A few tweaks to try TPM improvement

home/hosts/jude/default.nix

@@ -1,10 +1,6 @@
 { pkgs, ... }:
 
 {
-  home.packages = with pkgs; [
-    (mumble.override { pulseSupport = true; })
-    #logseq
-  ];
   greg = {
     development = true;
     gui = true;
@@ -13,5 +9,16 @@
     vscodium = true;
   };
 
+  home = {
+    file.".config/libvirt/qemu.conf".text = ''
+      nvram = [ "/run/libvirt/nix-ovmf/OVMF_CODE.fd:/run/libvirt/nix-ovmf/OVMF_VARS.fd" ]
+    '';
+
+    packages = with pkgs; [
+      (mumble.override { pulseSupport = true; })
+      #logseq
+    ];
+  };
+
   programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/";
 }

hosts/jude/virt.nix

@@ -3,11 +3,6 @@
 {
   greg.vmdev.enable = true;
 
-  virtualisation = {
-    waydroid.enable = false;
-    lxd.enable = false;
-  };
-
   systemd.services = {
     gitlab-runner = {
       conflicts = [ "libvirtd.service" ];
@@ -35,4 +30,54 @@
       };
     };
   };
+
+  virtualisation = {
+    libvirtd.hooks.qemu = {
+      "win11-prepare-begin-bind_vfio.sh" = pkgs.writeShellApplication {
+        name = "bind_vfio.sh";
+        runtimeInputs = with pkgs; [
+          kmod
+          libvirt
+        ];
+        text = ''
+          guest="$1"
+          stage="$2"
+          state="$3"
+
+          if [ "$guest" == "win11" ] && [ "$stage" == "prepare" ] && [ "$state" == "begin" ]; then
+            for f in vfio vfio_iommu_type1 vfio_pci; do
+              modprobe "$f"
+            done
+
+            virsh nodedev-detach pci_0000_10_00_0
+            virsh nodedev-detach pci_0000_10_00_1
+          fi
+        '';
+      };
+
+      "win11-release-end-unbind_vfio.sh" = pkgs.writeShellApplication {
+        name = "unbind_vfio.sh";
+        runtimeInputs = with pkgs; [
+          kmod
+          libvirt
+        ];
+        text = ''
+          guest="$1"
+          stage="$2"
+          state="$3"
+
+          if [ "$guest" == "win11" ] && [ "$stage" == "release" ] && [ "$state" == "end" ]; then
+            virsh nodedev-reattach pci_0000_10_00_1
+            virsh nodedev-reattach pci_0000_10_00_0
+
+            for f in vfio_pci vfio_iommu_type1 vfio; do
+              modprobe -r "$f"
+            done
+          fi
+        '';
+      };
+    };
+    lxd.enable = false;
+    waydroid.enable = false;
+  };
 }

modules/nixos/vmdev.nix

@@ -46,6 +46,7 @@ with lib;
         enable = true;
         onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
         qemu.ovmf.enable = true;
+        qemu.swtpm.enable = true;
       };
 
       virtualbox.host = {