{{Header}}
{{Title|title=
{{project_name_long}} Tuning
}}
{{#seo:
|description=Making {{project_name_short}} Faster. Tuning {{project_name_short}}.
|image=Gear-192875640.jpg
}}
[[File:Gear-192875640.jpg|thumb]]
{{intro|
Making {{project_name_short}} Faster. Tuning {{project_name_short}}.

Choose your virtualizer to get started.
}}
{{Tab
|type=controller
|linkid=virtualbox
|content=
{{Tab
|active=true
|type=section
|title={{headline|h=3|content=VirtualBox}}
|image=[[File:Virtualbox_logo.png]]
|addToClass=special-look
|content=
Virtualizer [[VirtualBox]] has been chosen.
}} <!-- close tab -->
{{Tab
|type=section
|title={{headline|h=3|content=KVM}}
|image=[[File:Kvm-new-logo.png]]
|content=

Virtualizer [[KVM]] has been chosen.
}} <!-- close tab -->
}} <!-- close controller -->
See below.
= Introduction =

{{mbox
| type    = notice
| image   = [[File:Ambox_notice.png|40px|alt=Info]]
| text    = Everything in this chapter is entirely optional.
}}

Applying steps in this chapter can improve {{project_name_short}} performance, but often at the cost of reduced security or an increased fingerprinting risk. Earlier entries in this chapter are easier to apply, while later tuning entries require a greater skill level.

= Tested Tuning Steps =

{{anchor|Hardware-accelerated graphics}}
== Hardware-accelerated Graphics ==
{{Tab
|type=controller
|linkid=virtualbox
|content=
{{Tab
|active=true
|type=section
|title={{headline|h=3|content=VirtualBox}}
|image=[[File:Virtualbox_logo.png]]
|addToClass=special-look
|content=
{{mbox
| image   = [[File:Ambox_warning_pn.svg.png|40px]]
| text    = '''Warning:''' This procedure lessens security.
}}

To enable hardware-accelerated graphics for {{project_name_workstation_long}}, perform these steps on the host:

# Power off the VM.
# <code>VirtualBox</code> &rarr; <code>click a VM</code> &rarr; <code>Settings</code> &rarr; <code>Display</code> &rarr; <code>Graphics Controller</code> &rarr; <code>Acceleration:</code> check <code>Enable 3D Acceleration</code> &rarr; <code>OK</code>
# Restart the VM.

Also refer to the VirtualBox manual: [https://www.virtualbox.org/manual/ch04.html#guestadd-3d Hardware-Accelerated Graphics].

Forum discussion: [https://forums.whonix.org/t/virtualbox-3d-acceleration/8673 VirtualBox 3D Acceleration]

Optional: To check if enabled.

{{Install Package|package=
glmark2-x11
}}

Run glmark.

{{CodeSelect|code=
glmark2
}}

Expected output if 3D is disabled:

<pre>  
 GLX does not support GLX_EXT_swap_control or GLX_MESA_swap_control!
 Failed to set swap interval. Results may be bounded above by refresh rate.
=======================================================
    glmark2 2023.01
=======================================================
    OpenGL Information
    GL_VENDOR:      Mesa/X.org
    GL_RENDERER:    llvmpipe (LLVM 15.0.6, 128 bits)
    GL_VERSION:     4.5 (Compatibility Profile) Mesa 22.3.6
    Surface Config: buf=32 r=8 g=8 b=8 a=8 depth=32 stencil=0 samples=0
    Surface Size:   800x600 windowed
=======================================================
 GLX does not support GLX_EXT_swap_control or GLX_MESA_swap_control!
 Failed to set swap interval. Results may be bounded above by refresh rate.
[build] use-vbo=false: FPS: 153 FrameTime: 6.575 ms
 GLX does not support GLX_EXT_swap_control or GLX_MESA_swap_control!
 Failed to set swap interval. Results may be bounded above by refresh rate.
[build] use-vbo=true: FPS: 156 FrameTime: 6.420 ms
 GLX does not support GLX_EXT_swap_control or GLX_MESA_swap_control!
 Failed to set swap interval. Results may be bounded above by refresh rate.
[texture] texture-filter=nearest: FPS: 179 FrameTime: 5.614 ms
 GLX does not support GLX_EXT_swap_control or GLX_MESA_swap_control!
 Failed to set swap interval. Results may be bounded above by refresh rate.
[texture] texture-filter=linear: FPS: 170 FrameTime: 5.910 ms
=======================================================
                                  glmark2 Score: 163 
=======================================================
</pre>

Expected output if 3D is enabled:

<pre>
=======================================================
    glmark2 2023.01
=======================================================
    OpenGL Information
    GL_VENDOR:      VMware, Inc.
    GL_RENDERER:    SVGA3D; build: RELEASE;  LLVM;
    GL_VERSION:     4.1 (Compatibility Profile) Mesa 22.3.6
    Surface Config: buf=32 r=8 g=8 b=8 a=8 depth=24 stencil=0 samples=0
    Surface Size:   800x600 windowed
=======================================================
[build] use-vbo=false: FPS: 634 FrameTime: 1.578 ms
[build] use-vbo=true: FPS: 885 FrameTime: 1.131 ms
[texture] texture-filter=nearest: FPS: 855 FrameTime: 1.170 ms
[texture] texture-filter=linear: FPS: 861 FrameTime: 1.162 ms
[texture] texture-filter=mipmap: FPS: 851 FrameTime: 1.176 ms
=======================================================
                                  glmark2 Score: 816 
=======================================================
</pre>
}} <!-- close tab -->
{{Tab
|type=section
|title={{headline|h=3|content=KVM}}
|image=[[File:Kvm-new-logo.png]]
|content=
[[Undocumented]].
}} <!-- close tab -->
}} <!-- close controller -->

== Renderer ==
<code>softwarecontext renderer</code> is set by default in {{project_name_short}}. This is accomplished by setting the environment variable {{CodeSelect|inline=true|code=QMLSCENE_DEVICE=softwarecontext}}. This setting is particularly useful in cases where hardware acceleration is disabled, which is the default setting in {{project_name_short}} VMs, for applications such as:

* [[Monero]]
* <code>[[signal]]-desktop</code>, and potentially 
* <code>wire-desktop</code>, as well as 
* other <code>electron</code>-based applications. (Note: This setting is unrelated to <code>[[electrum]]</code>.)

However, this configuration has been reported to cause issues with:

* shotcut
* kdenlive ([https://forums.whonix.org/t/video-editing-software-fails-to-launch-on-whonix-virtualbox-kvm/17241 Video editing software fails to launch on Whonix (Virtualbox/KVM)])

'''General information:'''

* Does this setting have any security impact? No.
* When does it make sense to undo this setting? Likely, when [[#Hardware-accelerated Graphics|Hardware-accelerated Graphics]] is enabled.
* Is the user encouraged to experiment with this setting? Yes.

'''How to test if issues are caused by <code>QMLSCENE_DEVICE=softwarecontext</code>?'''

{{box|text=
Option A): Command line method.

'''1.''' Temporarily unset the environment variable.

{{CodeSelect|code=
unset QMLSCENE_DEVICE
}}

'''2.''' Launch the application from the command line.

'''3.''' Done.

<u>Notes:</u>

* This method does not work if:
** Applications are started from the start menu.
** The unset command has not been run previously in different terminal emulator tabs.
* This process needs to be repeated after a reboot.
}}

{{box|text=
Option B): Configuration file deletion method.

'''1.''' Delete the configuration file that sets this environment variable.

{{CodeSelect|code=
sudo rm -f /etc/profile.d/20_software_rendering_in_vms.sh 
}}

'''2.''' Reboot the system.

{{CodeSelect|code=
sudo reboot
}}

'''3.''' Done.

'''4.''' To undo this change (optional, see footnote). <ref>
{{CodeSelect|code=
sudo apt-get-reset vm-config-dist
}}

(Refer to [[Configuration_Files#Reset_Configuration_Files_to_Vendor_Default|Reset Configuration Files to Vendor Default]] for more information.)
</ref>
}}

'''Forum search:''' [https://forums.whonix.org/search?expanded=true&q=QMLSCENE_DEVICE <code>QMLSCENE_DEVICE</code>]

'''Additional information for developers only:'''

* Related source code file: [https://github.com/Kicksecure/vm-config-dist/blob/master/etc/profile.d/20_software_rendering_in_vms.sh <code>/etc/profile.d/20_software_rendering_in_vms.sh</code>]
* It is not ideal to set this environment variable unconditionally in VirtualBox. Currently, no tool is known that can determine from within the VM whether VirtualBox 3D acceleration is enabled, see: [https://forums.virtualbox.org/viewtopic.php?f=3&t=97983 Test command from inside VM to detect if VirtualBox 3D acceleration is enabled or disabled?]

== Increase Virtual Machine RAM ==
{{Tab
|type=controller
|linkid=virtualbox
|content=
{{Tab
|active=true
|type=section
|title={{headline|h=3|content=VirtualBox}}
|image=[[File:Virtualbox_logo.png]]
|addToClass=special-look
|content=
RAM available to Virtual Machines can be increased via VirtualBox settings.

To check how much RAM is free, use <code>free -m</code> in a Terminal. Consider the example below:

{{box|text=
# Shutdown the VM.
# Assign more RAM: <code>Virtual machine</code> &rarr; <code>Menu</code> &rarr; <code>Settings</code> &rarr; <code><i>Adjust</i></code> <code>Memory slider to 4096</code> &rarr; <code><i>Hit:</i> OK</code>
# Restart the VM.
}}

See also: [[RAM|Advice for Systems with Low RAM]].
}} <!-- close tab -->
{{Tab
|type=section
|title={{headline|h=3|content=KVM}}
|image=[[File:Kvm-new-logo.png]]
|content=
[[Undocumented]].
}} <!-- close tab -->
}} <!-- close controller -->

== Additional CPU Cores ==
{{Tab
|type=controller
|linkid=virtualbox
|content=
{{Tab
|active=true
|type=section
|title={{headline|h=3|content=VirtualBox}}
|image=[[File:Virtualbox_logo.png]]
|addToClass=special-look
|content=
{{mbox
| image   = [[File:Ambox_warning_pn.svg.png|40px]]
| text    = '''Warning:''' this procedure may increase fingerprinting risks.
}}

On systems with multi-core processors, if [[Protocol-Leak-Protection_and_Fingerprinting-Protection#Minor_Identifiers|minor identifiers]] are not of any concern <ref>Adding CPU cores is considered a minor risk.</ref> then the number of cores available to the Virtual Machine(s) can be increased in VirtualBox settings.

Do not use the maximum since that could lead to system instability! Always leave at least one CPU unassigned; for example, if you have four CPUs then assign a maximum of three CPUs to the VM. <ref>
VirtualBox ticket: [https://www.virtualbox.org/ticket/19500 VirtualBox should now prohibit assigning all physical CPUs to a VM and/or fix VirtualBox CPU assignment manual].
</ref>

{{box|text=
# Power off the VM.
# <code>VirtualBox</code> &rarr; <code>click a VM</code> &rarr; <code>Settings</code> &rarr; <code>System</code> &rarr; <code>Processor</code> &rarr; <code>Reduce to 3</code> &rarr; <code>OK</code>
# Restart the VM.
}}
}} <!-- close tab -->
{{Tab
|type=section
|title={{headline|h=3|content=KVM}}
|image=[[File:Kvm-new-logo.png]]
|content=
[[Undocumented]].
}} <!-- close tab -->
}} <!-- close controller -->

= Untested Tuning Steps =

== Disable CPU Mitigations ==

{{mbox
| image   = [[File:Ambox_warning_pn.svg.png|40px]]
| text    = '''Warning:''' this procedure lessens security.

[[Untested]]!
}}

Consider disabling the [[Spectre Meltdown]] mitigations. ([https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages-spectre-meltdown-retpoline-l1-terminal-fault-l1tf/5739 Related forum discussion].)

This step should be performed in the VM intended for disabled CPU mitigations <u>and</u> on the host operating system if either [[Kicksecure]] or [[security-misc]] are in use.

{{box|text=
'''1.''' Remove the relevant CPU mitigations file.

{{CodeSelect|code=
sudo rm /etc/default/grub.d/40_cpu_mitigations.cfg
}}

'''2.''' Update grub.

{{CodeSelect|code=
sudo update-grub
}}

'''3.''' Reboot.

'''4.''' Done.
}}

== Nested Paging and VPIDs ==
{{Tab
|type=controller
|linkid=virtualbox
|content=
{{Tab
|active=true
|type=section
|title={{headline|h=3|content=VirtualBox}}
|image=[[File:Virtualbox_logo.png]]
|addToClass=special-look
|content=
It is possible to increase performance by using largepages and/or Virtual Processor Identifiers (VPIDs). It is unknown if this decreases security or stability. For further information refer to the VirtualBox manual: [https://www.virtualbox.org/manual/ch10.html#nestedpaging Nested Paging and VPIDs].

{{CodeSelect|code=
vboxmanage modifyvm {{project_name_workstation_short}}-Xfce --largepages on
}}

{{CodeSelect|code=
vboxmanage modifyvm {{project_name_gateway_short}}-Xfce --largepages on
}}

{{CodeSelect|code=
vboxmanage modifyvm {{project_name_workstation_short}}-Xfce --vtxvpid on
}}

{{CodeSelect|code=
vboxmanage modifyvm {{project_name_gateway_short}}-Xfce --vtxvpid on
}}
}} <!-- close tab -->
{{Tab
|type=section
|title={{headline|h=3|content=KVM}}
|image=[[File:Kvm-new-logo.png]]
|content=
[[Undocumented]].
}} <!-- close tab -->
}} <!-- close controller -->

== Memory Ballooning, Page Fusion and Memory Overcommitment ==

{{mbox
| image   = [[File:Ambox_warning_pn.svg.png|40px]]
| text    = '''Warning:''' this procedure lessens security.
}}

Memory ballooning worsens security because it is a vector for side channel attacks on memory; see [[Dev/KVM#memory_balloon|here]] for further information. <ref>This entry relates to KVM but the research similarly applies to other virtualizers unless they have implemented and documented specific protections.</ref>

For other security considerations, refer to the VirtualBox manual: [https://www.virtualbox.org/manual/ch04.html#guestadd-memory-usage Memory Overcommitment].

== Undocumented Tuning Settings ==

There are probably more tuning-related settings, but these are currently [[undocumented]] at {{project_name_short}}. Interested readers can review the manual for relevant settings of their respective virtualizer, which are unlikely to be bundled under a "tuning" chapter.

{{Tab
|type=controller
|linkid=virtualbox
|content=
{{Tab
|active=true
|type=section
|title={{headline|h=3|content=VirtualBox}}
|image=[[File:Virtualbox_logo.png]]
|addToClass=special-look
|content=
To view all settings, run.

{{CodeSelect|code=
vboxmanage showvminfo {{Project_name_gateway_short}}-Xfce
}}

Next, learn about all of these settings by reviewing the [https://www.virtualbox.org/manual/ VirtualBox manual].
}} <!-- close tab -->
{{Tab
|type=section
|title={{headline|h=3|content=KVM}}
|image=[[File:Kvm-new-logo.png]]
|content=
[[Undocumented]].
}} <!-- close tab -->
}} <!-- close controller -->

== PCI Passthrough ==

{{mbox
| image   = [[File:Ambox_warning_pn.svg.png|40px]]
| text    = '''Warning:''' this procedure lessens security.
}}

This setting can improve graphics performance dramatically, but it worsens security because VMs should not have direct access to physical hardware.

In simple terms, this feature allows the direct use of physical PCI devices on the host by the guest even if the host does not have drivers for the particular device.

{{Tab
|type=controller
|linkid=virtualbox
|content=
{{Tab
|active=true
|type=section
|title={{headline|h=3|content=VirtualBox}}
|image=[[File:Virtualbox_logo.png]]
|addToClass=special-look
|content=
For further information, refer to VirtualBox Manual: [https://documentation.help/VirtualBox/ch09s06.html PCI Passthrough].
}} <!-- close tab -->
{{Tab
|type=section
|title={{headline|h=3|content=KVM}}
|image=[[File:Kvm-new-logo.png]]
|content=
[[Undocumented]].
}} <!-- close tab -->
}} <!-- close controller -->

= See Also =

* [[RAM|Advice for Systems with Low RAM]]
* [[Troubleshooting]]

= Footnotes =
<references />

{{Footer}}

[[Category:Documentation]]