Rollback to Linux Kernel & Linux Firmware Prior to MeltDown & Spectre Fix

[Royi]

Hello,

I read and saw on Phoronix that the updated Kernels, which contains Meltdown & Spectre fix, hurt performance badly.
Since I'm not worried on such issues on my computer, how can I roll back to the latest state of Linux Kernel & Linux Firmware prior to those fixes?

I'm on Linux Mint 18.3 (Latest Updates).

Thank You.

[Pjotr]

Which kernel are you on now?

Code: Select all

uname -rv

[Mattyboy]

If you still have them installed on your system you can boot to the older Kernel in the Grub menu from advanced options. ( press and hold either shift or esc if you don't have it at boot ).

If not open update manager/view/Linux Kernels. Here you can install any listed you wish. You can also remove any. Note you have to re-boot into your desired Kernel before you can delete others, you can't remove what you're using. Your system will always boot to the latest Kernel so removing those released with the fix will be required.
Run

Code: Select all

sudo update-grub

after making any changes.

It may make a difference on older chips but I for one haven't noticed any slowdown, although, its reported, only certain processes are affected.

[Cosmo.]

Did you notice a performance reduction, or is it only from reading (the starting post sounds so)? If you do not have a serious problem, reverting = willingly installing security leaks is a very bad idea.

[Mattyboy]

If you do not have a serious problem, reverting = willingly installing security leaks is a very bad idea.

+ 1. That's how I see it.

[JoeBingo]

I followed the advice on the linux Mint Blog ... "Security notice: Meltdown and Spectre" ... https://blog.linuxmint.com/?p=3496
Haven't noticed any performance loss or problems.

That said, you could use the Update Manager (toolbar: VIEW > Linux Kernels) to list/view Linux Kernels ... those that may be installed and the one that is active. By clicking on a listed kernel, you can install or remove it.

Thread discussion on kernel roll-back how-to ... viewtopic.php?f=90&t=248533

[michael louwe]

@ Royi, .......

.

.
The Linux kernels without the Meltdown and Spectre patches are 3.13.138, 4.4.107 and 4.13.24. Please refer to ...
https://wiki.ubuntu.com/SecurityTeam/Kn ... ndMeltdown

[Royi]

@ Royi, .......

.

.
The Linux kernels without the Meltdown and Spectre patches are 3.13.138, 4.4.107 and 4.13.24. Please refer to ...
https://wiki.ubuntu.com/SecurityTeam/Kn ... ndMeltdown

Hi,

So the latest one is I need to look for is 4.13.24?
What about the Linux Firmware? As I thought it updates the CPU Micro Code.

Thank You.

[michael louwe]

@ Royi, .......

.

.
In general, new hardware is more compatible with new Linux kernel. Eg if you are running the 7th-gen Intel KabyLake processor, use kernel 4.13.

AFAIK, Linux firmware updates and Intel microcode updates are different and not related.

[smurphos]

You should be able to enable/disable the individual mitigations via modified grub parameters without regressing kernel version. That would ensure you don't strand yourself on an effectively unsupported kernel for ever more.

https://wiki.ubuntu.com/SecurityTeam/Kn ... onControls

[Royi]

Did you notice a performance reduction, or is it only from reading (the starting post sounds so)? If you do not have a serious problem, reverting = willingly installing security leaks is a very bad idea.

Have a look on Anandtech's review:

https://www.anandtech.com/show/12566

It does have real world effect.
In order to mitigate this performance deterioration one should disable the Microcode Update (One which happens on OS loading) & Use unpatched Linux Kernel which is what I'm after.

[smurphos]

Microcode is dealt with by the Drivers setting module and in Mint is supplied as a microcode package from Ubuntu. At the time of writing there is no spectre/meltdown patched microcode officially available. The first set of patches provided by Intel were withdrawn within a week as buggy and the second set provided by Intel earlier this month are still sat in the Ubuntu testing repo so I guess are also proving to be buggy.

One of the Spectre mitigations (IBRS) requires both a patched kernel and patched microcode to work.

These mitigations will likely be in all future kernel releases but can be turned on and off at will by the end-user via grub parameters. I'd really suggest you educate yourself in doing this if you are determined to avoid any performance degradation. That way you will still be covered by future kernel patches for other security issues.

Also bear in mind that major kernel updates generally bring performance improvements - e.g 4.15 may well have a 5% or 10% advantage in some areas over 4.13 etc. If performance is important to you you'll miss out on these if you lock yourself into an older kernel.

Linux firmware is not related to the mitigations.

[Royi]

Microcode is dealt with by the Drivers setting module and in Mint is supplied as a microcode package from Ubuntu. At the time of writing there is no spectre/meltdown patched microcode officially available. The first set of patches provided by Intel were withdrawn within a week as buggy and the second set provided by Intel earlier this month are still sat in the Ubuntu testing repo so I guess are also proving to be buggy.

One of the Spectre mitigations (IBRS) requires both a patched kernel and patched microcode to work.

These mitigations will likely be in all future kernel releases but can be turned on and off at will by the end-user via grub parameters. I'd really suggest you educate yourself in doing this if you are determined to avoid any performance degradation. That way you will still be covered by future kernel patches for other security issues.

Also bear in mind that major kernel updates generally bring performance improvements - e.g 4.15 may well have a 5% or 10% advantage in some areas over 4.13 etc. If performance is important to you you'll miss out on these if you lock yourself into an older kernel.

Linux firmware is not related to the mitigations.

It doesn't seem new Kernel improve performance (Regardless of the mitigation) - Linux 4.0 To Linux 4.15 Kernel Benchmarks.

Regarding the mitigation, I will be happy to learn how to disable mitigations like that using Grub.
The problem is the link you supplied doesn't show how to it for someone new to the Eco System as me.

Is there a more friendly guide for that?

Thank You.

[Moem]

Did you notice a performance reduction, or is it only from reading (the starting post sounds so)?

Have a look on Anandtech's review:

https://www.anandtech.com/show/12566

It does have real world effect.

So your answer seems to be 'no, I did not personally notice a performance reduction'? Is that correct?

[smurphos]

It doesn't seem new Kernel improve performance (Regardless of the mitigation) - Linux 4.0 To Linux 4.15 Kernel Benchmarks.

Regarding the mitigation, I will be happy to learn how to disable mitigations like that using Grub.
The problem is the link you supplied doesn't show how to it for someone new to the Eco System as me.

Is there a more friendly guide for that?

Thank You.

I did say kernel improvements in some areas... :wink: . I do think you are giving to much weight to synthetic benchmarks many of which are barely relevant to a desktop user. If you are running a web server or compiling software all day long then yes you will see noticeable degradation.

You need to take great care modifying your boot parameters. You can easily end up with an unbootable system.

I have tested this process for enabling and disabling pti (meltdown mitigation) only. If you follow these instructions to do this or to disable any other mitigations please understand this is at your own risk.

Also see - https://askubuntu.com/questions/19486/h ... -parameter

1) Open your default grub in the terminal based text editor nano by typing sudo nano /etc/default/grub You will be asked for your password. Be very careful with any edits to this file.

2) You'll see something like this...

Code: Select all

GNU nano 2.5.3                  File: /etc/default/grub                                           

# If you change this file, run 'update-grub' afterwards to update
# /boot/grub/grub.cfg.
# For full documentation of the options in this file, see:
#   info -f grub -n 'Simple configuration'

GRUB_DEFAULT="0"
GRUB_HIDDEN_TIMEOUT="0"
GRUB_HIDDEN_TIMEOUT_QUIET="true"
GRUB_TIMEOUT="5"
GRUB_DISTRIBUTOR="`lsb_release -i -s 2> /dev/null || echo Debian`"
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash elevator=cfq"
GRUB_CMDLINE_LINUX=""

# Uncomment to enable BadRAM filtering, modify to suit your needs
# This works with Linux (no patch required) and with any kernel that obtains
# the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...)
#GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef"

# Uncomment to disable graphical terminal (grub-pc only)
#GRUB_TERMINAL="console"

# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `vbeinfo'
#GRUB_GFXMODE="640x480"

# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux
#GRUB_DISABLE_LINUX_UUID="true"

# Uncomment to disable generation of recovery mode menu entries
#GRUB_DISABLE_RECOVERY="true"
                                         [ Read 34 lines ]
^G Get Help   ^O Write Out  ^W Where Is   ^K Cut Text   ^J Justify    ^C Cur Pos    ^Y Prev Page
^X Exit       ^R Read File  ^\ Replace    ^U Uncut Text ^T To Spell   ^_ Go To Line ^V Next Page

3) Using your arrow keys move your cursor to the line

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash elevator=cfq"

4) Add your additional kernel parameter(s) to this line.

E.g. to disable PTI (the meltdown mitigation) and referring to the reference document from Ubuntu https://wiki.ubuntu.com/SecurityTeam/Kn ... onControls I would change it to

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash elevator=cfq pti=off"

5) I'd also suggest changing GRUB_HIDDEN_TIMEOUT="0" to #GRUB_HIDDEN_TIMEOUT="0" to ensure the grub menu is displayed on every boot. That will be handy if you need to revert any of these changes to get back into the system

6) Once done press Ctrl-O followed by Y and then Ctrl-X to save the file and exit.

6) Enter sudo update-grub to actually update your grub.

7) Reboot

9) cat /proc/cmdline will confirm the parameters have taken.

8) Optionally check your mitigation status using - https://github.com/speed47/spectre-meltdown-checker

[Cosmo.]

Did you notice a performance reduction, or is it only from reading (the starting post sounds so)?

Have a look on Anandtech's review:

https://www.anandtech.com/show/12566

It does have real world effect.

So your answer seems to be 'no, I did not personally notice a performance reduction'

That is exactly my thought also, when I read the reply.
Another thing with the reply is, that it links about a W10 examination; regarding Linux kernel it does say nothing.

[Royi]

@smurphos, This is amazing!
I will try it and let you know.

When you say Grub Menu do you mean the screen I get on booth with 30 Seconds counter to chose "Safe Boot" or "Regular Boot" (And other options)?
If so it appears any way.

@Cosmo,
I really care about performance on my system as I use Scientific Programming daily.
I buy the newest CPU's though they offer ~5-7% advantage.

Seeing this ~5-10% performance degradation is just something I don't want to have.
It is hard to feel 10% in daily job.
But it is accumulated and if I let the CPU run for 3 days in a row and now it will be 3.3 days that something I'd pass.

Hence the option to disable those is great.

[smurphos]

When you say Grub Menu do you mean the screen I get on booth with 30 Seconds counter to chose "Safe Boot" or "Regular Boot" (And other options)?
If so it appears any way.

That sounds like a BIOS / UEFI menu..

The grub menu allows you to pick from installed kernels to boot into and if you are running dual/triple boot allows you to select the secondary or tertiary OS. It's hidden by default in a new Mint install. It will look something like this (image via Google image search). If you do have problems you can manually edit the kernel parameters from the grub menu by selecting option 'e'.

[Royi]

@smurphos,
I meant exactly the screen you pasted.

Thank You.

[Royi]

Did you notice a performance reduction, or is it only from reading (the starting post sounds so)?

Have a look on Anandtech's review:

https://www.anandtech.com/show/12566

It does have real world effect.

So your answer seems to be 'no, I did not personally notice a performance reduction'? Is that correct?

Another test by Phoronix (Linux 3.17 To Linux 4.16 Kernel Benchmarks On Intel Gulftown & Haswell Hardware):

https://www.phoronix.com/scan.php?page= ... ux-317-416

Ubuntu specific (A Look At Ubuntu 10.04 To Ubuntu 18.04 Linux Performance):

https://www.phoronix.com/scan.php?page= ... -1004-1804