Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm starting to work with Docker and after a few hours of trying to make it work, I found out that my BIOS was blocking it and that I needed to adjust the BIOS settings. I was told that the BIOS is somehow related to the motherboard.

How can the BIOS block this kind of process, overruling the operating system?

share|improve this question
13  
You have it backward. The BIOS settings for virtualization tell the CPU to allow a specific kind of processing. if the virtualization extensions are not enabled in bios, the CPU will not be able to execute the program. The situation is a lot like like trying to run a program compiled for a DEC Alpha processor architecture on an x64 system. without the extensions, the program will attempt to run instructions that the CPU doesn't understand. Your Docker is blocking itself from executing because it has detected that your CPU as it is currently configured cannot run it. – Frank Thomas Feb 20 at 0:58
up vote 31 down vote accepted

It's not that the CPU is blocking a program; it doesn't have a concept of apps at that low of a level. The problem is that Docker on non-Linux operating systems can require hardware virtualization. You haven't specified your OS, but I did a tiny bit of snooping and discovered that you probably use Windows.

Hardware virtualization is a CPU feature that, as you might guess from the name, lets the CPU help with virtualization. On many machines, you have to enable it in the BIOS. This is, in part, to prevent security issues. Basically, you couldn't start a program because it attempted to use a feature that was effectively absent as opposed to actively blocked.

share|improve this answer
14  
a tiny bit of snooping Ha..ha – RACING121 Feb 20 at 0:49
    
yes I'm using a windows 7! thanks for the explanation!!! I get it now! – Alvaro Joao Feb 20 at 1:18
    
I am familiar with this setting but still unclear, what exactly is hardware virtualization (in the context of the BIOS setting)? – Celeritas Feb 20 at 12:18
2  
@Celeritas Hardware virtualization is a set of features provided by the CPU and BIOS that make running virtual machines more efficient, such as by transparently managing memory accesses made by the VM in a more efficient way than can be done at a pure software level, and handling/trapping "privileged" instructions such as I/O operations for the virtualization software to more efficiently handle. – hexafraction Feb 20 at 13:22
2  
@RACING121 The N stands for NSA :) – Ben N Feb 20 at 16:26

Ben N answer is clearly the most useful and clear one.

For those who still wonder, however here is the full story.


Virtualization is achieved with hardware assist from the CPU. Since a virtualized OS would interfere with the host one, as they compete for the same resources, a mechanism is needed to stop the guest from having uncontrolled access to the hardware. This can be down with software, slow, techniques or with assist from the CPU.

Hardware assisted virtualization is implemented with specific, optional instructions, you can read about it in Chapters 23, 24, 25, 26, 27 and 28 of Intel Manual 3B Part 3. Software must first check for this instructions to be supported, before attempting using them.

For security reason, the CPU has a special register, it is an MSR, called IA32_FEATURE_CONTROL that holds bits telling with feature to enable or disable.
Quoting

Bit 0 is the lock bit. If this bit is clear, VMXON causes a general-protection exception. If the lock bit is set, WRMSR to this MSR causes a general-protection exception; the MSR cannot be modified until a power-up reset condition. System BIOS can use this bit to provide a setup option for BIOS to disable support for VMX. To enable VMX support in a platform, BIOS must set bit 1, bit 2, or both (see below), as well as the lock bit.

The fundamental point is that once the register is locked, it cannot be unlocked until a power-up.

Since BIOS/UEFI comes first, it has the power to disable virtualization by clearing the appropriate bits and locking the register before any OS can prevent that. When the virtualization feature is disabled this way, the CPU reports that it the optional instruction extension is missing (and actually faults if they are used) and so the software cannot use the hardware virtualization.

share|improve this answer
2  
That is a very good add-on to the question. Most people have no idea the setting requires a reset to change, so it can not be enabled "on the fly" while the OS is running. – Tonny Feb 20 at 16:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.