Can I disable Spectre and Meltdown mitigation features in Ubuntu 18.04LTS?
I want to test how much more performance I gain when I disable these two features in Linux, and if the performance is big, to make it permanently.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
A number of kernel boot parameters are available to disable or fine-tune hardware vulnerability mitigations:
nospectre_v2(x86, PowerPC, S/390, ARM64),
nopti(x86, PowerPC) or
mitigations, was introduced in 5.2 and back-ported to 5.1.2, 5.0.16, and 4.19.43 (and perhaps others). It can be used to control all mitigations, on all architectures, as follows:
mitigations=offwill disable all optional CPU mitigations;
mitigations=auto(the default setting) will mitigate all known CPU vulnerabilities, but leave SMT enabled (if it is already);
mitigations=auto,nosmtwill mitigate all known CPU vulnerabilities and disable SMT if appropriate.
Some of these can be toggled at runtime; see the linked documentation for details.
With a kernel 5.1.13 or newer :
On boot parameter you can use
With a kernel older than 5.1.13 :
noibrs noibpb nopti nospectre_v2 nospectre_v1 l1tf=off nospec_store_bypass_disable no_stf_barrier mds=off mitigations=off
mitigations=off or that long one-liner to your
/etc/sysconfig/grub and re-generate grub's configuration file with
(your distributions procedure will vary).
Debian/Ubuntu derived distributions:
Edit the file
/etc/default/grub then run
On Fedora 37, with a sufficiently new kernel, mitigations status can be displayed by printing the content of files under
$ grep . /sys/devices/system/cpu/vulnerabilities/* /sys/devices/system/cpu/vulnerabilities/itlb_multihit:KVM: Mitigation: VMX disabled /sys/devices/system/cpu/vulnerabilities/l1tf:Not affected /sys/devices/system/cpu/vulnerabilities/mds:Not affected /sys/devices/system/cpu/vulnerabilities/meltdown:Not affected /sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Mitigation: Clear CPU buffers; SMT vulnerable /sys/devices/system/cpu/vulnerabilities/retbleed:Mitigation: Enhanced IBRS /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Enhanced IBRS, IBPB: conditional, RSB filling, PBRSB-eIBRS: SW sequence /sys/devices/system/cpu/vulnerabilities/srbds:Mitigation: Microcode /sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected
To disable the mitigations in one swoop, do
sudo grubby --update-kernel=ALL --args="mitigations=off"
and behold how the printout changed after a reboot
$ grep . /sys/devices/system/cpu/vulnerabilities/* /sys/devices/system/cpu/vulnerabilities/itlb_multihit:KVM: Mitigation: VMX disabled /sys/devices/system/cpu/vulnerabilities/l1tf:Not affected /sys/devices/system/cpu/vulnerabilities/mds:Not affected /sys/devices/system/cpu/vulnerabilities/meltdown:Not affected /sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Vulnerable /sys/devices/system/cpu/vulnerabilities/retbleed:Vulnerable /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Vulnerable /sys/devices/system/cpu/vulnerabilities/spectre_v1:Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers /sys/devices/system/cpu/vulnerabilities/spectre_v2:Vulnerable, IBPB: disabled, STIBP: disabled, PBRSB-eIBRS: Vulnerable /sys/devices/system/cpu/vulnerabilities/srbds:Vulnerable /sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected