28 ms·
How to make Linux run fast again on Intel CPUs
- toastal 7y agoLucky for me, I never got to patch for Spectre or Meltdown in the BIOS upgrades for my Razer Blade because they only support Windows 10 as a BIOS upgrade option so you can have a GUI experience for what could be done with a bin file on a USB.
- xaduha 7y agoI'm not an expert, but my understanding was that Linux updates microcode by itself, has nothing to do with BIOS. EDIT: depends on the distro
- rzzzt 7y agoAlso, some vendors support putting the single-file updater .exe on a USB stick and upgrading from the BIOS directly: https://www.dell.com/support/article/us/en/19/sln171755/updating-the-dell-bios-in-linux-and-ubuntu-environments https://www.dell.com/support/article/us/en/19/sln171755/upda...
- abhijitparida 7y ago>We don't need no barriers between software, they could be friends Wholesome.
- xaduha 7y agoIf you want to try to do this for games, then at least measure the impact with some benchmarks in games that are CPU bound. Maybe it's not worth it.
- azeotropic 7y agoYeah, aren’t most games single-threaded? I doubt this affects gaming performance very much.
- xaduha 7y agoWhen running Overwatch under VFIO according to Task Manager and i7z tool on the host it loads cores pretty evenly for me. Can't keep 150 FPS at all times during a replay for instance, gonna disable mitigations and see if anything changes. EDIT: nothing drastic happened, probably need to disable Windows protections as well.
- xaduha 7y agoCan't edit anymore, so adding here. Between 'not vulnerable' and 'max speed' there are a few different intermediate states, probably was in one of those. And I have to admit that for All Green in spectre-meltdown-checker.sh and InSpectre.exe I'd have to pay a pretty noticeable price based on my Overwatch VFIO testing. Pretty sure there's no point returning to that intermediate state again, might as well commit to one or the other.
- Const-me 7y agoMost games are heavily multithreaded. For the last decade most of them are console ports, consoles have many CPU cores since Xbox 360 (3 cores / 6 threads, 2005) and PS3 (1+6 asymmetric cores, 2006). Most games render from single thread, but besides submitting these draw calls games do a lot of things under the hood.
- masklinn 7y agoGames have necessarily become more and more parallelised (whether through multithreading or multiprocessing) over the last decade, as even consoles are multi-core these days. Both XB1 and PS4 have 8 cores (2xJaguar modules). Both also reserve one of the core exclusively for the system, so a single-threaded game would only leverage 14% of available CPU compute power. The Switch is somewhat similar through to a lower extent: it effectively uses a quad-core ARM, with one of the core reserved to the system leaving 3 to game developers.
- dijit 7y agothe real impacts here are the userland/kernel space barrier. Games, for instance; don't cross that boundary as much as, say, networked databases.
- ttctciyf 7y agoSo as a somewhat unconcerned user, I've been disabling some kernel mitigation since more or less when these horrors were first revealed, and when I could remember/be bothered after a kernel upgrade. But I'm on an AMD CPU not intel. I'm very curious to hear what knowledgeable folks here could tell me about performance gains on AMD (1950x) from these or any other similar switches.
- vorticalbox 7y agoI believe they only apply to intel
- nsuser3 7y agoSome mitigations also apply to AMD CPUs.
- hrgiger 7y agoHere is my geekbench results: before: https://browser.geekbench.com/v5/cpu/381062 https://browser.geekbench.com/v5/cpu/381062 another before: https://browser.geekbench.com/v5/cpu/381122 https://browser.geekbench.com/v5/cpu/381122 after with mitigations off: https://browser.geekbench.com/v5/cpu/381082 https://browser.geekbench.com/v5/cpu/381082 I believe there is almost no difference (unless my bios hardened something like this that I am not aware off: https://www.asus.com/us/support/FAQ/1035323/ https://www.asus.com/us/support/FAQ/1035323/) If one needs those extra ~200 point I think he might already ensured that no extra app running and he is using cpu isolation
- m0zg 7y agoCould someone knowledge create a subset of these for AMD Zen? I have some compute-only servers in my garage for which I don't care about mitigations, but do care about performance.
- andrewcchen 7y agomitigations=off is all you need on a recent kernel
- jcelerier 7y agoheh, they copied my website :p https://make-linux-fast-again.com https://make-linux-fast-again.com
- ngcc_hk 7y agoThey seem not. Just one line is nothing. Need to read the f info about kernel.
- jcelerier 7y agoyes, that was tongue in cheek - actual work is done by people writing the kernel
- keldaris 7y agoThank you for that website. As I disable mitigations on all my personal hardware, this saved me a bit of time when this whole thing started and has served as a nice quick reference since.
- GrayShade 7y agoIsn't mitigations=off enough on newer kernels?
- amelius 7y agoOne of the article's comments says so.
- KindOne 7y agoYes. Its also been added into various LTS versions about five or six months ago. https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.68 https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.... https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.176 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.1... https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.119 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.... https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.43 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.... ctrl+f: cpu/speculation: Add 'mitigations=' cmdline option
- ngcc_hk 7y agoWe are adult. And free. You give us option and we can choose. And talk about it.
- Ecco 7y agoI wish they included some level of benchmark for the performance gain. In practice, how much of a difference would that make? Also a short summary of what those mitigations protect against would be great. This way the reader could make an informed decision: do I want to sacrifice X to get Y?
- pferde 7y agoDifference depends very much on actual workload. For example, I have a small server with mostly CPU-bound programs running, where the mitigations do not noticeably slow down anything, but a simple "xz -l large_iso_file" takes 20 minutes without mitigations=off, but only 2 minutes with.
- pantalaimon 7y agohttps://www.phoronix.com/scan.php?page=article&item=3900x-9900k-mitigations https://www.phoronix.com/scan.php?page=article&item=3900x-99... Older hardware is worse off https://www.phoronix.com/scan.php?page=article&item=sandy-fx-zombieload https://www.phoronix.com/scan.php?page=article&item=sandy-fx...
- 0xQSL 7y agoThere are some benchmarks of mitigation impact on Phoronix [1]. These benchmarks are only for mitigation sensitive workloads so real world impact will be lower. [1] https://www.phoronix.com/scan.php?page=article&item=amd-zen2-spectre&num=1 https://www.phoronix.com/scan.php?page=article&item=amd-zen2...
- sytelus 7y agoSo... what is the worse case scenario if you decide to disable these mitigations? What precausions one can take to be relatively safe while turning these off?
- ekimekim 7y agoIn general, these kinds of attacks are cross-process information leaks and sandbox escapes. The attack vector is untrusted code running on your system, of which the by far most common and most potentially malicious is javascript when you use a web browser. So the worst case scenario? You visit a website with some attacker-controlled javascript, and it successfully picks up information leaks from your password manager allowing it to obtain all your passwords. I'm not sure how realistic that attack is. I know that for some of these vulnerabilities attacks from javascript were shown to be possible, but I'm not sure what the target information was in that case.
- specialist 7y agoAre there ways to prevent data from being in the cache? I know almost nothing about computer security. I ask because ages ago, I added copyright protection to some products (under protest). Though encrypted on disk, once loaded, all our code and key phrases were "plaintext" in memory, easy to read. Hackers would post cracked versions of our releases within 24 hours. The whole effort seemed pointless. My takeaway was if you had physical access, you have everything. But maybe things have improved.
- ekimekim 7y agoIf you have physical access, you have everything (given sufficient time and effort). This will always be true, though dedicated security hardware (TPMs, etc) might drive up that time and effort requirement to get at their contents. The access provided by these attacks is a far cry from physical access. There are plenty of things that can be done to mitigate them (removing data from the cache, for example). Of course, this entire post is about how to disable those mitigations, as they almost always come with a performance penalty.
- hannob 7y agoIsn't this largely redudant? My understanding was that "mitigations=off" is a shortcut for "disable all spectre/meltdown changes that cost me performance", at least on a recent kernel.
- viraptor 7y agoThat's the thing. On old kernels you have to disable each one separately, on new kernels you can do either that or mitigations=off. If you want to make sure you disable everything on old kernels and disable potential new options on new kernels without going into details - you can use the line provided.
- Tuna-Fish 7y agoAs explained on the site, yes, but if you are running an older kernel you need to use the individual flags instead, and since the kernel safely ignores any flags it doesn't recognize, the full string works for everyone and doesn't do any harm. (Other than turning mitigations off, ofc...)
- justinjlynn 7y agoRemoving all shielding from the nuclear reactor doesn't do any harm... to the reactor.
- The_rationalist 7y agoActually, using clear Linux is THE way to have the fastest Linux.
- exikyut 7y agoNo, Gentoo is. https://bugs.gentoo.org/74072#c1 https://bugs.gentoo.org/74072#c1
- lorenzhs 7y agoSadly funroll-loops[.]org is no more, but there's an archive mirror: https://web.archive.org/web/20060803063141/http://funroll-loops.org/ https://web.archive.org/web/20060803063141/http://funroll-lo...
- Neil44 7y agoGibson Research’s InSpectre utility will allow you to do the same thing on Windows. https://www.grc.com/inspectre.htm https://www.grc.com/inspectre.htm
- kingofpee 7y agoI like the sarcastic tone it's written in. Wonder if makes enough difference to notice?
- tapia 7y agoMeanwhile at the NSA: "The plan worked perfectly! Now they are disabling the security patches willingly. Everyone, back to work!" (:
- gigatexal 7y agoFor a local workstation user not doing anything sensitive etc I don’t see why you wouldn’t do this. Be smart. Be clean online. And enjoy the full power of your box. A server though, especially one that will be targeted, should take the performance hit and get patched.
- twic 7y agoIsn't it the other way round? Most of these mitigations are to stop hostile code from stealing your secrets. A physical server doesn't run hostile code. A workstation with a web browser which supports JavaScript runs potentially hostile code all day, every day.
- vbezhenar 7y agoDepends on your browsing pattern. I don't visit random websites often. And even if I do, I don't stick there for long (those exploits need a lot of time to extract useful data). And sites that I visit are trusted (like HN) so they are very unlikely to run exploits.
- arghwhat 7y agoYou run arbitrary code from a lot more sites than you just those you visit, and I doubt you're combing through it. Third-party JS, tracking, unblocked advertisements, possibly malicious on-site code, etc. If you're allowing any site to run JavaScript, you're running entirely arbitrary and uncontrolled code on your machine, and thus is in dire need of the mitigations. It's a different situation for a server designed to not run remote code, which makes it practically impossible to exploit speculative execution vulnerabilities.
- deleted 7y ago[deleted]
- dijit 7y agoSorry, I consider this to be a very poor defence. You might trust the site you go to; but that's not all the javascript that gets loaded, there are includes that a lot of web developers will use for convenience, there are ad networks and there are bugs that could allow some unintended javascript to get loaded (like with bit-squatting[0]). It's not a given that you're safe running javascript if you only visit sites you trust. Even if you are INCREDIBLY sanitary, which I would argue is unrealistic (just check your history and you'll see that you probably visit many sites off of a google search). [0]: http://www.youtube.com/watch?v=lZ8s1JwtNas http://www.youtube.com/watch?v=lZ8s1JwtNas / http://dinaburg.org/bitsquatting.html http://dinaburg.org/bitsquatting.html
- perch56 7y agoI recently brought back to life a PC that a friend was about to throw away. It has an Intel i7 3820 CPU and running latest Ubuntu. Here are my results from Geekbench 5.0.2 Tryout for Linux x86 (64-bit) before and after the "mitigations=off": mitigations on score: 865 Single-Core Score 2624 Multi-Core Score mitigations off score: 912 Single-Core Score 3995 Multi-Core Score
- forinti 7y agoThrow away an i7? That's a bit wasteful.
- letitburn 7y agoThe cheapest Ryzen outperforms it.
- wtallis 7y agoThat chip's almost 8 years old. It can barely keep up with today's entry-level desktop processors, and draws twice as much power while doing so.
- opencl 7y agoEven with the mitigations that chip is significantly faster than an athlon 200GE, without them it's more than twice as fast (in geekbench at least).
- katsura 7y agoI'm not sure if it is related, but going from Linux kernel 5.2 to 5.3 on Arch makes my laptop constantly spin the fans, and it runs considerably more hot. I tried upgrading, and downgrading a few times, but 5.2 results in a much cooler laptop for me, so I've disabled kernel update for now.
- askthrowaway 7y agoI tried this and run Geekbench 5.0.2 here are the results: mitigations on score: 980 Single-Core Score 2008 Multi-Core Score mitigations off score: 976 Single-Core Score 2741 Multi-Core Score links before: https://browser.geekbench.com/v5/cpu/376453 https://browser.geekbench.com/v5/cpu/376453 after: https://browser.geekbench.com/v5/cpu/376504 https://browser.geekbench.com/v5/cpu/376504
- liquidify 7y agoYour single core score went down? How?
- askthrowaway 7y agoIts just a few numbers.. actually the test should be run multiple times and take median. Oh and I ran it more times and it ranged from 2500 to 2900 for multicore score.
- progval 7y agoIt went down by 0.5%, that's most likely irrelevant.
- qwerty456127 7y agoI don't have /etc/sysconfig/grub on Manjaro. Is it /etc/default/grub? Should I add the line as specified in the article if my CPU is as old as Core 2 Duo? Will it make any difference? Won't it render the system unbootable?
- katsura 7y agoYou can check with this command if your CPU is affected by any of those: grep . /sys/devices/system/cpu/vulnerabilities/* And yes, you'll need to edit the /etc/default/grub file, but make sure that you add your extra parameters to GRUB_CMDLINE_LINUX_DEFAULT based on this: https://wiki.archlinux.org/index.php/Kernel_parameters#GRUB https://wiki.archlinux.org/index.php/Kernel_parameters#GRUB
- qwerty456127 7y agoThanks!
- forinti 7y agoYes. You should end up with a line like this: GRUB_CMDLINE_LINUX_DEFAULT="noresume noibrs noibpb nopti nospectre_v2 nospectre_v1 l1tf=off nospec_store_bypass_disable no_stf_barrier mds=off mitigations=off"
- plmpsu 7y agoFor arch see here: https://wiki.archlinux.org/index.php/Improving_performance https://wiki.archlinux.org/index.php/Improving_performance and the linked https://wiki.archlinux.org/index.php/Kernel_parameters https://wiki.archlinux.org/index.php/Kernel_parameters
- gchamonlive 7y agoIt would be nice if we were able to do this for specific cores, and then somehow assign critical applications to secure cores and regular applications to performance cores
- xhgdvjky 7y agoyou could get two machines
- gchamonlive 7y agoYou mean like a heterogeneous cluster? Do you have suggestions on how to manage load deployment on such a topology based on how security critical the application is
- yjftsjthsd-h 7y agoThat actually sounds straightforward in most job scheduling software that I've seen; just tag the hosts "nomitigations"/"mitigations_on" or so, and set constraints on where jobs are scheduled to match.
- yencabulator 7y agoI've been wondering why we haven't seen a linux kernel scheduler yet that'll SMT colocate only threads of the same process. Derisk the SMT-based attacks by making the only targets be "self". (Or processes of the same user in the same namespaces, or some such criteria for "mutually trusting" processes.)
- alkonaut 7y agoWould be great if this could be done for Windows (mitigations=off). I’d be happy to reboot to a mode where I have 3% better perf. I’d easily do it every time I wanted to play any game where I’m CPU bound
- thg 7y agoYou can disable them through setting a registry key or use this handy tool instead: https://www.grc.com/inspectre.htm https://www.grc.com/inspectre.htm
- Santosh83 7y agoYou can turn mitigations off for Spectre and Meltdown by using the GRC InSpectre program from Gibson Research. The tool's main purpose is to display if your system is patched but it also allows you to turn them off. I never tried it to see if it actually works though. Windows might turn them back on for all I know.
- jokoon 7y agoI've read that it's possible to exploit meltdown or spectre just with javascript. Apparely it's now patched with most browsers. Other than js, am I right to think it's still a difficult vulnerability to exploit since you need to execute code on a target machine? It seems to be bad news for cloud techs, but not for users.
- Zeetah 7y agoWould love to get a pointer for the equivalent for Windows 10. Thanks.
- pongo1231 7y agoTry InSpectre https://www.grc.com/inspectre.htm https://www.grc.com/inspectre.htm
- ig0r0 7y agoI do not know why but disabling all the mitigations as described actually resulted in worse performance for me mitigations on score: 719 Single-Core Score 1438 Multi-Core Score mitigations off score: 679 Single-Core Score 1418 Multi-Core Score Running Ubuntu 18.04.3 LTS with i5-4300 U on a T440s. Any ideas why? Makes no sense to me.
- slovenlyrobot 7y agoHow many times did you repeat the test? 98% you had a youtube video playing in the background or some full text indexer was running or similar. As for the 2%, I find it hard to believe constantly flushing caches and rejigging page tables on every syscall could ever be faster, but there is always room to be surprised :) The other obvious option since you mention it's a laptop is probably throttling. Worth at least checking dmesg output to see if the kernel logged any events during the run, but I'm not sure that's conclusive. On my Dell it's possible to force fans to 100% through a third party utility, maybe yours supports similar
- morpheuskafka 7y agoI am still shocked at how little repercussions Intel has actually faced for this fisco. This must have cost companies like AWS millions of dollars in lost capacity/early upgrades--why have they not made a serious effort to get these issues under control and why are they not rapidly losing market share to AMD and Arm?
- moocowtruck 7y agobecause the alternatives really are not alternatives, and because moving from something like investments in hardware are not quick and easy moves. I will tell you once or if ppl figure out then the drain will be pulled for intel
- gameswithgo 7y agoas of pretty recently epic is better by almost all metrics.
- fareesh 7y agoWhat would this translate to in a typical workstation situation? Browser with some YouTube video playing, 30 tabs, some webpack Dev server doing compiles and a text editor? 50ms faster compiling?
- timbit42 7y agoInfection.
- jwlake 7y agoThere really just needs to be a good way to run your browser in a horrible jail. Someone just needs to sell an arm on a USB stick that you run v8 on for chrome and nothing else. Destroying the performance of the entire machine to enable the ability to run JS seems a bit over-zealous.
- vbezhenar 7y agoEdge in Windows have mode to run in a separate VM. Not sure if they kept it after moving to Chromium engine.
- trollied 7y agoSo the window manager just takes a raw stream of the video from the browser on the USB-based machine & sends input requests to & fro? Sounds like the old days with X11. export DISPLAY=win:0.0
- dmitrygr 7y agoThose exist and they are called chrome sticks. They are also available in laptop format, called Chromebooks. Also, they are available in small form factor box format, known as chromeboxes
- shmerl 7y agoHm, for AMD we need a fix for this: https://sourceware.org/bugzilla/show_bug.cgi?id=24979 https://sourceware.org/bugzilla/show_bug.cgi?id=24979 The bug was closed, but it doesn't look like it was fixed.
- bioneuralnet 7y agoWow, running Ubuntu 19.04 on an XPS 13 and this was a very noticeable boost. I knew it had gotten slower but I'd forgotten by how much. I'm just ignoring what I've potentially opened myself up to...
- johnx123-up 7y agoCan someone please share some better resource on how to activate it, especially for a Linux noob?
- seamyb88 7y agoIn the file "/etc/default/grub" there is a line that says GRUB_CMDLINE_LINUX_DEFAULT="", where inside the "" is a possible list of parameters. Just add the parameter to this list with a space. Back in the terminal type "sudo update-grub" and restart your machine.