26

We've had a number of servers from Dell recently, all of which have had hardware-assisted virtualization disabled in the BIOS.

As far as I know hardware-assisted virtualization is a good thing - so why would Dell disable it? Does it have a performance overhead if the machine isn't acting as a virtual machine host? Are there any security issues?

In case it's relevant to your answers we will primarily be using:

  • Host OS: Windows Server 2003 Enterprise R2 (32-bit)
  • Guest OS:Windows Server 2003 Enterprise R2 (32-bit)
  • VMM: Virtual Server 2005 Enterprise R2 SP1
Tom Robinson
  • 775
  • 2
  • 11
  • 21
  • I have also seen this with Dell laptops – Richard Ev Jun 12 '09 at 11:42
  • I posted about something similar the other day regarding HP blade servers - I couldn't see why they disable it be default either - bloody irritating isn't it! – Chopper3 Jun 12 '09 at 11:47
  • Can you add a link? I couldn't find any similar questions when I searched. – Tom Robinson Jun 12 '09 at 11:53
  • That was a good question http://serverfault.com/questions/23518/virtualization-pitfalls-lessons-learned – Kara Marfia Jun 12 '09 at 12:18
  • 3
    There is one universal reason for re-actively disabling complex systems/functions: work around bugs. In this particular case I know of at least one such bug. See issue #734 at the "Revision Guide for AMD Family 15h Models 00h-0Fh Processors". – ndemou Aug 26 '14 at 13:50
  • OT: When users come to you with: Q: "Why is my CPU at 20% on the new blades while the max on the old blades was 10%?" A: Dell also enables power management on their blades *grrr*. Since we're virtualizing we don't need power management as virtualization saves enough power IMHO. – Marki Apr 08 '16 at 13:29

11 Answers11

16

The reason Dell (and Sony etc.) disable Intel-VT and AMD-V is that they cannot support it. Enabling the feature would mean they would have to provide support on it, which the simply cannot do, due to insufficient knowledge at the supportdesk, mainly.

That is, at least, how Sony formulated it.

I tried prying the reason from Sony support guys and that is the only thing they would give me. I finally was able to patch my BIOS and enable VT myself, though.

As for the rest, stuff like Bluepill are not exactly mainstream. And as far as I know - and I work with virtualization stuff a lot - there is no downside to enabling it. If there is though, I would really like to know about it...

wzzrd
  • 10,269
  • 2
  • 32
  • 47
  • At first I doubted this response. And I know this post is extremely old, but I was doing some research and this was actually the first thing I found on Google. This is actually 100% correct, as it is a support issue. Most people (to date now) will not have to patch their BIOS. Vendors generally sell server and client equipment with the purpose of installing a Native OS, not a Hypervisor. For this reason, they Disable VT/VTx in order to avoid some of the odd problems they can theoretically cause. More specifically, the vendors do not want to spend time testing features they dont support. – IceMage Dec 30 '14 at 17:36
10

One very good reason is security. There have been known hacks that insert a malicious hypervisor in between your OS and your hardware. This allows anyone to capture any data in a perfectly transparent manner.

Antoine Benkemoun
  • 7,314
  • 3
  • 41
  • 60
  • 2
    You're thinking about a rootkit such as BluePill. While I haven't looked into this in detail, I think this really isn't much of an issue anymore these days. I could be wrong, you can just look it up I suppose. Good addition either way, definately something to be considered and a good enough reason to disable it if it's not being used. – HannesFostie Jun 12 '09 at 11:50
  • 2
    Here's some more information about BluePill - http://en.wikipedia.org/wiki/Blue_Pill_(malware) – Tom Robinson Jun 12 '09 at 13:26
  • 1
    @Anapologetos, no actually, that is not a pre-req. Blue pill traps the running OS in a virtual machine. It inserts itself underneath the OS, so to speak. It *becomes* a hypervisor rather than needing one. Apart from that, according to wikipedia, it targeted only Vista, but I suppose the concept could be easily portable. It virtualization, after all. Anyway, not enabling VT because of Blue Pill seems rather silly: it's not out in the wild as far as I know (though it is open source) and its undetectability is debated. – wzzrd Jun 12 '09 at 14:24
  • You are correct, wzzrd. I rescind my comment--I haven't had my coffee yet this morning! :) – Josh Brower Jun 12 '09 at 14:38
6

I would hazard a guess that not all CPUs available for a given motherboard and BIOS combination support VT extensions. So they ship it as disabled in the BIOS for the sake of compatibility.

Times are changing and VT is becoming pretty common place now. So perhaps we'll see a change?

Dan Carley
  • 25,189
  • 5
  • 52
  • 70
3

I found this on The Register:

Sony's engineers and QA people were: "Very concerned that enabling VT would expose our systems to malicious code that could go very deep in the Operating System structure of the PC and completely disable the latter."

Tom Robinson
  • 775
  • 2
  • 11
  • 21
2

Depending on the virtualization method you are intending to use you may not need to enable hardware virtualization featurs in Intel-VT and AMD-V capable CPUs. When you would need to use these features is when the virtualization method is unable to work when installing unmodified operating systems, usually Microsoft Windows.

When working with VMware the hardware virtualization features added byt the Intel-VT and AMD-V chipsets are usually unnecessary as VMware provides all of the necessary features within itself and it can lead to degraded performance of the virtual server itself.

With Xen virtualization you will need to use these features if you intend to run Windows within the unprivileged guest domains (domU's) and install using full-virtualization rather than para-virtualization. In my experience having to enable these features can show a significant degradation in performance overall even still but it will allow you to install Windows. Other operating systems like Linux, *BSD and OpenSolaris I have had no problems installing without hardware virtualization and see much better improvement when the hardware virtualization features are disabled.

In the end it comes down to what virtualization path your are planning to take, and what operating systems you see being installed that can be the determining factor in whether to leave it disabled or go ahead and enable it.

Jeremy Bouse
  • 11,241
  • 2
  • 27
  • 40
2

Having worked in Dell server support, all the VT capable servers have the feature disabled in the bios by default, but it is easy to enable if you need it.

As for Sony - they have it disabled in the laptops, for the reasons stated above.

I've never seen a server with VT/SVM capabilities disabled completely, to the point you can't enable it.

dyasny
  • 18,482
  • 6
  • 48
  • 63
1

I might be behind the times, but in lots of cases with things like VMWare it actually makes a lot of things slower:

VMWare White Paper on the Subject

Kyle Brandt
  • 82,107
  • 71
  • 302
  • 444
  • Isn't that whitepaper from 2006? Furthermore, it discusses the downswides when actually virtualizing an environment from what I could tell at first glance. The original poster will be running native workloads on it only. – HannesFostie Jun 12 '09 at 11:53
  • Noticed with VirtualBox that some OS run much faster if hardware virtualization is disabled. Of course, others run much faster with it enabled! :-) – Brian Knoblauch Jun 12 '09 at 12:10
  • it doesn't say that activating VT makes things slower, it says that their non-VT virtualization is faster than newer VT-dependent ones. – Javier Jun 12 '09 at 19:39
1

As wzzrd mentioned above, it's all to do with support. Leaving VT off lowers the number of support scenarios where VT becomes a factor, enabling quicker problem resolution for the majority of customers who haven't ventured down the virtualization route.

One thing I've noted is that in windows 7, running the xp mode beta causes conflicts with vmware workstation when VT is enabled on my dell. Both want to "get hold of" the VT extension and as xp mode leaves a VPC process running even after exiting, it doesn't "let go" of the VT. So when you fire up vmware, any virtual machine you try and run dies on startup. Disabling the VT extension in the bios prevents this from happening, but with markedly reduced performance.

  • That's quite a weird argument. How about the calls from the people complaining about it being turned off? – niXar Jun 14 '09 at 10:02
0

I am pretty sure hardware assisted virtualization does NOT have any overhead when you're just running a native OS.

The only reason I can think of for having the ability to disable it (I've never thought about this before, actually) is that certain applications/workloads could in fact run worse when HAV is enabled than when ran natively, due to certain overhead in the MMU for instance.

I wouldn't worry about it at all.

HannesFostie
  • 845
  • 14
  • 29
0

Enabling Intel VT makes CPU hotter, I've had a Desktop and Laptop that have had this behaviour, both with stock CPU coolers. I'm refering to Home Computers but it's the same feature.

I know that AMD-V comes enabled by default, but I don't know if it makes CPU hotter.

Andrei Silviu Canghizer
  • 11
  • I doubt that is true. I don't see any reason why an identical workload would have a measurable difference in power consumption depending on whether VT is enabled. Some software will behave differently depending on whether VT is enabled, and of course that can change the workload on the CPU and cause a change in the temperature. But VT cannot be blamed for that unless very strong evidence can be provided. – kasperd Apr 08 '16 at 10:14
-2

Simply have a look at Hewlett Packard Proliant DL145 G3 - Servers.

HP disabled the HyperVisor (HV) by the BIOS. The BIOS-Menue don't show an option to enable this feature. The only answer to questions regarding this problem is "this platform don't support hardware virtualisation - end of discussion"

It's simply impossible to enable HV with the HP-provided BIOS.

The only solution: Coreboot ... that is to completely wipe out the PHOENIX-BIOS from this boards and replace it with something other ...

wonea
  • 103
  • 3
  • 1
    -1 The question is not about systems where HV is completely unavailable in the BIOS. It's about why it is shipped disabled, even though it's available. – sleske May 09 '12 at 07:46