> Virtualization-based security, or VBS, uses hardware virtualization and the Windows hypervisor to create an isolated virtual environment that becomes the root of trust of the OS that assumes the kernel can be compromised.
> While VBS greatly improves platform security, VBS also changes the trust boundaries in a Windows PC. With VBS, the Windows hypervisor controls many aspects of the underlying hardware that provide the basis for the VBS secure environment. The hypervisor must assume the Windows kernel could become compromised by malicious code, and so must protect key system resources from being manipulated from code running in kernel mode in a manner that could compromise security assets.
https://learn.microsoft.com/en-us/windows-hardware/design/de...
https://learn.microsoft.com/en-us/windows-hardware/design/de...
Architecture Image: https://www.microsoft.com/en-us/security/blog/wp-content/upl...
> Intel VT-X2 with Extended Page Tables (EPT)
As far as I know, this doesn't limit CPUs to 8th Gen and newer. Neither does VT-x and the other requirements.
Furthermore, there are supported ways of disabling VBS entirely so the gimped version of Windows 11 that doesn't use VBS you'd get for installing it on older hardware wouldn't be that different from an install you'd disable VBS on to get 15% better performance in video games.
https://learn.microsoft.com/en-us/virtualization/hyper-v-on-...
The parent partition has full access to hardware and child partitions (VMs). The hardware is not virtualized to the parent.
It's a pain when renting a VPS sometimes, but on Windows I don't think that's a common problem.
It's also a problem for Microsoft's new ARM64-based Surface devices: Snapdragon X doesn't support nested virtualization, even though Windows does.
If I have access to AWS, I will be spinning up Linux VMs for GNU/Linux workloads.
Snapdragon X does support nested virtualisation - it's Windows that doesn't support it on arm64 yet
If it's this one and you're cool with Linux, I recommend https://github.com/waydroid/waydroid , which likewise runs Android on top of a "normal" Linux distro, but with the advantage that it can just use the actual Linux kernel that's already there. There's also https://gitlab.com/android_translation_layer/android_transla... that tries to bridge further up the stack; this is arguably cooler and probably lighter but currently has very limited app compatibility.
Just one more stepping stone on Microsoft's constant inability to make good decisions.
Fundamentally though, the biggest issue probably was Microsoft was still far too afraid to fight Google directly, their monopoly was at its height but user perception of that hadn't caught up yet.
thom•8mo ago
kokada•8mo ago
Also VMs can be really fast thanks to virtualization instructions and para virtualization techniques.
ChocolateGod•8mo ago
Existing Linux syscalls rarely change and never in a non-backwards compatible way, extra options are added.
yjftsjthsd-h•8mo ago
dwattttt•8mo ago
At that point, either Linux distros have to consider Windows' "almost" Linux kernel as a target to support, or what Microsoft did, which was to use a VM and a "real" Linux kernel.
Hilift•8mo ago
Strategically, I don't think WSL is a real product that would be customer facing due to "WSL has been designed and built to use with inner loop development workflows. There are design features in WSL that make it great for this purpose but may make it challenging for production-related scenarios compared to other products."
https://learn.microsoft.com/en-us/windows/wsl/faq
hypercube33•8mo ago
rustcleaner•8mo ago