nixos/windows-vm.md

Windows 11 VM - Single GPU Passthrough

Windows 11 virtual machine with NVIDIA GPU passthrough for running Adobe software on the NixOS desktop. Audio is handled via Scream over the libvirt NAT bridge.

Hardware

Component	Device
CPU	Intel i5-9400F (6 cores, no iGPU)
GPU	NVIDIA GeForce RTX 3060 Ti
GPU PCIe	0000:01:00.0 (VGA), 0000:01:00.1 (HDMI audio)
Onboard audio	Intel 200 Series PCH HDA at 0000:00:1f.3 - shares IOMMU group 8 with PCH, not passthrough-capable

How it works

When the VM starts, a libvirt hook script terminates the host graphical session, unloads the NVIDIA kernel modules, and binds the GPU to vfio-pci. The monitor then displays the Windows guest directly. When the VM shuts down, the hook reverses the process and restarts greetd.

Audio uses Scream: a Windows kernel driver streams PCM over UDP to a receiver service running on the host, which forwards it to Pipewire.

Prerequisites

Before the first switch, enable Intel VT-d in the BIOS (Intel Virtualization for Directed I/O). After rebooting, verify IOMMU is active:

dmesg | grep -i iommu
# expected: DMAR: IOMMU enabled

Then apply the configuration and reboot:

just switch desktop
sudo reboot

VM setup

1. Create the disk

mkdir -p ~/vms
qemu-img create -f qcow2 ~/vms/windows.qcow2 100G

2. Get the Windows 11 ISO

Download from microsoft.com/software-download/windows11. Save to ~/vms/win11.iso.

3. Create the VM in virt-manager

virt-manager

Create a new VM with "Local install media", select ~/vms/win11.iso, and on the final screen check "Customize configuration before install" with name set to windows.

Apply the following settings before starting the installation:

Overview

• Chipset: Q35
• Firmware: any UEFI entry (not secboot for now)

CPU

• Enable "Copy host CPU configuration"
• Topology: 1 socket, 4 cores, 1 thread

Disk

• Bus: SATA

NIC

• Device model: virtio

Add hardware - PCI Host Device (add both)

• 0000:01:00.0 - NVIDIA GeForce RTX 3060 Ti
• 0000:01:00.1 - NVIDIA RTX 3060 Ti HDMI audio

Remove

• Video QXL (or Virtio)
• Display Spice

Add hardware - TPM

• Type: Emulated, Version: 2.0

Click Begin Installation. The host session will terminate and the Windows installer will appear on the monitor via GPU passthrough.

4. Install Windows 11

Follow the installer normally. The SATA disk appears without any driver loading step.

To skip the Microsoft account requirement: press Shift+F10 at the network screen to open CMD, run oobe\bypassnro, and the system will reboot offering a local account option.

5. Install drivers

VirtIO drivers

On the host, serve the MSI over HTTP while the VM is running:

VIRTIO_PATH=$(ls /nix/store | grep virtio-win | grep -v '\.drv')
python3 -m http.server --directory /nix/store/$VIRTIO_PATH 8080

Inside Windows, open a browser and go to http://192.168.122.1:8080. Download and run virtio-win-gt-x64.msi, install everything, then reboot. Press Ctrl+C on the host to stop the server.

NVIDIA drivers

Download the GeForce RTX 3060 Ti driver (Game Ready or Studio) from the NVIDIA website inside the VM. Install and reboot.

6. Set up Scream audio

On Windows: download the latest Scream-x.x-setup.exe from the Scream releases page, run the installer, accept the unsigned driver prompt, and reboot.

After reboot, go to Settings > System > Sound and set the output device to Scream (WDM).

On the host: the Scream receiver runs as a user systemd service and starts automatically on login. Verify it is running:

systemctl --user status scream.service

Audio from the VM will play through the headphone jack on the host.

Daily usage

virsh start windows

The hook terminates the host session and hands the GPU to the VM. The monitor shows Windows. Shut down Windows normally from the Start menu to return the GPU to the host and restart the login screen.

IOMMU groups (desktop)

Verified after enabling VT-d:

Group	Address	Device
1	0000:01:00.0	NVIDIA GeForce RTX 3060 Ti
1	0000:01:00.1	NVIDIA RTX 3060 Ti HDMI audio
8	0000:00:1f.0	Intel Z370 LPC/eSPI Controller
8	0000:00:1f.2	Intel Z370 Power Management Controller
8	0000:00:1f.3	Intel 200 Series PCH HD Audio
8	0000:00:1f.4	Intel Z370 SMBus Controller
9	0000:00:1f.6	Intel Ethernet Connection I219-V

The HDA audio controller shares group 8 with critical PCH devices and cannot be passed through. Audio is handled by Scream instead.