Slashdot Mirror
HP Disables VT On Some Intel Laptops
snoukka writes "I just bought a new HP nx9420 laptop in order to use it with Linux, XEN, and windows on XEN. I was very disappointed when I noticed that the processor had this feature but VT is disabled in BIOS by HP and cannot be enabled! Disabled!? It's like buying a car with turbo and finding out after buying it that this turbo 'feature' was disabled." The forum thread goes back to last August and is still live. The latest post from an HP rep indicates that new firmware for the nx9420 should be available later this week in which the ability to switch on VT is enabled. It's not clear whether other HP products, in which VT was also disabled, will also get new firmware.
But will HP have to charge $4.99 for the VT compatible firmware in order to comply with the Sarbanes-Oxley Act?
What is VT? That'd be nice to know.
How many escape pods are there? "NONE,SIR!" You counted them? "TWICE, SIR!"
I gave VT to my wife... ;)
Enabling VT is a huge security risk with no benefit for most of HP's customers. You probably should be able to turn it on, but having it on leaves open the possibility that a rootkit could be installed as the hypervisor/VMM/whatever, making it undetectable to the OS. Even having the option seems dangerous, as many "power users" will probably enable everything in the BIOS they can, regardless of risk/reward. On second thought, there are probably only a few hundred people that would run Xen on their laptop, so why have the "bug" available on the other few hundred thousand laptops? I suspect there may be many legal reasons why it is disabled by default, whether or not disabling the option to turn it on was intentional or not.
--That's the point of being root, you can do anything you want, even if it's stupid.
At least they didn't just delete the post. *cough* apple *cough*
I brought a Lenovo T60p recently. VT was off by default but can be turned on in the BIOS.
I was born with two perfectly good nipples, each of which is perfectly capable of producing milk, but the feature was disabled with a few androgens.
This is not a performance issue. The only "performance" difference here is that with VT, you can run Windows under Xen. Without VT, you cannot, but can still run kernels (Linux/BSD/etc.) which are built to run on the Xen hypervisor. The OP wanted to use it to run Windows and Linux/BSD/etc. under Xen. As Virtual PC and VMWare both do full virtualization, VT will not make a difference, but with Xen's (faster) paravirtualization (which requires cooperation between the VMM and the guest OS), it means that VT can keep Windows in its own domain, so that interrupts and syscalls don't interfere with the hypervisor and other guest OS(s).
--That's the point of being root, you can do anything you want, even if it's stupid.
After having taken a closer look at the page I linked (because it's been changed since I read it last), I've discovered that my particular model (X60t) at least has a new BIOS out that fixes the problem. : )
This leads me to believe that, at least for Lenovo, it's just that they were presumably in a hurry to get the model released, not that it was intentional crippleware.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Perhaps not quite ready for prime time, but http://freebios.sourceforge.net/ is a nice way to solve this problem. Then if VT doesn't work, you can fix it yourself.
1. I'm not sure that VMWare other than the higher end versions (ie not the free 'server' edition) would be capable of using VT at all; it isn't exactly a hypervisor...
2. From the Xen mailing list re why disk IO (for one thing) *will* be slower in a HVM domain than in a paravirtualised domain:
The reason the emulated IDE controller is quite slow is a consequence of
the emulation. The way it works is that the driver in the HVM domain
writes to the same IO ports that the real device would use. These writes
are intercepted by the hardware support in the processor and a VMEXIT is
issued to "exit the virtual machine" back into the hypervisor. The HV
looks at the "exit reason", and sees that it's an IO WRITE operation.
This operation is then encoded into a small packet and sent to QEMU.
QEMU processes this packet and responds back to HV to say "OK, done
that, you may continue". HV then does a VMRUN (or VMRESUME in the Intel
case) to continue the guest execution, which is probably another IO
instruction to write to the IDE controller. There's a total of 5-6 bytes
written to the IDE controller per transaction, and whilst it's possible
to combine some of these writes into a single write, it's not always
done that way. Once all writes for one transaction are completed, the
QEMU ide emulation code will perform the requested operation (such as
reading or writing a sector). When that is complete, a virtual interrupt
is issued to the guest, and the guest will see this as a "disk done"
interrupt, just like real hardware.
All these steps of IO intercepts takes several thousand cycles, which is
a bit longer than a regular IO write operation would take on the real
hardware, and the system will still need to issue the real IO operations
to perform the REAL hardware read/write corresponding to the virtual
disk (such as reading a file, LVM or physical partition) at some point,
so this is IN ADDITION to the time used by the hypervisor.
Unfortunately, the only possible improvement on this scenario is the
type "virtual-aware" driver that is described below.
[Using a slightly more efficient model than IDE may also help, but
that's going to be marginal compared to the benefits of using a
virtual-aware driver].
(Credit goes to Mats Petersson).
In the free world the media isn't government run; the government is media run.
Try searching around for "male lactation"
It's actually not uncommon. If you feel cheated, there are drugs you can take to enable this feature. Some models autoenable this feature for no reason.
Man, you really need that seminar!
I've had bad experiences with HP laptops before. This was several years ago, so I may not remember everything correctly.
My HP Pavilion laptop had the USB controller on IRQ 11, but, according to 2 out of 3 BIOS tables, it was on IRQ 9. This caused USB not to work under Linux. HP and the BIOS vendor apparently weren't interested in fixing the issue, so, eventually, it was worked around with a patch to Linux. According to what I've heard, the USB controller worked under Windows, but would reset every 5 minutes.
Around the time the warranty expired (I don't recall if it was just before or just after), the cooling fan started to get stuck. This would result in it making an awful lot of noise, followed soon enough by the system shutting down, because of overheating. After several requests to various addresses and phone numbers at HP, they offered that I could send the laptop in for repair, and they'll put in a new fan and send it back to me. Unfortunately, the operation would have cost more money than it was worth to me.
Also, the socket where the power adapter connects to the laptop broke. I eventually figured out how to open the laptop, get everything out of the way to get to the socket, and put everything back together. However, I never really succeeded in fixing the socket. I tried everything from soldering to chewing gum, but it kept breaking again. Just before I decided to fix the adapter plug to the socket (thus hopefully keeping the two connected and in place), the hard disk finally got so many bad sectors that it couldn't be used anymore. I gave the laptop away to a friend who said he'd fix and sell it, but a week later I found it on the sidewalk, thrown out of the window.
All in all, I think I got about a year and a half out of the laptop. After that, I bought an iBook, which I just sold last summer, apparently still working perfectly after two years of heavy use (more than the HP was ever subjected to). Pleased with Apple, but not wanting to make the switch to the Macbook just yet, I got another iBook before they ran out. It will take quite some convincing to get me to buy HP again, and I have a lasting aversion of moving parts in computers.
Please correct me if I got my facts wrong.
I work as an HP repair tech (currently.) We've had HUNDREDS of laptops sent in for repair for this reason.
It's really sad how HP features things, but disables them. I had to repair a DV9000 with the webcam built-in, because the webcam wasn't seen.
The spot for the webcam to hook up wasn't even tere. HP had installed a de-featured board instead of a fully-featured board.
This is everyday at HP. Nothing to see here, move along.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
As a long time Xen user and one of the very first non Xen developer to run hardware virtualized OS under Xen on Intel hardware, I can say something that most here are missing: if you install Xen as the hypervisor and then launch an unmodified OS, like Windows, using hardware virtualization (you ain't launching an unmodified OS under Xen without hardware virtualization anyway), the unmodified OS will *not* see a VT-capable system. Which means that if you install Xen in the first place, as a knowledgeable Xen/Linux user, it's gonna be *very* hard for a Windows virus to be able to attack Xen/Linux. You can run Xen under Xen (that's an indisputable fact, I've done it) but you fscking can NOT run an hardware virtualized system under another hardware virtualized system (that is another undisputable fact). Now conceptually there may be an workable exploit one day, but being able to attack the hypervisor from an OS seeing a non-VT system would be one heck of a hack (a bit like being able to crash a computer configured as a completely passive sniffer behind a one-way ethernet cable or a shomiti tap). In other words, it is very unlikely to happen anytime soon.
Moreover saying that an hypotetical "hypervisor exploit" would be undetectable is complete rubbish bullshit: it's not any more difficult to detect than to detect a root exploit. Anyone who consider that scanning a machine from itself is a safe way of detecting malware is a fool anyway. You take the system offline, hook it's hard disk to a known good system (or boot it using a live CD) and voila... Gameover rootkit, game over hypervisor "undetectable" malware.
(and if you want to play the "my servers can't be taken down" I'll fire back with a "what punk, you're telling me you've got a SPOF?").
What Xen buys you if you want, though, is free (from Linux) scanning / SHA1-summing / etc. of Windows systems without the Windows systems even *knowing* it is happening. Game over Windows "rootkits". Plain and simple.
I hope that by now you realize that if you run Xen/Linux then Windows under Xen using VT, it is *impossible* for a virus to act as the hypervisor and then to present you with a 'fake' Xen/Linux hypervisor that would allow you to run Windows. That's how VT in this day and Intel age works. It may change, but as of now: move along, nothing to see here.
(OK, OK, a *really* incredible virus could make you think you're running Windows using HVM though Windows would actually be running under QEMU... But that would be one heck of a hack and you'd notice QEMU's extreme slowness in emulation mode... No accelerated QEMU under Xen).
Hypervisor rootkits can't counter timing-attacks based detection either.
Windows running under Xen is way more secure than running on the bare metal. Dot.
So please, stop all the uninformed "oh my god VT is teh insecure tech!".
To me running Windows under Xen is the most secure thing that happened to Windows in ages (and, no, I wasn't that much of a VMWare fan).
VT is the vertical tab.
Octal: 013
Decimal: 11
Hex: 0x0B
C escape: \v
It's the Control-K character.
When sent to the console, it seems to go down a line or two.
I can't see much use for VT.
Acronyms are a way in which like minded people can quickly and efficiently communicate; countless businesses, academic institutions and social groups freely use acronyms as part of an established and understood vocabulary.
Except that in this case "VT" is not part of an established and understood vocabulary.
Of course, we wouldn't ask that question because everyone knows what HP is already. Why's that? Because this is a tech orientated site, of course.
This isn't really a good comparison. Even people without a technology background know what "HP" stands for.
I've been involved with and around computers and electronics since the late 1970s, and today is the first day in a long time that I've encountered the abbreviation "VT". It means "Video Terminal", right? Or is it "Video Tape"?
It's AEP (accepted editorial practice, but you knew that already, right?) to put the meaning of an abbreviation in parentheses next to its first use in a journalism piece, so you're sure the reader understands what you're talking about - unless you're writing an abbreviation knowledge test.
Putting moderation advice in your
You can't blame Lenovo for this. Intel had major problems with making VT work early on, and there are a lot of steppings where it's just plain broken. These companies decided to turn it off for everyone because they don't want to handle all the users complaining that Lenovo sucks because VT is broken. Blame Intel for this one.
My other car is first.