Hyper-V enlightened VMCS

Windows guests that run Hyper-V, including for virtualization-based security (VBS) and memory integrity (HVCI), can use enlightened VMCS (eVMCS) to reduce nested virtualization overhead. This can improve performance when these features are active; the benefit depends on the workload. Benchmark with and without eVMCS: QEMU notes that it disables some virtualization features, including posted interrupts, which can offset the benefit.

Before you begin

Your cloud must support eVMCS and have eligible Intel compute hosts. Ask your cloud operator to confirm the Preparing hosts for eVMCS prerequisites. eVMCS is Intel-only; this restriction doesn’t apply to Windows or vTPM generally.

Use a Windows image you own or have permission to modify. Configure Hyper-V or VBS inside Windows as needed; the image property doesn’t enable them. For TPM requirements, see Using a virtual TPM.

Enable eVMCS

Set these properties on the Windows image before creating instances:

$ openstack image set <image-name-or-uuid> \
    --property os_type=windows \
    --property hw_hyperv_evmcs=true

Create new instances from that image. Updating image properties doesn’t change existing instances. If no eligible Intel host is available, scheduling fails with No valid host; ask your cloud operator to check host eligibility and capacity.

eVMCS is disabled by default. To disable it for future instances, set hw_hyperv_evmcs=false on the image. This feature doesn’t add Mode-Based Execution Control (MBEC) support.