[Help Welcome] KVM Development - staying the course

@HulaHoop is this still true? meaning if LVM used we can rely on it without spice? does this as well improve other hypervisors like Virtualbox?

1 Like

How is LVM related to spice?

LVM is a disk partitioning tool, while spice is a graphics/media transfer protocol. There is a RAW disk mode in KVM where underlying disk storage is accessed directly without isolation, but the security consequences and data confidentiality violations are pretty evident.
Malware could recover deleted files from the host disk or inject malicious IO commands to the hardware.


Current KVM page looks like this.

Fixed it by removing thumb description:

<code>Unofficial logo re-creation for the [https://www.linux-kvm.org KVM] virtualizer</code>

No idea how to reback it while keeping the page looks nice.

1 Like

Well i thought the vt-x is the issue, but i checked the BIOS and the vt-x is actually enabled, i also thought my PC is old and the vt-x is just not working anymore, but i tried another VMs in KVM and so as Virtualbox = working?!

So i think investigation need to be done, im happy to provide any further logs (my ticket is the first one).

1 Like

Try a Debian VM.

VirtualBox used to work without hardware virtualization support with good speed too. This feature might not be deprecated.

KVM cannot do that. QEMU maybe but dunno speed.

You cannot have VirtualBox and KVM installed at the same time. This might cause the same error message.

1 Like

First time i hear this, since when?

Dunno when. I think old feature before hardware virtualization was invented? The when isn’t important.


No hardware virtualization required. For many scenarios, Oracle VM VirtualBox does not require the processor features built into current hardware, such as Intel VT-x or AMD-V. As opposed to many other virtualization solutions, you can therefore use Oracle VM VirtualBox even on older hardware where these features are not present. See Hardware vs. Software Virtualization.

Compare the xml files of VMs that you can use versus not use.

1 Like

QEMU would probably work but unsupported.


Not sure how that works.


Oracle VM VirtualBox’s 64-bit guest and multiprocessing (SMP) support both require hardware virtualization to be enabled. This is not much of a limitation since the vast majority of 64-bit and multicore CPUs ship with hardware virtualization. The exceptions to this rule are some legacy Intel and AMD CPUs.

Since Whonix downloadable images are for 64-bit (32-bit or 64-bit?), this shouldn’t work. But since @nurmagoz confirmed VirtualBox works, seems VirtualBox has somewhat better out of the box legacy hardware support.

1 Like

Figured out this issue, this is seems to be Debian (or Kernel) VS my PC issue:

If TPM activated from the BIOS:

It will appear at the beginning of the OS booting (quickly disappear):

kernel: x86/cpu: VMX (outside TXT) disabled by BIOS

To solve it one need to disable TPM feature:

Dunno if this is reported upstream or not.

1 Like
1 Like

Can you test some KVM with EFI please? @HulaHoop

KVM EFI support might have considerably improved meanwhile. For example, Debian nowadays can be easily installed on EFI and even SecureBoot enabled systems.

Therefore would be good to test both, EFI and SecureBoot.

Then making any changes to the Whonix libvirt KVM config files to support EFI, SecureBoot.

Yet to be decided if EFI (and maybe later SecureBoot) will become the new default for Whonix VMs as per:

1 Like

If there is anything that needs help with or requires testing please do let me know

1 Like

Btw please Follow Whonix Developments for news. If there are major testers wanted announcements, these will be posted in the news forums.

1 Like

Could vagrant be a solution to the missing .ova appliance feature for libvirt / KVM? Vagrant supports .box files.

vagrant is available in Debian.


Supports libvirt. Package in Debian:


  • /usr/share/doc/vagrant-libvirt/examples/create_box.sh

/usr/share/doc/vagrant-libvirt/examples/create_box.sh IMAGE [BOX] [Vagrantfile.add]

Package a qcow2 image into a vagrant-libvirt reusable box


  • metadata.json
  • Vagrantfile

I am not sure Vagrant can be feed existing libvirt XML files or needs its own format?

But there could be limitations.

please review:
KVM: Difference between revisions - Whonix


Long standing KVM issue:

VM internal traffic is visible on the host for network sniffers such as wireshark, tshark as well as iptables (and therefore by extension also corridor)

This is an issue because of this corridor (or something similar if invented such as perhaps Whonix-Host KVM Firewall) cannot be used as an additional leak test or Tor whitelisting gateway.

Quote myself from Whonix on Mac M1 (ARM) - Development Discussion - #35 by Patrick

As hubport option might be much more secure similar and also apply to Whonix KVM.

This is very important, needs most attention to get right to avoid IP leaks.

From the UTM config files. Relevant options:


-device virtio-net-pci,netdev=external
-device virtio-net-pci,netdev=internal
-netdev user,id=external,ipv6=off,net=
-netdev socket,id=internal,listen=:8010


-device virtio-net-pci,netdev=internal
-netdev socket,id=internal,connect=

Doesn’t look crazy. Related documentation:
Documentation/Networking - QEMU

But it has the same issue that KVM has. VM internal traffic is visible on the host for network sniffers such as wireshark, tshark.

This has lead in the past to a failure of configuring corridor on a Debian host with Whonix KVM.


GitHub - rustybird/corridor: Tor traffic whitelisting gateway

testing on Debian host · Issue #28 · rustybird/corridor · GitHub

Using corridor, a Tor traffic whitelisting gateway with Whonix ™

So it would be much better if KVM / QEMU (UTM) would hide this from the host operating system. I.e. encapsulate the internal networking better. ChatGPT says this is possible using the hubport option but ChatGPT unfortunately sometimes talkes nonsense. Could you look into it please?


1 Like

Pending changes piling up.

KVM: Difference between revisions - Whonix

1 Like

Missing documentation:
As mentioned in How to use Whonix-Gateway KVM for any other VM, operating system (Whonix-Custom-Workstation)? using Anonymize Other Operating Systems is undocumented for Whonix KVM.

1 Like