26

We've had a number of servers from Dell recently, all of which have had hardware-assisted virtualization disabled in the BIOS.

As far as I know hardware-assisted virtualization is a good thing - so why would Dell disable it? Does it have a performance overhead if the machine isn't acting as a virtual machine host? Are there any security issues?

In case it's relevant to your answers we will primarily be using:

  • Host OS: Windows Server 2003 Enterprise R2 (32-bit)
  • Guest OS:Windows Server 2003 Enterprise R2 (32-bit)
  • VMM: Virtual Server 2005 Enterprise R2 SP1
6
  • I have also seen this with Dell laptops
    – Richard Ev
    Jun 12, 2009 at 11:42
  • I posted about something similar the other day regarding HP blade servers - I couldn't see why they disable it be default either - bloody irritating isn't it!
    – Chopper3
    Jun 12, 2009 at 11:47
  • Can you add a link? I couldn't find any similar questions when I searched. Jun 12, 2009 at 11:53
  • That was a good question serverfault.com/questions/23518/… Jun 12, 2009 at 12:18
  • 3
    There is one universal reason for re-actively disabling complex systems/functions: work around bugs. In this particular case I know of at least one such bug. See issue #734 at the "Revision Guide for AMD Family 15h Models 00h-0Fh Processors".
    – ndemou
    Aug 26, 2014 at 13:50

11 Answers 11

16

The reason Dell (and Sony etc.) disable Intel-VT and AMD-V is that they cannot support it. Enabling the feature would mean they would have to provide support on it, which the simply cannot do, due to insufficient knowledge at the supportdesk, mainly.

That is, at least, how Sony formulated it.

I tried prying the reason from Sony support guys and that is the only thing they would give me. I finally was able to patch my BIOS and enable VT myself, though.

As for the rest, stuff like Bluepill are not exactly mainstream. And as far as I know - and I work with virtualization stuff a lot - there is no downside to enabling it. If there is though, I would really like to know about it...

1
  • At first I doubted this response. And I know this post is extremely old, but I was doing some research and this was actually the first thing I found on Google. This is actually 100% correct, as it is a support issue. Most people (to date now) will not have to patch their BIOS. Vendors generally sell server and client equipment with the purpose of installing a Native OS, not a Hypervisor. For this reason, they Disable VT/VTx in order to avoid some of the odd problems they can theoretically cause. More specifically, the vendors do not want to spend time testing features they dont support.
    – IceMage
    Dec 30, 2014 at 17:36
10

One very good reason is security. There have been known hacks that insert a malicious hypervisor in between your OS and your hardware. This allows anyone to capture any data in a perfectly transparent manner.

4
  • 2
    You're thinking about a rootkit such as BluePill. While I haven't looked into this in detail, I think this really isn't much of an issue anymore these days. I could be wrong, you can just look it up I suppose. Good addition either way, definately something to be considered and a good enough reason to disable it if it's not being used. Jun 12, 2009 at 11:50
  • 2
    Here's some more information about BluePill - en.wikipedia.org/wiki/Blue_Pill_(malware) Jun 12, 2009 at 13:26
  • 1
    @Anapologetos, no actually, that is not a pre-req. Blue pill traps the running OS in a virtual machine. It inserts itself underneath the OS, so to speak. It becomes a hypervisor rather than needing one. Apart from that, according to wikipedia, it targeted only Vista, but I suppose the concept could be easily portable. It virtualization, after all. Anyway, not enabling VT because of Blue Pill seems rather silly: it's not out in the wild as far as I know (though it is open source) and its undetectability is debated.
    – wzzrd
    Jun 12, 2009 at 14:24
  • You are correct, wzzrd. I rescind my comment--I haven't had my coffee yet this morning! :) Jun 12, 2009 at 14:38
6

I would hazard a guess that not all CPUs available for a given motherboard and BIOS combination support VT extensions. So they ship it as disabled in the BIOS for the sake of compatibility.

Times are changing and VT is becoming pretty common place now. So perhaps we'll see a change?

3

I found this on The Register:

Sony's engineers and QA people were: "Very concerned that enabling VT would expose our systems to malicious code that could go very deep in the Operating System structure of the PC and completely disable the latter."

1
  • Shouldn't this be the accepted answer? Oh, the words belong to Sony.......
    – Pacerier
    Apr 22, 2015 at 8:06
2

Depending on the virtualization method you are intending to use you may not need to enable hardware virtualization featurs in Intel-VT and AMD-V capable CPUs. When you would need to use these features is when the virtualization method is unable to work when installing unmodified operating systems, usually Microsoft Windows.

When working with VMware the hardware virtualization features added byt the Intel-VT and AMD-V chipsets are usually unnecessary as VMware provides all of the necessary features within itself and it can lead to degraded performance of the virtual server itself.

With Xen virtualization you will need to use these features if you intend to run Windows within the unprivileged guest domains (domU's) and install using full-virtualization rather than para-virtualization. In my experience having to enable these features can show a significant degradation in performance overall even still but it will allow you to install Windows. Other operating systems like Linux, *BSD and OpenSolaris I have had no problems installing without hardware virtualization and see much better improvement when the hardware virtualization features are disabled.

In the end it comes down to what virtualization path your are planning to take, and what operating systems you see being installed that can be the determining factor in whether to leave it disabled or go ahead and enable it.

1
  • He's not taking any virtualization path, kind of missed the point of his question Jun 12, 2009 at 13:02
2

Having worked in Dell server support, all the VT capable servers have the feature disabled in the bios by default, but it is easy to enable if you need it.

As for Sony - they have it disabled in the laptops, for the reasons stated above.

I've never seen a server with VT/SVM capabilities disabled completely, to the point you can't enable it.

1

I might be behind the times, but in lots of cases with things like VMWare it actually makes a lot of things slower:

VMWare White Paper on the Subject

3
  • Isn't that whitepaper from 2006? Furthermore, it discusses the downswides when actually virtualizing an environment from what I could tell at first glance. The original poster will be running native workloads on it only. Jun 12, 2009 at 11:53
  • Noticed with VirtualBox that some OS run much faster if hardware virtualization is disabled. Of course, others run much faster with it enabled! :-) Jun 12, 2009 at 12:10
  • it doesn't say that activating VT makes things slower, it says that their non-VT virtualization is faster than newer VT-dependent ones.
    – Javier
    Jun 12, 2009 at 19:39
1

As wzzrd mentioned above, it's all to do with support. Leaving VT off lowers the number of support scenarios where VT becomes a factor, enabling quicker problem resolution for the majority of customers who haven't ventured down the virtualization route.

One thing I've noted is that in windows 7, running the xp mode beta causes conflicts with vmware workstation when VT is enabled on my dell. Both want to "get hold of" the VT extension and as xp mode leaves a VPC process running even after exiting, it doesn't "let go" of the VT. So when you fire up vmware, any virtual machine you try and run dies on startup. Disabling the VT extension in the bios prevents this from happening, but with markedly reduced performance.

1
  • That's quite a weird argument. How about the calls from the people complaining about it being turned off?
    – niXar
    Jun 14, 2009 at 10:02
0

I am pretty sure hardware assisted virtualization does NOT have any overhead when you're just running a native OS.

The only reason I can think of for having the ability to disable it (I've never thought about this before, actually) is that certain applications/workloads could in fact run worse when HAV is enabled than when ran natively, due to certain overhead in the MMU for instance.

I wouldn't worry about it at all.

1
  • Antoine Benkemoun made a very good point, please read his post as well. Jun 12, 2009 at 11:51
0

Enabling Intel VT makes CPU hotter, I've had a Desktop and Laptop that have had this behaviour, both with stock CPU coolers. I'm refering to Home Computers but it's the same feature.

I know that AMD-V comes enabled by default, but I don't know if it makes CPU hotter.

1
  • I doubt that is true. I don't see any reason why an identical workload would have a measurable difference in power consumption depending on whether VT is enabled. Some software will behave differently depending on whether VT is enabled, and of course that can change the workload on the CPU and cause a change in the temperature. But VT cannot be blamed for that unless very strong evidence can be provided.
    – kasperd
    Apr 8, 2016 at 10:14
-2

Simply have a look at Hewlett Packard Proliant DL145 G3 - Servers.

HP disabled the HyperVisor (HV) by the BIOS. The BIOS-Menue don't show an option to enable this feature. The only answer to questions regarding this problem is "this platform don't support hardware virtualisation - end of discussion"

It's simply impossible to enable HV with the HP-provided BIOS.

The only solution: Coreboot ... that is to completely wipe out the PHOENIX-BIOS from this boards and replace it with something other ...

1
  • 1
    -1 The question is not about systems where HV is completely unavailable in the BIOS. It's about why it is shipped disabled, even though it's available.
    – sleske
    May 9, 2012 at 7:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .