19.5. Enabling enhanced hardware security on Windows virtual machines

Procedure

1. Open the XML configuration of the Windows VM. The following example opens the configuration of the Example-L1 VM:

   # virsh edit Example-L1

2. Under the <cpu> section, specify the CPU mode and add the policy flag.

   重要
   • For Intel CPUs, enable the vmx policy flag.
   • For AMD CPUs, enable the svm policy flag.
   • If you do not want to specify a custom CPU, you can set the <cpu mode> as host-passthrough.

   <cpu mode='custom' match='exact' check='partial'>
       <model fallback='allow'>Skylake-Client-IBRS</model>
       <topology sockets='1' dies='1' cores='4' threads='1'/>
       <feature policy='require' name='vmx'/>
   </cpu>

3. Save the XML configuration and reboot the VM.

4. On the VMs operating system, navigate to the Core isolation details page:

   Settings > Update & Security > Windows Security > Device Security > Core isolation details

5. Toggle the switch to enable Memory Integrity.

6. Reboot the VM.

   注意

   For other methods of enabling HVCI, see the relevant Microsoft documentation.