This maintenance has now been completed without incident.
The security issues that were fixed will come out of embargo after
12:00Z today, so you can find details about them here after that
In addition, all CPU firmware was updated to the latest available
and SMT (hyperthreading) was disabled to better protect you against
existing and future CPU side channel attacks.
We may be able to revisit that decision when Xen's "Core Scheduling"
feature is available:
This would mean that all the vCPUs you see in your VM would not
share a core with other VMs, as a lot of the side channel attacks
involve fetching data out of resources that are shared by all
threads on the same CPU core.
I am not sure we will ever get to the stage where that is safe,
however. For example, processes within your VM may still be able to
use that to get data from shared resources and leak across security
Disabling SMT has raised apparent CPU usage to a level which is
slightly alarming but not, I think, actually detrimental. You can
see that here:
where it is very obvious where the disabling of SMT happened for
each server (except "limoncello" and "talisker" which always had it
I am not entirely sure that the old stats were valid. They assume
that every CPU thread could provide the same amount of compute
power, even when half of them are on the same core as the other
half. If a server showed as 40% loaded before, was it really, or was
there in reality a lower cap to what could possibly be used?
Anyway, there are two largely unused servers and I'm going to
rebalance heaviest users onto them to reduce overall CPU load.
-- No-nonsense VPS hosting
announce mailing list