| Previous | Next |
| STATUS_VSM_NOT_INITIALIZED | STATUS_VOLSNAP_BOOTFILE_NOT_VALID |
STATUS_VSM_DMA_PROTECTION_NOT_IN_USE
The missing layer is IOMMU-backed DMA isolation for the VSM path
STATUS_VSM_DMA_PROTECTION_NOT_IN_USE says the hypervisor is not protecting DMA through the required IOMMU path. An IOMMU translates and restricts device DMA accesses so devices can be isolated from memory they should not reach. For a VSM scenario, that protection is part of maintaining separation between ordinary and isolated memory contexts.
This status should not automatically be equated with the Windows feature named Kernel DMA Protection. Microsoft documents Kernel DMA Protection as a separate Windows security feature and notes that it does not require VBS. The NTSTATUS wording is specifically about hypervisor/VSM DMA protection and the presence or firmware enablement of an IOMMU.
What to inspect
- Platform IOMMU capability and whether Intel VT-d or AMD IOMMU support is enabled in firmware.
- Hypervisor/VSM state for the current boot.
- Firmware updates and ACPI/IOMMU description changes on the affected platform.
- Whether the requested feature explicitly requires VSM DMA protection rather than only ordinary DMA remapping.
Do not diagnose this status by testing only device-driver signatures or by toggling external-device policy. Confirm that the hypervisor sees a usable IOMMU and can apply DMA isolation in the VSM configuration requested by the component.
References
- Microsoft: Virtual Secure Mode
- Microsoft: Kernel DMA Protection
- Microsoft: VBS platform requirements
- Microsoft: IOMMU-based GPU isolation
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.