Arch Linux Hypervisor Lab

Architecture notes, configuration examples and test records for an Arch Linux KVM/VFIO lab running on two Acer laptops.

Arch Linux host (LUKS2, Btrfs, linux-hardened, systemd-boot)
|
|-- clean     10.10.1.0/24  NAT       trusted accounts and games
|-- dirty     10.10.2.0/24  NAT       mods and untrusted software
|-- dev       10.10.3.0/24  NAT       development and 3D work
|-- lab       10.10.4.0/24  ISOLATED  malware and OT experiments
`-- services  10.10.5.0/24  NAT       private service VMs

NVIDIA dGPU -- VFIO --> one of clean / dirty / dev / lab

The dGPU is assigned to one workload VM at a time. It is never part of the services domain. The host remains headless by default; Sway and Looking Glass are optional administration components on the iGPU.

Repository set

1. arch-bootstrap installs the encrypted base system and optional encrypted VM disk.
2. privatestack-ansible configures KVM, networking, isolation, boot profiles and GPU hand-off.
3. This repository records the design, setup order, failures and compatibility results.

The known profiles are an Acer Nitro 5 with an RTX 3060 Mobile and an Acer Predator Helios 300 with an RTX 3070 Mobile. Individual components have been exercised on both machines, but a complete compatibility result is recorded only after a clean install and a second idempotent Ansible run. Current status is in hardware/README.md.

PCIe power-management freeze

The immediate host freeze was first isolated on the Nitro while starting a passthrough guest. Disabling PCIe port power management with pcie_port_pm=off stopped the freeze. The Predator later reproduced the same failure without that parameter and confirmed the same fix. pcie_aspm=off is kept in the VFIO profile as the related fallback used by this lab.

Full notes: problems/gpu-freeze-power-management.md.

Looking Glass without a physical display

On the Nitro, the only output wired to the passed GPU cannot be used. A Windows virtual display keeps the RTX 3060 active, kvmfr carries the framebuffer and SPICE remains available only for input and recovery. The Looking Glass client log and kvmfr state are used to distinguish real shared-memory capture from the plausible SPICE fallback.

Relevant files:

• configs/looking-glass.md
• configs/virtual-display-windows.md
• problems/geforce-passthrough-needs-a-display.md
• problems/looking-glass-shows-spice-and-calls-it-success.md
• problems/kvmfr-device-permissions.md
• problems/looking-glass-client-ini-comments.md

Repository map

configs/      boot, network, libvirt and guest configuration examples
hardware/     compatibility matrix, evidence policy and report template
problems/     failure investigations and fixes
scripts/      hardware report collector and repository verifier
SETUP.md      end-to-end setup and validation order

Run the repository checks with:

python scripts/verify_repo.py
bash -n scripts/collect-hardware-report.sh

Scope

The isolated network is intended for defensive research and controlled tests on systems you own or are authorized to examine. It has no uplink by default, and the host rules block forwarding between trust domains. Any deliberate LAN exposure belongs in the documented allowlist.