Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have yet to see a system whose default configuration enables MMU and directed I/O virtualization. Often this necessitates rebooting and going into the BIOS to enable it if you want, e.g., 64-bit support on your VMs.

Is there some kind of substantial processor overhead that occurs if this is switched on and you're not using virtualization? If not, then what's the reason for it being off by default?

share|improve this question
3  
One vote up since I am also asking myself this question! –  Valentin May 17 '12 at 13:44

3 Answers 3

There were some proof-of-concept rootkits like Blue Pill a while back that could own a system with VT on. After this discovery, most vendors began shipping their units with VT disabled as a general security precaution.

share|improve this answer
6  
+1 People using VT on a desktop/laptop are the exception. That machine being susceptible to virii is the rule. –  Chris S May 17 '12 at 14:03
    
I'm suddenly having second thoughts about this shiny new powerful dev machine I've built that runs a bunch of VMs with hardware virtualization enabled. I don't need virtualization, but I figure it'd save me time in the long run not having to repave it every couple of months. How big an issue is this? –  Paperjam May 17 '12 at 21:16
1  
Virtually non-existant (as of this comment). Blue Pill was a proof of concept. I am unaware of anything like this in the wild. –  MDMarra May 17 '12 at 21:20
1  
Here is the Microsoft evaluation of the security problem, including the recommendation to switch VT off by default on client role systems: msdn.microsoft.com/en-us/windows/hardware/gg463498.aspx –  Jpsy Jul 20 '13 at 15:02
1  
Microsoft's paper is no longer available on their web site, but you can read it on the Internet Archive if you want to. –  Josh Kelley Sep 9 '14 at 16:48

All the blades we buy have virtualization enabled by default, because I guess our vendor has made a commercial decision to do so to save on so many support calls.

Its not disabled because of a processor hit, but depending on what its being used for, the reason that it may be off by default is that enabling these features can effect peripheral access.

share|improve this answer
3  
What peripheral access can this impact? I've never heard that before. –  MDMarra May 17 '12 at 13:25
    
Are you talking about VT-d when you mentioned peripheral access? –  Zoredache May 17 '12 at 19:03
    
No, it was MMU... I remember someone droning on about it recently. Something to do with Rasberry Pi. –  Sirch May 18 '12 at 9:46

Note that according to this other thread, it also seems to have some impact on performances http://superuser.com/questions/545101/why-does-hp-recommend-that-i-keep-hardware-virtualization-off

It seems relevant to me, since reduced set of instructions are more efficient. I just wouldn't have thought that changing a BIOS option could directly affect this.

I got no idea whether the impact is significant or not, but considering this and the security potential flaw, having such a rarely used feature disabled by default looks like a good choice to me.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.