# Windows 11 VM - Single GPU Passthrough

Windows 11 virtual machine with NVIDIA GPU passthrough for running Adobe software on the NixOS desktop. Audio is handled via [Scream](https://github.com/duncanthrax/scream) over the libvirt NAT bridge.

## Hardware

| Component | Device |
|-----------|--------|
| CPU | Intel i5-9400F (6 cores, no iGPU) |
| GPU | NVIDIA GeForce RTX 3060 Ti |
| GPU PCIe | `0000:01:00.0` (VGA), `0000:01:00.1` (HDMI audio) |
| Onboard audio | Intel 200 Series PCH HDA at `0000:00:1f.3` - shares IOMMU group 8 with PCH, not passthrough-capable |

## How it works

When the VM starts, a libvirt hook script terminates the host graphical session, unloads the NVIDIA kernel modules, and binds the GPU to `vfio-pci`. The monitor then displays the Windows guest directly. When the VM shuts down, the hook reverses the process and restarts greetd.

Audio uses Scream: a Windows kernel driver streams PCM over UDP to a receiver service running on the host, which forwards it to Pipewire.

## Prerequisites

Before the first switch, enable **Intel VT-d** in the BIOS (Intel Virtualization for Directed I/O). After rebooting, verify IOMMU is active:

```bash
dmesg | grep -i iommu
# expected: DMAR: IOMMU enabled
```

Then apply the configuration and reboot:

```bash
just switch desktop
sudo reboot
```

## VM setup

### 1. Create the disk

```bash
mkdir -p ~/vms
qemu-img create -f qcow2 ~/vms/windows.qcow2 100G
```

### 2. Get the Windows 11 ISO

Download from `microsoft.com/software-download/windows11`. Save to `~/vms/win11.iso`.

### 3. Create the VM in virt-manager

```bash
virt-manager
```

Create a new VM with **"Local install media"**, select `~/vms/win11.iso`, and on the final screen check **"Customize configuration before install"** with name set to `windows`.

Apply the following settings before starting the installation:

**Overview**
- Chipset: `Q35`
- Firmware: any UEFI entry (not secboot for now)

**CPU**
- Enable "Copy host CPU configuration"
- Topology: 1 socket, 4 cores, 1 thread

**Disk**
- Bus: `SATA`

**NIC**
- Device model: `virtio`

**Add hardware - PCI Host Device** (add both)
- `0000:01:00.0` - NVIDIA GeForce RTX 3060 Ti
- `0000:01:00.1` - NVIDIA RTX 3060 Ti HDMI audio

**Remove**
- Video QXL (or Virtio)
- Display Spice

**Add hardware - TPM**
- Type: Emulated, Version: 2.0

Click **Begin Installation**. The host session will terminate and the Windows installer will appear on the monitor via GPU passthrough.

### 4. Install Windows 11

Follow the installer normally. The SATA disk appears without any driver loading step.

To skip the Microsoft account requirement: press `Shift+F10` at the network screen to open CMD, run `oobe\bypassnro`, and the system will reboot offering a local account option.

### 5. Install drivers

**VirtIO drivers**

On the host, serve the MSI over HTTP while the VM is running:

```bash
VIRTIO_PATH=$(ls /nix/store | grep virtio-win | grep -v '\.drv')
python3 -m http.server --directory /nix/store/$VIRTIO_PATH 8080
```

Inside Windows, open a browser and go to `http://192.168.122.1:8080`. Download and run `virtio-win-gt-x64.msi`, install everything, then reboot. Press `Ctrl+C` on the host to stop the server.

**NVIDIA drivers**

Download the GeForce RTX 3060 Ti driver (Game Ready or Studio) from the NVIDIA website inside the VM. Install and reboot.

### 6. Set up Scream audio

**On Windows:** download the latest `Scream-x.x-setup.exe` from the [Scream releases page](https://github.com/duncanthrax/scream/releases), run the installer, accept the unsigned driver prompt, and reboot.

After reboot, go to **Settings > System > Sound** and set the output device to **Scream (WDM)**.

**On the host:** the Scream receiver runs as a user systemd service and starts automatically on login. Verify it is running:

```bash
systemctl --user status scream.service
```

Audio from the VM will play through the headphone jack on the host.

## Daily usage

```
virsh start windows
```

The hook terminates the host session and hands the GPU to the VM. The monitor shows Windows. Shut down Windows normally from the Start menu to return the GPU to the host and restart the login screen.

## IOMMU groups (desktop)

Verified after enabling VT-d:

| Group | Address | Device |
|-------|---------|--------|
| 1 | `0000:01:00.0` | NVIDIA GeForce RTX 3060 Ti |
| 1 | `0000:01:00.1` | NVIDIA RTX 3060 Ti HDMI audio |
| 8 | `0000:00:1f.0` | Intel Z370 LPC/eSPI Controller |
| 8 | `0000:00:1f.2` | Intel Z370 Power Management Controller |
| 8 | `0000:00:1f.3` | Intel 200 Series PCH HD Audio |
| 8 | `0000:00:1f.4` | Intel Z370 SMBus Controller |
| 9 | `0000:00:1f.6` | Intel Ethernet Connection I219-V |

The HDA audio controller shares group 8 with critical PCH devices and cannot be passed through. Audio is handled by Scream instead.
