So the plan is to make a Windows 10 guest, give it lots of vCPUs and memory, perform GPU passthrough to achieve maximal performance, and then load my games onto this guest. The aim of this would be to stream the games over LAN to my PCs, thus providing easy access while also putting all games on a single box that has no personal files on it.

As games can include tracking or other invasive anti-cheat as well as vulnerabilities like any software, I feel that they should be placed on an unprivileged system. However, the most secure method of using a restricted VLAN that has dedicated clients for said gaming (with ACLs blocking any of those devices from talking to anything else in the building) would be rather annoying in terms of convenience and resources.

As such, my question boils down to if the plan proposed in paragraph 1 is sufficient or if streaming of a gaming server still opens the entire network to considerable risk (as there's always some risk).

The reason for the specificity of this question is that games are a unique threat model for me, as they are not critical by any means but at the same time do not clearly need to be as isolated as traditional DMZ devices (e.g. webservers).

1 Answer 1


The most obvious inroad: The passthrough GPU has full access to main memory for DMA operations, mediated by the IOMMU, and to other PCIe devices in the same domain.

The GPU can emit "translated" memory access requests that bypass the IOMMU translation (as the addresses used are already assumed to be translated), whether that is actually implemented in existing GPUs is something I don't know straight away.

Whether the IOMMU still performs access control checks for translated requests depends on the chipset, but my expectation would be "no", as the point of having address translation inside PCIe devices instead of the IOMMU is to distribute the TLB -- performing access checks would reintroduce the same bottleneck that virtualization awareness in PCIe devices was built to avoid.

Depending on your chipset, it may be possible to disallow "translated" PCIe requests entirely, then at least the GPU would be limited to memory allocated to the VM, but access to other devices remains open.

These scenarios require determined attackers though. Unless you are specifically targeted, I'd expect that the isolation is sufficient to protect your system against the typical invasive software, because while VM breakout is possible for invasive software, actually doing something with this access requires analysis of the outside system.

The biggest threat here would likely be ransomware, but the effort/reward balance for ransomware that sophisticated is not on the side of attackers.

The thing I would expect from anti-cheat software though is that it attempts to detect virtualized environments, and flag them as untrustworthy straight away.

Hiding virtualization completely is difficult, and this is likely to become your biggest problem in this endeavor.

  • I exclusively use the setup described by the OP; modern anti-cheat engines don't seem to care. Although it did require tricking the graphics card driver into ignoring virtualization. Feb 1, 2021 at 14:25
  • Thank you for the very detailed post :) . I know it is not part of the Q, but does the choice of hypervisor (either KVM or Hyper-V) have any noticable impact on the risk of an attack? both systems would be patched regularly. In my understanding PCI passthrough is more dependent on the motherboard chipset than the choice of (PCI Passthrough Supported) hypervisors Feb 2, 2021 at 13:39
  • @anotherusername, correct, that is a hardware limitation for the most part. Generally high-speed bus systems place a high amount of trust in the components connected to them, because verification costs performance and adds new error states that need to be debugged -- my PCIe endpoint implementation in VHDL spends a lot more logic on flow control than on the actual data exchange, for the unlikely case where a DMA buffer mapped in a VM is swapped out by the hypervisor so a request cannot be satisfied immediately and in order of submission because of that. Feb 5, 2021 at 10:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .