Ultra 9 processor and VMware

[RaSystemlord]

I got a new laptop running Intel Ultra 9 processor HX 275. As such, it works with VMware, but I still have a couple of questions, if somebody would know:

0.
The installation on new Win 11 Pro, was straight-forward. In installation start, there is one option that is not checked by default. It says something like the option should be checked for better performance if you are running VMware on Hyper-V enabled system. I checked it.

Well, default Win 11 Pro 24H2 is Hyper-V enabled and I haven't changed anything in this regard.

So, everything should be fine and VMs do work, but ...

For background, my VMs are Window Server 2022 standard (two of them) and Win 11 Pro (two of them). Haven't yet tried anything else.

Installation does complain about "side channel mitigations" and I have turned them on.

BIOS has virtualization selections ON (as far as I can tell - it is different now than i.x -series of Intel). Hardware is Asus Rog Strix Scar, if that is somehow significant, a brand new model line.

1.
On both VM OS's mentioned above, I need to turn Hardware Virtualization OFF on the VMware menu. (All the 3 options in the GUI are OFF, too, haven't tried anything else).

The question obvious is, how to get the better performance?

2.
Would I really need to turn Hyper-V completely OFF to get the better performance?

I mean, Cfgtech, posted a really comprehensive explanation how to turn everything related OFF.

I understand that for nested virtualization, you need to have them OFF, but I'm not doing any of that.

[kasper]

I am not clear from your post as to whether VBS is on or off.    VBS on will cause your host/guest to take a significant performance hit.

And if you do not use Hyper-V then remove it from the host.

[RaSystemlord]

Kasper: You are right, I wasn't clear enough. My version is 17.5.2, which works elsewhere just fine with Ryzen/Win10 Pro combination. With "just fine", I mean professional, rather heavy software, but which are not something like "gaming-critical" in performance requirements.

1.

VMware installation has a toggle, which says to be checked, if Hyper-V is ON. What is that about and does it not work for giving a decent performance? It seems that it is not working.

2.

Everything that Windows 11 Pro has by default is still there now. So, all that Hyper-V / VBS is ON.

With all that, it does not allow a VM to have Intel/AMD-virtualization support ON.

So, you seem to be saying that in ALL cases of using VMware, these Win 11 Hyper-V / VBS thingies need to be OFF, right?

I was kind of thinking that maybe Intel Ultra 9 processor, brings something new to the game. But perhaps not. I'm interesting in hearing about that, too - you know, processors are not created equal: AMD and Intel are NOT the same with (latest) Win 11.

[Morc001]

I'm running a few Windows VMs, but nothing demanding, so I don't know whether switching off side channel mitigation on a Hyper-V enabled host boosts performance or not. But that is the setting Workstation warns you about when powering on a VM that does not have this switched off and the host has Hyper-V running. Windows 11 24H2 has VBS on by default, which relies on Hyper-V. Hyper-V is running even though the Hyper-V Windows feature is not installed.

Since I wanted to use nested virtualization I read a few posts on here about that not being available in Windows 11 24H2, unless VBS/Hyper-V is disabled. I was wondering whether this is an AMD only problem, but did not see any post categorically saying one way or the other. And it does not make sense that AMD would work differently than Intel, since they support the same virtualization features. Unless you need nested virtualization you should not disable/remove VBS/Hyper-V in my opinion. I'm running Workstation 17.6.3, don't have VBS/Hyper-V disabled, and I don't see major problems or any actually. Screen refresh issues only (which some describe as input lag), reported in other threads, mainly under Linux, but also noticed something when booted up a Windows XP VM. Disabling 3D acceleration resolves the problems. I did not try the Broadcom suggested DX12 rendered disabling and since I'm not doing anything that would require 3D acceleration I'm fine with disabling.

[RaSystemlord]

Morc001:
Referring to previous posts as well.

1.

Yes, I was meaning the "Side channel ...", which are for a VM. I wrote it a bit wrong.

2.

As for processor differences. I checked from "experts" (ChatGPT and Deepseek) and both of them said that AMD is lagging behind in virtualization capabilities. And thus the solutions are not necessarily the same. I have here Intel, but a new technology Ultra 9, and that is the undertow of my questioning.

I understand, that in these threads the processor is usually not mentioned, but according to "experts", it really should be mentioned. Maybe some of these contradictions and try-outs, could be understood better.

3.

I understand that Hyper-V/VBS -thingies should be completely removed in order to get the hardware support for VMware (also VirtualBox) virtualization. I mean with Win 24H2 Pro platform. It is still unclear - based on these LONG instruction sets, whether you can even do that with Home version. Well, whatever, I would never use Home version anyway for anything significant. I have modified all the Home computers to Pro - it is just very, very strange that high-end laptops are even delivered with Home version.

4.

Nobody understood what I meant the check box during installation of VMware 17.5.2. Starting with text like "... do you want Automatically installed ... if you have VBS enabled system". 

Unfortunately, since I let it to be "Automatically Installed", I cannot get a screen copy about it anymore.

Still, that did NOT help to get hardware virtualization to VMs.

5.

Items 3 and 4 are not that simple

I do get the hardware support on Win 10 (build May 2025) with AMD Ryzen 9.

So, Win 10 is the better version for virtualization.

6.

Instruction sets to get VMware working (with hardware support) on Win 11 are just ridiculous - and I do NOT mean the persons finding this out, I mean the so-called OS of Win 11. You need to cripple down everything that is built to Win 11 24H2 for security=to fix things that are just wrong in Win 11 security. Windows IS a patch over patch over patch, but this takes the cake.

Maybe, in the near feature, I will have all VMware working on Kubuntu platform. It will probably be faster on old hardware than Win 11 with high-end, new hardware. Just a guess - it will fun to measure it.

[Morc001]

AMD may lack some virtualization support features, but the basic features are there. That'll not prevent proper nested virtualization support on AMD processors. Regarding Windows 10 being better: it's not. You can enable VBS on Windows 10, it's just not on by default. If you enable it it'll break nested virtualization. Regarding Windows 11 Home: you can turn off VBS on it too. Even more, Hyper-V is not even available as an installable feature on Home using the Windows UI. You have to use dism to install it. I tried it hoping that Microsoft only cripples third-party VM software and nested virtualization will be available under Hyper-V, but Hyper-V is not as advanced as VMWare and ESXi 8 does not even boot under it, even when you try to tweak the VM. I tried ESXi as that tells you whether nested virtualization is available. VBS is there for a reason, giving you an extra layer of secuirty. You can turn it off, although not in an easy way. Better would be to allow certain apps to access nested virtualization features, but that may invalidate the VBS concept (I don't know how VBS works under the hood).

[Samuel Appiah]

Hi my name is Sam,

I'm trying to download VMware Workstation player 17 for my (IT Home Lab)  from BROADCOM , but the Broadcom  website is not giving me access to download the VMware software.

I Would be if a Technician can assist me to resolve this issue.

Regards

Sam. 

[Morc001]

Please post in the appropriate thread! This thread has nothing to do with download problems.

[RaSystemlord]

Morc001: Thanks for the clarification around the subject. Good to know those things.

However, my concern is never about nested virtualization, but the performance - especially enabling the processor support for VMware virtualization. Can you say that AMD is there as good as Intel? When AMD lacks some virtualization features, will those short-comings have an effect on performance or directly making enabling hardware support impossible? Hard to say, of course, but that is why I didn't even consider AMD choices for Win 11 use.

As I said, with AMD Ryzen 9, Win 10 Pro (latest) and 17.5.2. - there are no problems with MANY different Win-choices and Kubuntu.

Well, OK, those instruction sets are not valid for Home version - I mean, not completely valid means that they do not work. However, yet, you are talking about Nested virtualization, which is not my concern (at this time). Be that as it may, Home version is never the required version for certain professional software and thus never my choice - no reason to play with Home.

Even Windows security is patch over patch over patch. firewalls, virus scanners (some of which are useless or fraudulent), TPM chips and now VBS which cripples software. It is hard to say, which ones are just messing up with consumers. I wouldn't use Windows in my Host, if it weren't for professional software - but that is completely a different discussion.

[Morc001]

Since VBS is active the CPU support for hardware accelerated virtualization is hidden from VMWare Workstation. It's as good as nonexistent. Hyper-V is using it for sure on both CPUs. Intel was lagging in performance up until the last generation in terms of pure CPU power. So if you get better performance on the same hardware but older VMWare, then it's VMWare, not the CPU.

Those instructions to switch off VBS are valid for Home as well. One post detailed the differences between Home and Pro, mainly the lack of Group Policy UI. I'm not saying you should be using Home, just saying that Home is no different in this regard. If anything even faster, lacking some Pro features :), but I don't have metrics to support that guess.

Windows security is not patch over patch. Or Linux security is patch over patch as well. On Linux there are a lot less AV products and Microsoft's solution has grown up to the task and competes in performance and detection features/ratio with the best in the market. I'm subscribed to the Ubuntu security newletter and get summary of patches for apps and kernel almost daily. Microsoft is trying to protect the average user, while Linux does not yet. Mainly because Linux is a small fraction of the desktop market. Ubuntu/kernel maintainers stopped detailing kernel vulnerabilities in these newsletter posts a few months back and even Linus Torvalds said in an interview/speak that it's not wise to mark commits with CVE-s and such to give ideas to bad actors what to exploit.

[RaSystemlord]

Morc001: My point on AMD/Win 10 Pro combination was that hardware acceleration works. I haven't made any comparison between different VMware versions. I understand that Win 10 discuss is next to irrelevant, because support is ending.

With security issues between Windows and Linux, this is not really the place, although this VBS leads to this. I did NOT mean patches to programs themselves - generally speaking, I do not think that Linux software programmers make less errors than Windows programmers. That is only ONE thing in OS/Distro security. Patches over patches over patches, sorry one level is missing, over patches, I mean in Windows: Firewalling, Virus scanners, TPM chip and now even Virtualization Based Security. You can of course make this a virtue of Windows - they are trying to make it safe. Like Yoda said: "There is no try. Just do." That is how Unix and then Linux was made. Windows was not.

[Morc001]

Bare metal will always be faster than any hardware assisted virtualization, but I think recent CPUs with support make them very close to bare metal. Hardware acceleration works on Windows 11 too, Hyper-V uses it for sure. I guess all CPUs officially supported by Windows 11 have all the necessary hardware support for virtualization.

None of those are patches. VBS is a security layer, of which Linux has no equivalent as far as I know. Firewall and antivirus are complementary and can be switched off, and no pacthes either, or a Linux antivirus is a patch as well. Linux has no built-in antivirus and the firewall is switched off by default on most distros as far as I know. RedHat and some other enterprise distros has it on, but Ubuntu does not. TPM is a hardware, and Windows 11 requires it so it can safely store the Bitlocker key in it. Apple chips have the secure enclave, other ARM CPUs and thus Android have similar solutions. I just looked it up and LUKS can be set up to use TPM. So is this a patch for Linux? UNIX did not start off safe, only became somewhat safe, but you're a privilege escalation/code execution in a root process/kernel bug way from total system compromise. Microsoft is doing something with VBS, Linux has SELinux, but not the same and does not protect from kernel bugs if I understand correctly how it works.

[RaSystemlord]

You have very good points in there.

I guess our perspective is very different - you are looking as it is, and I'm looking how it all have evolved. Windows started in some professional work without network capabilities (Windows 3.0 and 3.1.) Actual professional work started with NT 3.1, 3.5, 3.5.1, 4.0 and Windows 2000 and XP. They didn't have any network securities. Then game XP SP2,3,4 having nominal security and becoming unstable OS's - if you even call them OS's because they didn't always have all the drivers to run (like Dell drivers). But they were distros nevertheless, without any security in a network.

This was actually good in a company internal net, because everything was rather easy to setup. UNIX, on the other hand, had always basic security. It comes from 70s university-world, were students would certainly hack the university computers, if they could.

I call those 4 things patches, because none of them have any use, if you have built your OS/Distro correctly - like main distros of Linux have. I'm now talking about basic workstation use - that's the topic under VMware workstation - not server use.

Nowadays, Windows security measures have to be so strict that it sometimes takes weeks in companies to figure out what to do. I have gone through all that, and still doing it (and yes, waiting for weeks), since AT&T Unix in 90s, VAX/VMS before that, and Windows 3.1 when it first came out around mid-90s. I mean, professional support for complex software environments with multiple servers & stuff. Always installing that stuff for myself, too.

However, the insecurities in Windows are a matrix and the above is not enough to give the full picture. It's not about Windows alone, it's about commercial software versus open software. When your source code is not public, you hide things from the users. ALL commercial systems, including Windows, Android, Apple can spy the user as much as they want. It is BAD if Chinese do it, it is BAD if Russians do it (Kaspersky), but it's OK if Americans do it, like NSA can do it. You might beg to differ, especially at the moment, but that is how it generally has gone, in reality. Every backport is an insecurity - concerns closed Linux and Unix -systems too, as some of the above mentioned closed systems are.

Another dimension in the matrix, giving a generic problem in taking real insecurities into account, is the Stockholm Syndrome. Professionals supporting Windows systems are kidnapped by Microsoft/Windows and give unfounded nice talks about what Microsoft, their kidnapper-salary-wise, does (if you don't know what the well-known Stockholm Syndrome is - look it up). There is also a legal aspect, why this happens, without the Stockholm Syndrome. For instance, a Broadcom employer cannot give Microsoft any critic, even if VMware is not to blame but Microsoft is to blame. I have seen groundless accusations against Broadcom on this very Forum, while they cannot defend themselves.

[kasper]

If you are looking for a more secure host, set VBS to ON.  If you are looking to do guest nested virtualzation and a modest perfermance increase, turn VBS OFF.   Consider these VMX settings for security:        isolation.tools.dnd.disable = "TRUE"
isolation.tools.copy.disable = "TRUE"
isolation.tools.paste.disable = "TRUE"

And these but they may be outdated: isolation.tools.setGUIOptions.enable = "FALSE"
isolation.tools.hgfsServerSet.disable = "TRUE"
isolation.tools.hgfs.disable = "TRUE"

Consider these VMX settings for performance (some require you have a lot of memory on the host):  

debug = "FALSE"
logging = "FALSE"
sched.mem.pshare.enable = "FALSE"
mainMem.useNamedFile = "FALSE"
disableUserPreferences = "TRUE"
isolation.tools.unity.disable = "TRUE"
vmx.scoreboard.enabled = "FALSE"

[Morc001]

I guess you meant you turned side channel mitigation OFF:

Since Hyper-V/VBS is active hardware virtualization support is not available to VMWare. If you want/need hardware virtualization support you need to disable VBS/Hyper-V. Once you've disabled VBS you should turn back on side channel mitigation on the VMs.