Technical Advisory: Configuration Review for Virtual Machines

Technical Advisory: Automated Restrictions for High-Security Windows VMs

Summary

We have identified a compatibility issue in the ITS Private Cloud infrastructure affecting Virtual Machines with vIOMMU (I/O MMU) enabled. This configuration is typically found on Windows VMs using Virtualization-Based Security (VBS) or Credential Guard.

Please note that this does not impact the stability or performance of the guest operating system while it is running. The issue is strictly limited to operations that involve capturing or migrating the VM’s memory state, specifically snapshotsand vMotions.

To maintain environment stability, we have deployed a patch to the vss-cli and VSS Cloud Portal that prevents these specific operations on affected VMs until a permanent fix is implemented.

Automated Safety Measures

The following operations are now restricted for any VM with vIOMMU enabled:

Snapshots: Creation or deletion.
vMotion / Fault Domain Moves: Shifting the VM between physical hosts.

If you attempt these actions on an affect VM, you will receive an error message directing you back to this advisory. These restrictions will remain in place until a vendor hotfix is verified and deployed.

How to Identify Your Affected VMs

Via the VSS Cloud Portal:

Click the Menu in the top right corner.
Select VM Inventory.
Select Inventory Fields and ensure IOMMU Enabled is checked.
Click Export.
You will receive an email shortly with a link to your full inventory list.

Via the vss-cli:

Run the following command to list all affected VMs in your account:

List in console:
vss-cli compute vm ls -f vvtd_enabled=1
-OR-
Export to .csv
vss-cli --table-format csv compute vm ls -f vvtd_enabled=1 > vms_with_viommu.csv

Mandatory Operations

If you have a critical requirement to perform a Fault Domain move or a snapshot on an affected VM, please contact the VSS team at vss@eis.utoronto.ca for assistance. These operations will require coordinated downtime to be performed safely.

Current Status

We have a high-priority case open with the vendor and we are exploring possible work arounds.