52

Can I disable Spectre and Meltdown mitigation features in Ubuntu 18.04LTS?

I want to test how much more performance I gain when I disable these two features in Linux, and if the performance is big, to make it permanently.

3
  • maybe you have to recompile kernel Nov 30, 2019 at 8:52
  • 1
    ArchWiki provides information about how to secure your system too May 1, 2022 at 13:28
  • 1
    How much performance did you gain?
    – RogerS
    Aug 20, 2022 at 22:11

3 Answers 3

54

A number of kernel boot parameters are available to disable or fine-tune hardware vulnerability mitigations:

  • for Spectre v1 and v2: nospectre_v1 (x86, PowerPC), nospectre_v2 (x86, PowerPC, S/390, ARM64), spectre_v2_user=off (x86)
  • for SSB: spec_store_bypass_disable=off (x86, PowerPC), ssbd=force-off (ARM64)
  • for L1TF: l1tf=off (x86)
  • for MDS: mds=off (x86)
  • for TAA: tsx_async_abort=off
  • for iTLB multihit: kvm.nx_huge_pages=off
  • for SRBDS: srbds=off
  • for retbleed: retbleed=off
  • KPTI can be disabled with nopti (x86, PowerPC) or kpti=0 (ARM64)

A meta-parameter, mitigations, was introduced in 5.2 and back-ported to 5.1.2, 5.0.16, and 4.19.43 (and perhaps others). It can be used to control all mitigations, on all architectures, as follows:

  • mitigations=off will disable all optional CPU mitigations;
  • mitigations=auto (the default setting) will mitigate all known CPU vulnerabilities, but leave SMT enabled (if it is already);
  • mitigations=auto,nosmt will mitigate all known CPU vulnerabilities and disable SMT if appropriate.

Some of these can be toggled at runtime; see the linked documentation for details.

2
  • Does specifying mitigations=auto,nosmt make linux more secure on CPU without hyperthreading? Feb 9 at 18:24
  • 1
    @VladimirKunschikov no, if there’s no SMT to start with then nosmt doesn’t change anything. Feb 9 at 22:18
23

With a kernel 5.1.13 or newer :

On boot parameter you can use

mitigations=off 

With a kernel older than 5.1.13 :

noibrs noibpb nopti nospectre_v2 nospectre_v1 l1tf=off nospec_store_bypass_disable no_stf_barrier mds=off mitigations=off 

Add either mitigations=off or that long one-liner to your /etc/sysconfig/grub and re-generate grub's configuration file with

grub2-mkconfig

(your distributions procedure will vary).

Debian/Ubuntu derived distributions:

Edit the file /etc/default/grub then run

update-grub
2
  • I notice you have mitigations=off in that long one-liner. Is that going to do anything on older kernels?
    – Mike S
    Feb 17, 2022 at 21:45
  • But Ubuntu 18.04 has kernel version 4.15. Sep 28, 2022 at 1:05
0

On Fedora 37, with a sufficiently new kernel, mitigations status can be displayed by printing the content of files under /sys/devices/system/cpu/vulnerabilities/.

$ grep . /sys/devices/system/cpu/vulnerabilities/*
/sys/devices/system/cpu/vulnerabilities/itlb_multihit:KVM: Mitigation: VMX disabled
/sys/devices/system/cpu/vulnerabilities/l1tf:Not affected
/sys/devices/system/cpu/vulnerabilities/mds:Not affected
/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected
/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Mitigation: Clear CPU buffers; SMT vulnerable
/sys/devices/system/cpu/vulnerabilities/retbleed:Mitigation: Enhanced IBRS
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl
/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Enhanced IBRS, IBPB: conditional, RSB filling, PBRSB-eIBRS: SW sequence
/sys/devices/system/cpu/vulnerabilities/srbds:Mitigation: Microcode
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected

To disable the mitigations in one swoop, do

sudo grubby --update-kernel=ALL --args="mitigations=off"

Beware: Spectre proof-of-concept exploits can run in browser JavaScript

As the leaky.page proof-of-concept demonstrates, this vulnerability can be exploited from browser JavaScript code. Therefore, as long as you use a web browser, there is value in keeping the mitigations on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.