Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We've had a number of servers from Dell recently, all of which have had hardware-assisted virtualization disabled in the BIOS.

As far as I know hardware-assisted virtualization is a good thing - so why would Dell disable it? Does it have a performance overhead if the machine isn't acting as a virtual machine host? Are there any security issues?

In case it's relevant to your answers we will primarily be using:

  • Host OS: Windows Server 2003 Enterprise R2 (32-bit)
  • Guest OS:Windows Server 2003 Enterprise R2 (32-bit)
  • VMM: Virtual Server 2005 Enterprise R2 SP1
share|improve this question
    
I have also seen this with Dell laptops –  Richard Everett Jun 12 '09 at 11:42
    
I posted about something similar the other day regarding HP blade servers - I couldn't see why they disable it be default either - bloody irritating isn't it! –  Chopper3 Jun 12 '09 at 11:47
    
Can you add a link? I couldn't find any similar questions when I searched. –  tjrobinson Jun 12 '09 at 11:53
    
That was a good question serverfault.com/questions/23518/… –  Kara Marfia Jun 12 '09 at 12:18

10 Answers 10

up vote 7 down vote accepted

The reason Dell (and Sony etc.) disable Intel-VT and AMD-V is that they cannot support it. Enabling the feature would mean they would have to provide support on it, which the simply cannot do, due to insufficient knowledge at the supportdesk, mainly.

That is, at least, how Sony formulated it.

I tried prying the reason from Sony support guys and that is the only thing they would give me. I finally was able to patch my BIOS and enable VT myself, though.

As for the rest, stuff like Bluepill are not exactly mainstream. And as far as I know - and I work with virtualization stuff a lot - there is no downside to enabling it. If there is though, I would really like to know about it...

share|improve this answer

One very good reason is security. There have been known hacks that insert a malicious hypervisor in between your OS and your hardware. This allows anyone to capture any data in a perfectly transparent manner.

share|improve this answer
1  
You're thinking about a rootkit such as BluePill. While I haven't looked into this in detail, I think this really isn't much of an issue anymore these days. I could be wrong, you can just look it up I suppose. Good addition either way, definately something to be considered and a good enough reason to disable it if it's not being used. –  HannesFostie Jun 12 '09 at 11:50
    
Here's some more information about BluePill - en.wikipedia.org/wiki/Blue_Pill_(malware) –  tjrobinson Jun 12 '09 at 13:26
1  
@Anapologetos, no actually, that is not a pre-req. Blue pill traps the running OS in a virtual machine. It inserts itself underneath the OS, so to speak. It becomes a hypervisor rather than needing one. Apart from that, according to wikipedia, it targeted only Vista, but I suppose the concept could be easily portable. It virtualization, after all. Anyway, not enabling VT because of Blue Pill seems rather silly: it's not out in the wild as far as I know (though it is open source) and its undetectability is debated. –  wzzrd Jun 12 '09 at 14:24
    
You are correct, wzzrd. I rescind my comment--I haven't had my coffee yet this morning! :) –  Josh Brower Jun 12 '09 at 14:38

I would hazard a guess that not all CPUs available for a given motherboard and BIOS combination support VT extensions. So they ship it as disabled in the BIOS for the sake of compatibility.

Times are changing and VT is becoming pretty common place now. So perhaps we'll see a change?

share|improve this answer

Depending on the virtualization method you are intending to use you may not need to enable hardware virtualization featurs in Intel-VT and AMD-V capable CPUs. When you would need to use these features is when the virtualization method is unable to work when installing unmodified operating systems, usually Microsoft Windows.

When working with VMware the hardware virtualization features added byt the Intel-VT and AMD-V chipsets are usually unnecessary as VMware provides all of the necessary features within itself and it can lead to degraded performance of the virtual server itself.

With Xen virtualization you will need to use these features if you intend to run Windows within the unprivileged guest domains (domU's) and install using full-virtualization rather than para-virtualization. In my experience having to enable these features can show a significant degradation in performance overall even still but it will allow you to install Windows. Other operating systems like Linux, *BSD and OpenSolaris I have had no problems installing without hardware virtualization and see much better improvement when the hardware virtualization features are disabled.

In the end it comes down to what virtualization path your are planning to take, and what operating systems you see being installed that can be the determining factor in whether to leave it disabled or go ahead and enable it.

share|improve this answer
    
He's not taking any virtualization path, kind of missed the point of his question –  HannesFostie Jun 12 '09 at 13:02

I might be behind the times, but in lots of cases with things like VMWare it actually makes a lot of things slower:

VMWare White Paper on the Subject

share|improve this answer
    
Isn't that whitepaper from 2006? Furthermore, it discusses the downswides when actually virtualizing an environment from what I could tell at first glance. The original poster will be running native workloads on it only. –  HannesFostie Jun 12 '09 at 11:53
    
Noticed with VirtualBox that some OS run much faster if hardware virtualization is disabled. Of course, others run much faster with it enabled! :-) –  Brian Knoblauch Jun 12 '09 at 12:10
    
it doesn't say that activating VT makes things slower, it says that their non-VT virtualization is faster than newer VT-dependent ones. –  Javier Jun 12 '09 at 19:39

As wzzrd mentioned above, it's all to do with support. Leaving VT off lowers the number of support scenarios where VT becomes a factor, enabling quicker problem resolution for the majority of customers who haven't ventured down the virtualization route.

One thing I've noted is that in windows 7, running the xp mode beta causes conflicts with vmware workstation when VT is enabled on my dell. Both want to "get hold of" the VT extension and as xp mode leaves a VPC process running even after exiting, it doesn't "let go" of the VT. So when you fire up vmware, any virtual machine you try and run dies on startup. Disabling the VT extension in the bios prevents this from happening, but with markedly reduced performance.

share|improve this answer
    
That's quite a weird argument. How about the calls from the people complaining about it being turned off? –  niXar Jun 14 '09 at 10:02

I found this on The Register:

Sony's engineers and QA people were: "Very concerned that enabling VT would expose our systems to malicious code that could go very deep in the Operating System structure of the PC and completely disable the latter."

share|improve this answer

Having worked in Dell server support, all the VT capable servers have the feature disabled in the bios by default, but it is easy to enable if you need it.

As for Sony - they have it disabled in the laptops, for the reasons stated above.

I've never seen a server with VT/SVM capabilities disabled completely, to the point you can't enable it.

share|improve this answer

I am pretty sure hardware assisted virtualization does NOT have any overhead when you're just running a native OS.

The only reason I can think of for having the ability to disable it (I've never thought about this before, actually) is that certain applications/workloads could in fact run worse when HAV is enabled than when ran natively, due to certain overhead in the MMU for instance.

I wouldn't worry about it at all.

share|improve this answer
    
Antoine Benkemoun made a very good point, please read his post as well. –  HannesFostie Jun 12 '09 at 11:51

simply have a look at Hewlett Packard Proliant DL145 G3 - Servers.

HP disabled the HV by the BIOS. The BIOS-Menue don't show an option to enable this feature. The only answer to questions regarding this problem is "this platform don't support hardware virtualisation - end of discussion"

It's simply impossiblt to enable HV with the HP-provided BIOS.

The only solution: Coreboot ... that is to completely whipe out the PHOENIX-BIOS from this boards and replace it with something other ...

share|improve this answer
    
-1 The question is not about systems where HV is completely unavailable in the BIOS. It's about why it is shipped disabled, even though it's available. –  sleske May 9 '12 at 7:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.