Discrete Device Assignment (DDA) Configuration and Requirements

Overview and Requirements

  • Discrete Device Assignment (DDA): Introduced in Server 2016, DDA allows virtual machines (VMs) to bypass the Hyper V hypervisor layer to directly access physical PCI Express (PCIe) hardware.

  • Supported Hardware: Officially supported by Microsoft exclusively for PCIe GPUs and NVMe storage devices.

  • Supported Guest Operating Systems: Windows 10, Server twenty nineteen, Server twenty sixteen, certain distros of Linux, and server twenty twelve R2 (with specific updates installed).

  • Host Hardware Prerequisites: Requires native PCI Express control and a PCIe root complex that supports Access Control Services to direct traffic through the input output memory management unit (IOMMU).

  • Host Verification: Microsoft provides a PowerShell machine profile script to verify host compatibility and determine the PCIe location path.

  • Driver Installation: Device drivers must be installed only on the guest VM, not the host system.

Limitations and Security Risks

  • Disabled Hyper V Features: VMs using DDA cannot utilize save and restore, live migration, dynamic memory, or high availability clustering.

  • Host Crash Risks: A compromised VM can trigger an error on the PCIe bus that crashes the physical server.

  • Dismounting Protection: An improper device dismount will crash the host server; installing a device mitigation driver (partitioning driver) from the manufacturer on the host mitigates this risk.

Configuration and Implementation Steps

  • Execution Environment: All configuration steps are performed through PowerShell.

  • Step 1 (VM Automatic Stop Action): Change the VM automatic stop action from the default save state setting to turn off the VM.

  • Step 2 (Dismount from Host): Identify the PCIe location path, disable the device on the host, and dismount the device (requires the force parameter if no mitigation driver is installed).

  • Step 3 (Assign to VM): Mount and assign the device to the target VM using its name and PCIe location path before starting the VM.

  • GPU Specifics: Graphics cards may require enabling write combining on the CPU, configuring 32 bit MMIO space, and configuring greater than 32 bit MMIO space.

  • Restoring to Host: Stop the VM, run PowerShell commands to remove the device from the VM and mount it back to the host partition, then enable it in the host Device Manager.