Question from a non tech savvy person.
SMT = Hyperthreading?
So Qubes disables hyperthreading?
Why does Qubes do this?
This essentially means that for Qubes there are only so called 4 “logical cores” if you got one CPU with 4 cores though it supports Hyperthreading, which would ammount to 8 logical cores.
Thanks for all the answers. I am very interested in not only using it but understanding it as well.
If you also got any good reads (books, blogs, wikis etc) on Intel-CPU, Xen, Virtualisation etc. please post it.
I find the Xen wiki not very good for people who want to understand more about the whole concept (either it expects deep knowledge or it is just a manual).
Hyperthreading is Intel’s name for SMT.
So strictly it should be “Hyperthreading = SMT”
SMT is “Simultaneous multithreading” - threads can work on the same
physical core at the same time, which is why your 4 cores can present as
8 logical cores.
(There are other forms of multithreading.)
There have been a number of security problems with hyperthreading.These
are to do with the way that the processor runs the threads, caches data
when a thread is idle, and controls the process. An attacker might be
able to read data from dom0, or data from another qube.
Although the manufacturers have issued patches against known
vulnerabilities, Qubes (as well as applying those patches) disables SMT
by default. This is a defensive measure against other vulnerabilities
being found.
You can read about the Qubes approach in Qubes Security Bulletins
indexed here: News Categories | Qubes OS
Wikipedia is a good place to start on SMT and CPUs generally.
Because Xen is a hypervisor it can create vcpus and present these to
qubes. Xen tries to optimise the vcpus across the “real” physical cores,
and does a reasonable job of it. This is why you can allocate more than
the available cores, and you may see a performance benefit. But you
are making Xen do a lot of work, which may be counterproductive.
That is why I suggest starting with a lowish number of vcpus, and
increase the number slowly.
You can allocate vcpus to qubes as you want, and you can also create
“pools” of vcpus that are specific to cores. This would allow you to
separate groups of qubes, and dom0, and make sure that they use
different cores. In a high security situation, this may be worth trying,
but it is advanced use of Qubes.
