Improve Linux performance with this one weird trick
- Reference: 1658127853
- News link: https://www.theregister.co.uk/2022/07/18/improve_linux_performance/
- Source link:
Another day, [1]another bleed -ing vulnerability . New speculative-execution attacks keep being discovered, and OS kernel developers keep finding ways to block them – at the cost of some CPU performance for each mitigation. But what if you run an isolated, standalone box? What if you just … turned off all the mitigations?
Many years ago my then-lodger – a Perl and Linux guru – attempted to show me a quick way to move some stuff from one Linux box to another. He was very surprised to discover that I didn't have SSH enabled, and that there was no way to access any of my Linux boxes from any of the others. This was and is the default setting for the desktop versions of Ubuntu and Mint, and for a lot of people, that's what you want: a computer that is sealed off to the outside world.
[2]
If that describes your needs, then you might find [3]Jean-Michaël Celerier 's admirably terse [4]make-linux-fast-again.com useful. The site is a little dated – you only need all of the switches if you're running a kernel older than version 5.1.13. These days, just the last one is enough. Add it to the end of the kernel line in /etc/default/grub , run update-grub and reboot.
[5]
[6]
If you want to see what each individual instruction does, there are both [7]brief and [8]wordier explanations out there. If those aren't enough instructions for you, then sorry – you probably shouldn't try this at home.
Also don't do it on a server, or in a VM, or a machine that hosts VMs or anything else that others use. If the box lets other devices connect to it over the network, don't do it.
[9]
Seriously. Just don't go there.
[10]Torvalds: Linux kernel team has sorted Retbleed chip flaw
[11]CISA pulls the fire alarm on Juniper Networks bugs
[12]CP/M's open-source status clarified after 21 years
[13]Weird Flex, but OK: Now you can officially turn these PCs, Macs into Chromebooks
Another pretty easy optimization is one we [14]mentioned back when it was introduced : the zswap feature. If your machine isn't a powerhouse with bucketloads of RAM, then it probably occasionally swaps to disk – whether an Ubuntu-style swapfile or a dedicated swap partition. Enabling zswap compresses whatever is being put into swap, which on any 64-bit machine is likely to be a much faster process than writing to disk. Along with the mitigations=off phrase mentioned above, just add zswap.enabled=1 , run update-grub or your distro's equivalent, and reboot.
The Reg FOSS desk tried it on our 12GB RAM day-to-day laptop, and it took a zero off the amount of data placed into swap. ®
Get our [15]Tech Resources
[1] https://www.theregister.com/2022/07/12/amd_intel_retbleed/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YtUvQi6OsrfwNaYARv3jJQAAAEw&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://jcelerier.name/
[4] https://make-linux-fast-again.com/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YtUvQi6OsrfwNaYARv3jJQAAAEw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YtUvQi6OsrfwNaYARv3jJQAAAEw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://linuxreviews.org/HOWTO_make_Linux_run_blazing_fast_(again)_on_Intel_CPUs
[8] https://transformingembedded.sigmatechnology.se/insight-post/make-linux-fast-again-for-mortals/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YtUvQi6OsrfwNaYARv3jJQAAAEw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2022/07/17/linux_5_19_rc7/
[11] https://www.theregister.com/2022/07/15/cisa_critical_juniper_bugs/
[12] https://www.theregister.com/2022/07/15/cpm_open_source/
[13] https://www.theregister.com/2022/07/14/chrome_os_flex_launched/
[14] https://www.theregister.com/2013/07/15/linux_for_workgroups/
[15] https://whitepapers.theregister.com/
Depends what you are doing with the car... if you're trying to set a robotically driven quarter mile then it's a good plan.
The issue is that most systems aren't standalone.
It all depends on what you want. As the article states, if you are the ONLY user on that machine, it's fine. In your example, if your car is a racing car, then it might be fine. (execpt for seat belts)
I use this configuration on my laptop but not on my servers. I's easy.
If it downloads and runs any one else's code, like say the JS on this web site, then you're not the only user.
As the article says, it's only for machines that aren't connected at all. How much use is one of those?
only for machines that aren't connected at all
Well, aren't connected when you boot like that, at least. If you have a big CPU-intensive job like an image render, or some video processing, you may want to get everything downloaded & setup, unplug the network, and reboot into a fast unprotected mode while running that one job. Then back to 'normal' & reconnect.
You're right.
It is generally servers which run controlled workloads rather than clients. Lots of these bleed attacks have been demonstrated from JS, so most web browsing is out.
On the other hand lots of servers never have any "logged in users" so there is no chance of extra SW being installed and run unless some other bug in your apps can be exploited by which time you're largely dead anyway.
The days when server meant hundreds of users with login access is long gone.
Unless you are using OpenSUSE ...
... which forces mitigations=auto on to the kernel command line regardless.
Go faster strips
> that's what you want: a computer that is sealed off to the outside world.
That's what I want for my Windows machines.
It's (not) surprising how much faster they run without any anti-virus software. And there is joy to be found in not being nagged every five minutes to apply this update or that. Although the scourge of seemingly continuous updates has not infected my Linux machines, too.
Hmmm.
I think I prefer to take the hit on performance - slightly less risk of an oops!
P.S. wouldn't it be nice if someone designed a new architecture that was simple and fast without all the crud?
Re: Hmmm.
That was the idea of RISC. It didn't stay "Reduced" for very long.
Disable swap
“… then it probably occasionally swaps to disk…”
I have run my Linux box with swap disabled for ages. These days with gobs of RAM, I see no point at all in having swap enabled on a personal machine (and I’m not even convinced most servers need swap any more - though obviously some do). If I ever get to the point where I’m running out of RAM then I either have a virus or I’m doing something really stupid.
You have to remember what swap was invented for - a backstop when RAM was small and very expensive. If you are going to run out of memory then swap really just delays the inevitable. The size/cost issue just doesn’t exist any more
I can make my car faster by:
- Removing all the air bags
- Removing all the padding in the cabin
- Removing the seat belts
- Replaing the padded seats with bare-bones bucket racing seats.
- etc.
Doesn't mean I should...