Debian Project Warns: Turn off Hyperthreading with Skylake and Kaby Lake (Ubuntu affected)

guru3d.com ^ | 06/26/2017 08:40 AM | Hilbert Hagedoorn

[Ernest_at_the_Beach]

Debian developers have issued an advisory to disable hyper-threading with Intel and Skylake- Kaby Lake generation processors. The CPUs can cause problems under certain conditions, in fact on all operating systems.

They advside you to turn it off in the BIOS, and thus forfeit the extra performance you gain. It seems there is s defect for the CPUs in question that can cause compiler- and application crashes, unexpected behavior of programs and incorrect output software:

This warning advisory is relevant for users of systems with the Intel
processors code-named "Skylake" and "Kaby Lake". These are: the 6th and
7th generation Intel Core processors (desktop, embedded, mobile and
HEDT), their related server processors (such as Xeon v5 and Xeon v6), as
well as select Intel Pentium processor models.

TL;DR: unfixed Skylake and Kaby Lake processors could, in some
situations, dangerously misbehave when hyper-threading is enabled.
Disable hyper-threading immediately in BIOS/UEFI to work around the
problem. Read this advisory for instructions about an Intel-provided
fix.

SO, WHAT IS THIS ALL ABOUT?
---------------------------

This advisory is about a processor/microcode defect recently identified
on Intel Skylake and Intel Kaby Lake processors with hyper-threading
enabled. This defect can, when triggered, cause unpredictable system
behavior: it could cause spurious errors, such as application and system
misbehavior, data corruption, and data loss.

It was brought to the attention of the Debian project that this defect
is known to directly affect some Debian stable users (refer to the end
of this advisory for details), thus this advisory.

Please note that the defect can potentially affect any operating system
(it is not restricted to Debian, and it is not restricted to Linux-based
systems). It can be either avoided (by disabling hyper-threading), or
fixed (by updating the processor microcode).

Due to the difficult detection of potentially affected software, and the
unpredictable nature of the defect, all users of the affected Intel
processors are strongly urged to take action as recommended by this
advisory.

WHAT SHOULD I DO IF I DO HAVE SUCH PROCESSORS?
----------------------------------------------

Kaby Lake:

Users of systems with Intel Kaby Lake processors should immediately
*disable* hyper-threading in the BIOS/UEFI configuration. Please
consult your computer/motherboard's manual for instructions, or maybe
contact your system vendor's support line.

The Kaby Lake microcode updates that fix this issue are currently only
available to system vendors, so you will need a BIOS/UEFI update to get
it. Contact your system vendor: if you are lucky, such a BIOS/UEFI
update might already be available, or undergoing beta testing.

You want your system vendor to provide a BIOS/UEFI update that fixes
"Intel processor errata KBL095, KBW095 or the similar one for my Kaby
Lake processor".

We strongly recommend that you should not re-enable hyper-threading
until you install a BIOS/UEFI update with this fix.

Skylake:

Users of systems with Intel Skylake processors may have two choices:

1. If your processor model (listed in /proc/cpuinfo) is 78 or 94, and
the stepping is 3, install the non-free "intel-microcode" package
with base version 3.20170511.1, and reboot the system. THIS IS
THE RECOMMENDED SOLUTION FOR THESE SYSTEMS, AS IT FIXES OTHER
PROCESSOR ISSUES AS WELL.

Run this command in a command line shell (e.g. xterm) to know the
model numbers and steppings of your processor. All processors must
be either model 78 or 94, and stepping 3, for the intel-microcode fix
to work:

grep -E 'model|stepping' /proc/cpuinfo | sort -u

If you get any lines with a model number that is neither 78 or 94, or
the stepping is not 3, you will have to disable hyper-threading as
described on choice 2, below.

Refer to the section "INSTALLING THE MICROCODE UPDATES FROM NON-FREE"
for instructions on how to install the intel-microcode package.

2. For other processor models, disable hyper-threading in BIOS/UEFI
configuration. Please consult your computer/motherboard's manual for
instructions on how to do this. Contact your system vendor for a
BIOS/UEFI update that fixes "Intel erratum SKW144, SKL150, SKX150,
SKZ7, or the similar one for my Skylake processor".

NOTE: If you did not have the intel-microcode package installed on your
Skylake system before, it is best if you check for (and install) any
BIOS/UEFI updates *first*. Read the wiki page mentioned below.

More info here.

[Ernest_at_the_Beach]

Just picked this up from Phoronix comments:

*************************************************************************

06-25-2017, 11:44 AM

https://downloadmirror.intel.com/267...e-20170511.tgz and install with microcode... the "ucode-tool" is no longer needed, Intel provides the microcode in native linux format nowadays....

Posted by:

arjan_intel

Intel

[Dalberg-Acton]

I think he is mistaken about Debian.

[RayChuang88]

True, but Intel has pushed out CPU microcode updates through Windows Update in the past.

[RayChuang88]

The fact Intel has made updates available for Linux/Unix users means this whole issue is moot. Somebody should "virtually bop" the person who caused a panic for all the wrong reasons.

[Ernest_at_the_Beach]

More interesting discussion form Phoronix:

*****************************************************

06-25-2017, 03:00 PM

More like dangerous to run Debian. You're telling me that I'm supposed to run this crap on a production system and disable one of the biggest perks of having a Core i7? HAHA! No. Their refusal to ship device firmware is really stupid. The whole reason we have firmware is to avoid precisely this kind of situation.

Back in the 90s when Intel processors didn't have replaceable firmware, things like the Pentium FDIV and F00F bugs required removing the processor and sending it to Intel for a replacement.

The processors that misbehave under Debian won't misbehave under Fedora, because Fedora ships and updates linux-firmware quite often. Also, my wifi works.

It's funny how Debian goes to all this trouble to be "Free", but then they package things like Widevine, Flash, RAR, etc. and just say that it's not officially part of Debian. The FSF has Debian on the non-recommended list of distributions even though Debian policy makes it much harder than necessary to set your computer up properly and most people end up figuring out a way to get the firmware anyway because they have devices that don't work without it. There is no functional difference, spare a little disk space used, of making available and pre-installing the firmware, since if you don't have the device, it will never get loaded, and few (if any) users want their computer to be non-functional in some way if it's missing.

Fedora is actually more Free by the FSF's own guidelines than Debian is. While Fedora ships firmware, the FSF would declare Debian non-Free for suggesting the firmware or making it available, which it does, but Fedora does not suggest, pre-install, or make available the non-Free software that is hosted by Debian. They don't stop you from installing it yourself from RPM Fusion and they don't try to break it (which would make an operating system non-Free if it did), but RPM Fusion is another project that is not made available by default or recommended by the Fedora project websites.

While there is some effort to set Fedora up, critical hardware isn't broken out-of-the-box simply due to lack of firmware. Debian has picked some odd policies and it continues to do so.

Also, after a while, Debian Stable becomes crusty enough that it won't work properly on new-ish hardware. Not only is the kernel Linux that it ships with sufficiently old that it still has a bunch of Skylake behavior that will make your laptop less efficient and will run down your battery, they insist on breaking the wifi chip until you can install the iwlwifi firmware (which is more of a pain because modern laptops don't have ethernet ports!), *and* to top it off, if you don't disable Hyperthreading, then certain Skylake processors will malfunction on Debian unless the manufacturer releases a new BIOS, which, guess what, probably only installs if you have Windows(!) all because Debian won't ship firmware for the kernel to replace on boot to solve things like this, like a sane OS does.

I don't even consider Debian. The people making their policies are braindead. There shouldn't be a struggle to set up a modern operating system. Sure, there are things to install and settings to tweak in Fedora, but it's not effing broken right out of the gate.

Right now I pretty much use Fedora because on other distributions my laptop is somewhat broken and finding out why or fixing it robs me of the time that I could be using my computer. If I ever want Long Term Stable, I'll go with CentOS. Whenever 8 is out, I guess. You could conceivably install CentOS and never have to do a distribution upgrade again. It's supported for longer than a Debian Stable or Ubuntu LTS, and it gets feature and driver backports.

Last edited by BaronHK; 06-25-2017, 03:08 PM.

[RayChuang88]

Or in short, Debian is officially s***wing themselves. Meanwhile, Fedora, which is supported by Red Hat Software (a company with a LOT of experience developing Linux for "big iron" mainframe hardware), will end up getting more business as many server farms ditch Debian for Fedora.

[Ernest_at_the_Beach]

Hmm....I will have to look at Centos.

[Ernest_at_the_Beach]

Yes, and there can be a big difference between Lionux distros for sure, and the Unix distros as well.

Wonder how Gentoo does their support items, something to check,

[RayChuang88]

In short, anyone who owns Red Hat Software stock will be VERY happy with Debian's horrible missteps over this issue--one that Fedora has likely fixed already. Watch many server farms officially ditch Debian permanently--and that might include Amazon Web Services, Squarespace, etc.

[dayglored]

Thanks for the ping! Got another ping that references the Debian post and had links back to this thread as well, so I pinged my list to that one for better overall coverage.