect. Around 1h extra one on "almost idle" scenarios.