KVM Hypervisor VGA Passthrough + VAC Authenticaton Error

[luki]

Hello,

in the last view days i have troubles with VAC Authentication Error in CS:GO.
It kicks me after 1 or 2 games. I sent a ticket to steamsupport and they say:

Your recent disconnects by VAC have been caused by running a KVM hypervisor alongside CS:GO.
As stated in our Disconnected by VAC article, you'll need to disable this software while playing CS:GO to avoid being kicked moving forward.
Steam Support

Why the Hell is it forbidden to use Virtualization? I have a 12 Core Xeon E5 CPU with 128 GB RAM and I want to make full use of it. I run several VMs like Gameservers, Webserver and so on.

And I also virtualized my Gaming Rig on this Server with a 2nd PCI-E VGA Graphics and VAC kicks me out random.

[The Giving One]

Originally posted by Not Throwing - Just Bad,:

This demonstrates a perfectly normal and reasonable use case, one that WILL become more mainstream as CPUs get more cores and in general become more powerful, as well as 1080p gaming GPUs become cheaper and cheaper.

No, it won't, not as far as VAC protected games go it won't. As far as this forum goes, it does not get along with VAC. Therefore, it is not allowed to be used and it cannot be used anyway....because it blocks VAC.

I normally might suggest a thread in the suggestions forum, but I think that would be a waste of time. In this forum, concerning VAC, it is not going to be "mainstream" whatsoever...not as long as it can be exploited in the way discussed in the thread, and of course not as long as VAC kicks for it.

[SAZrocks]

Originally posted by The Giving One:

Originally posted by Not Throwing - Just Bad,:

This demonstrates a perfectly normal and reasonable use case, one that WILL become more mainstream as CPUs get more cores and in general become more powerful, as well as 1080p gaming GPUs become cheaper and cheaper.

No, it won't, not as far as VAC protected games go it won't. As far as this forum goes, it does not get along with VAC. Therefore, it is not allowed to be used and it cannot be used anyway....because it blocks VAC.

I normally might suggest a thread in the suggestions forum, but I think that would be a waste of time. In this forum, concerning VAC, it is not going to be "mainstream" whatsoever...not as long as it can be exploited in the way discussed in the thread, and of course not as long as VAC kicks for it.

My point was not that valve should just allow Hypervisors. My point was that VAC should be adapted or a solution otherwise found that allows legitimate users to use VMs, which as I said above have very practical uses and benefits. The answer (for now) shouldn't be, "Hypervisors block VAC, and are therefore not allowed." Instead, it should be "VAC does not currently support the use of Hypervisors." The problem is that VAC, an Anti-Cheat system (designed to improve my gaming experince by removing hackers) is keeping me (a legitimate user) from playing the game at all! Currently, this number of users that are affected in this counter intuitive way is rather small, but my point is that more people will continue to use this method because of the rather large cost benefits that come along with it.

To sum up that mess of thought, the goal should be for VAC to eventually support Hypervisors, and not just say, "No."

[The Giving One]

Originally posted by Not Throwing - Just Bad,:

The problem is that VAC, an Anti-Cheat system (designed to improve my gaming experince by removing hackers) is keeping me (a legitimate user) from playing the game at all!

No it isn't. Just stop using the hypervisor, then you can play just fine. Problem solved.

And just how is VAC going to know the difference between the honest player using the hypervisor and the cheater ?

[SAZrocks]

Originally posted by The Giving One:

No it isn't.

Uh Yes, it is. It is a problem. The problem in our discussion however, is that you keep implying that my answer to this problem is to just to allow all hypervisors, which isn't my answer. My answer to this problem is that VAC should be adapted to support Hypervisors.

Just stop using the hypervisor, then you can play just fine. Problem solved.

*sigh* Did you even read the first half of my first post in this thread? At all? If you had, you would know that isn't an option, because no, no I can't play just fine without using a hypervisor.

And just how is VAC going to know the difference between the honest player using the hypervisor and the cheater ?

I don't know enough about this subject to be able to tell you exactly how this should be done. Heck, If i did, I would probably be working for Valve or some other developer. But from what I gather it should be possible to tell if [insert Vac secured game here]'s blocks of memory are being changed without [insert Vac secured game here] doing anything to those areas, thus indicating some kind of external modification. AFAIK legitimate user operation doesn't do this, so therefore you should be able to tell the difference.

PS: I appreciate what you do in this section. I'm new here, but the amount of time you put into this section is obvious and I just wanted to thank you for that. I honestly dont know how you don't go crazy after all these posts.

[The Giving One]

Originally posted by Not Throwing - Just Bad,:

Uh Yes, it is. It is a problem. The problem in our discussion however, is that you keep implying that my answer to this problem is to just to allow all hypervisors, which isn't my answer. My answer to this problem is that VAC should be adapted to support Hypervisors.

If you think this way, with all due respect, it is your problem, not a problem with VAC or the game or Steam itself. The system requirements on the store page do not list a hypervisor. Therefore, one is not needed for the game to be played whatsoever.

Not to mention of course that VAC does not like it, as you know.

Originally posted by Not Throwing - Just Bad,:

*sigh* Did you even read the first half of my first post in this thread? At all? If you had, you would know that isn't an option, because no, no I can't play just fine without using a hypervisor..

I did read it. And that is irrelevant. You can play the game fine without the hypervisor. If you have to buy a new computer system, internet hardware, heck even get a new ISP....whatever it takes you "CAN" play without the hypervisor...it is just that apparently the options are not suitable to you.

It is irrelevant. Thousands upon thousands of players can play the game just fine without a hypervisor.

Originally posted by Not Throwing - Just Bad,:

I don't know enough about this subject to be able to tell you exactly how this should be done. Heck, If i did, I would probably be working for Valve or some other developer.

Exactly my point. It is easy to say "just make it happen", but of course the actual suggestion on "HOW" to make it happen eludes you, as it would for most.

So my question still stands. How is VAC going to know the difference ?

The answer is...it can't. Therefore, it is not going to be allowed.

EDIT..I just saw your PS above...

I appreciate your kind words. And I don't mean to seem rude to you in my replies. Thanks agian, and I also don't mean to seem disrespectful of your opinion on this issue.

[Darren]

Oncw it becomes more mainstream VAC should they decide to support it will likely have a module that must be installed on the hypervisor itself which will give the "all-clear" signal to the Steam instances running on the VMs.

But it is far from trivial to design such a system and prevent tampering with it.

[FMP]

Originally posted by Satoru:

Originally posted by The Doctor:

I agree in the part of getting support for Linux, thats why for gaming i use only windows. Linux always have problems with games although is much better in terms of support than years ago.

If you ran the game in a vSphere or HyperV you'd have the same issue

Yup.
I never ran a VAC protected game under Hyper-V but did play games with Denvro (or whatever it's name is, and yes I'm aware of the differences) and ran into issues. When Sniper Elite 4 came out I simply whipped up a basic Windows install on a spare SSD and flip between Hyper-V and Physical depending on my mood.

[VaLiuM]

The amount of games that a) Run on Linux and b) Are VAC-protected at the same time are probably that small, that it's just not applicable and reasonable to adapt and change anything for the sake of a handful of "enthusiasts". That may have had a big influence in the decision back then. But idk.

[Darren]

Originally posted by VaLiuM:

The amount of games that a) Run on Linux and b) Are VAC-protected at the same time are probably that small, that it's just not applicable and reasonable to adapt and change anything for the sake of a handful of "enthusiasts". That may have had a big influence in the decision back then. But idk.

I will point out the mistake in your assumption. It's perfectly possible to run Windows in a Hypervisor VM. So the set of games that this won't work for is at least the full set of VAC-protected games. And rumor has it Denuvo also prevents games running on a Hypervisor.

I do agree it's currently likely a very small market of gamers that have configurations that are unsupported (far less than those that have touch-screens for example and can't use touch features in the SteamUI).

[VaLiuM]

I haven't said that you can't, OP already mentioned his setups on the very first page, so i already knew about Windows too. https://steamcommunity.com/discussions/forum/9/135510393198367927/#c135510393201473748

It just doesn't change the fact, that a relatively small percentage of uncommon setups will not create enough demand or justification to make any changes or adoptions, especially as long as that would mean to allow for possible backdooring and weakening of DRM, protection or anti-cheat in place.

There is probably a reason why virtualization and certain types of DRM, protection or anti-cheat won't be in bed with each other anytime soon. Especially since Denuvo is relatively new compared to VAC, it doesn't make a lot different. Best is to actually ask the creators why that is, for VAC it's already been mentioned, "it interferes", for Denuvo it's most likely the same reason.

[budozero]

I never had issues with VAC and hypervisors. Never.
So to say VAC does not allow hypervisors is not correct.

Look at OPs first post, look at what he says he is doing and look at what support said.

He claims to run VMs, one of them is his gaming "rig" - Supports response is there is KVM hypervisor running along side CSGO, thats a totally different situation.

[42]

Originally posted by budozero:

I never had issues with VAC and hypervisors. Never.
So to say VAC does not allow hypervisors is not correct.

Look at OPs first post, look at what he says he is doing and look at what support said.

He claims to run VMs, one of them is his gaming "rig" - Supports response is there is KVM hypervisor running along side CSGO, thats a totally different situation.

What hypervisor do you use?

[42]

Maybe if we set our SMBIOS fields to our host, VAC will let us play.

Windows 10 reports my System Information as this:
System Manufacturer - QEMU
System Model - Standard PC (i440FX + PIIX, 1996)
BIOS Version/Date - EFI Development Kit II /OVMF 0.0.0 2/6/2015
A hypervisor has been detected. Features required for Hyper-V will not be displayed.

I set these in kvm, using the output of strace -F -e open dmidecode
-smbios type=0,vendor="American Megatrends Inc.",version=0403,date=04/07/2015,release=4.6,uefi=on \
-smbios type=1,manufacturer=ASUS,product="All Series",version="System Version",serial="System Serial Number" \
-smbios type=2,manufacturer="ASUSTeK COMPUTER INC.",product="Z97-E/USB 3.1",version="Rev X.0x",serial=150544144600157,asset=fortytwo,location=fortytwo

Now Windows 10 sees this!
System Manufacturer - ASUS
System Model - All Series
BIOS Version/Date - American Megatrends Inc. 0403, 4/7/2015
BaseBoard Manufacturer - ASUSTek COMPUTER INC.
A hypervisor has been detected. Features required for Hyper-V will not be displayed.

Maybe disabling some CPU options we can trick Windows into thinking the CPU is not vt-d compatible?

[The Giving One]

Originally posted by 42:

Maybe disabling some CPU options we can trick Windows into thinking the CPU is not vt-d compatible?

How do you know the VAC team has not already thought of this ?

It is not an identifiable cheat that one downloads and actually installs, I will give you that. But, you did say "trick" Windows, so that would give me pause right there.

And that is actually going against the SSA clause also, I would say. You are not supposed to try to circumvent, inteferre, or bypass cheat detection such as VAC.

[Darren]

Amusingly no matter what he sets it's not going to work all the Hypervisor's are actually deliberately advertising their presence to Windows/Linux/etc by overriding a cpu instruction to return different results than normal.