Upcoming Speaking Engagements

Post Syndicated from B. Schneier original https://www.schneier.com/blog/archives/2025/09/upcoming-speaking-engagements-48.html

This is a current list of where and when I am scheduled to speak:

  • I’m speaking and signing books at the Cambridge Public Library on October 22, 2025 at 6 PM ET. The event is sponsored by Harvard Bookstore.
  • I’m giving a virtual talk about my book Rewiring Democracy at 1 PM ET on October 23, 2025. The event is hosted by Data & Society. More details to come.
  • I’m speaking at the World Forum for Democracy in Strasbourg, France, November 5-7, 2025.
  • I’m speaking and signing books at the University of Toronto Bookstore in Toronto, Ontario, Canada on November 14, 2025. Details to come.
  • I’m speaking with Crystal Lee at the MIT Museum in Cambridge, Massachusetts, USA, on December 1, 2025. Details to come.
  • I’m speaking and signing books at the Chicago Public Library in Chicago, Illinois, USA, on February 5, 2026. Details to come.

The list is maintained on this page.

2025-10-14 развод

Post Syndicated from Vasil Kolev original https://vasil.ludost.net/blog/?p=3513

По принцип една от целите на блога беше едно нещо да не го казвам на много хора поотделно, но това първо го казах на почти всички, и сега го пиша.

Миналата година май месец се разведохме. Опитахме всякакви варианти, но в крайна сметка съвместното ни живеене не се отразяваше добре на никого и нямаше как да е полезно за децата, та миналата година Елена се пренесе с децата в Бургас, където те започнаха училище.
(гледането на деца в Бургас е далеч по-лесно и по-нормално от това в София, и се намират добри училища, например математическата им гимназия още държи ниво по олимпиадите)

Самият развод не промени особено нещата. Мога да кажа, че е по-скъп от сватбата, ама основно щото трябва едни адвокати да напишат малко документи, иначе пак като при сватбата, 5 минути в някакво учреждение (тоя път съда) и след няколко дни ни беше готово решението. Мога да кажа, че в нашия случай жененето ни спести два документа (тия за припознаване на децата), та не е съвсем ясно доколко имаше практически смисъл.
(те не че хората се женят по практически причини)

Но разводът не прави децата да изчезнат, както и всичките задължения, свързани с тях, та прилична част там няма да се промени. Само имам възможност да се занимавам пак с OpenFest (което всъщност беше основната причина да мога да се върна в организацията, иначе нямаше да има как), и пак се занимавам с initLab (избраха ме пак в управителния съвет).

Децата са добре, не съм се пропил, и life goes on 🙂

A deep dive into Cloudflare’s September 12, 2025 dashboard and API outage

Post Syndicated from Tom Lianza original https://blog.cloudflare.com/deep-dive-into-cloudflares-sept-12-dashboard-and-api-outage/

What Happened

We had an outage in our Tenant Service API which led to a broad outage of many of our APIs and the Cloudflare Dashboard. 

The incident’s impact stemmed from several issues, but the immediate trigger was a bug in the dashboard. This bug caused repeated, unnecessary calls to the Tenant Service API. The API calls were managed by a React useEffect hook, but we mistakenly included a problematic object in its dependency array. Because this object was recreated on every state or prop change, React treated it as “always new,” causing the useEffect to re-run each time. As a result, the API call executed many times during a single dashboard render instead of just once. This behavior coincided with a service update to the Tenant Service API, compounding instability and ultimately overwhelming the service, which then failed to recover.

When the Tenant Service became overloaded, it had an impact on other APIs and the dashboard because Tenant Service is part of our API request authorization logic.  Without Tenant Service, API request authorization can not be evaluated.  When authorization evaluation fails, API requests return 5xx status codes.

We’re very sorry about the disruption.  The rest of this blog goes into depth on what happened, and what steps we are taking to prevent it from happening again.

Timeline

Time

Description

2025-09-12 16:32

A new version of the Cloudflare Dashboard is released which contains a bug that will trigger many more calls to the /organizations endpoint, including retries in the event of failure.

2025-09-12 17:50

A new version of the Tenant API Service is deployed.

2025-09-12 17:57

The Tenant API Service becomes overwhelmed as new versions are deploying. Dashboard Availability begins to drop IMPACT START

2025-09-12 18:17

After providing more resources to the Tenant API Service, the Cloudflare API climbs to 98% availability, but the dashboard does not recover. IMPACT DECREASE

2025-09-12 18:58

In an attempt to restore dashboard availability, some erroring codepaths were removed and a new version of the Tenant Service is released. This was ultimately a bad change and causes API Impact again. IMPACT INCREASE

2025-09-12 19:01

In an effort to relieve traffic against the Tenant API Service, a temporary ratelimiting rule is published.

2025-09-12 19:12

The problematic changes to the Tenant API Service are reverted, and Dashboard Availability returns to 100%. IMPACT END

Dashboard Availability

The Cloudflare dashboard was severely impacted throughout the full duration of the incident.


API Availability

The Cloudflare API was severely impacted for two periods during the incident when the Tenant API Service was down.


How we Responded

Our first goal in an incident is to restore service.  Often that involves fixing the underlying issue directly, but not always.  In this case we noticed increased usage across our Tenant Service, so we focused on reducing the load and increasing the available resources.  We installed a global rate limit on the Tenant Service to help regulate the load.  The Tenant Service is a GoLang process that runs on Kubernetes in a subset of our datacenters.  We increased the number of pods available as well to help improve throughput.  While we did this, we had others on the team continue to investigate why we were seeing the unusually high usage.  Ultimately, increasing the resources available to the tenant service helped with availability but was insufficient to restore normal service.


After the Tenant Service began reporting healthy again and the API largely recovered, we still observed a considerable number of errors being reported from the service. We theorized that these were responsible for the ongoing Dashboard availability issues and made a patch to the service with the expectation that it would improve the API health and restore the dashboard to a healthy state. Ultimately this change degraded service further and was quickly reverted. The second outage can be seen in the graph above.

It’s painful to have an outage like this.  That said, there were a few things that helped lessen the impact.  Our automatic alerting service quickly identified the correct people to join the call and start working on remediation.  Additionally, this was a failure in the control plane which has strict separation of concerns from the data plane.  Thus the outage did not affect services on Cloudflare’s network.  The majority of users at Cloudflare were unaffected unless they were making configuration changes or using our dashboard.

Going Forward

We believe it’s important to learn from our mistakes and this incident is an opportunity to make some improvements.  Those improvements can be categorized as either ways to reduce / eliminate the impact of a similar change or as improvements to our observability tooling to better inform the team during future events.

Reducing Impact

We use Argo Rollouts for releasing, which monitors deployments for errors and automatically rolls back that service on a detected error.  We’ve been migrating our services over to Argo Rollouts but have not yet updated the Tenant Service to use it.  Had it been in place, we would have automatically rolled back the second Tenant Service update limiting the second outage.  This work had already been scheduled by the team and we’ve increased the priority of the migration.

When we restarted the Tenant Service, everyone’s dashboard began to re-authenticate with the API.  This caused the API to become unstable again causing issues with everyone’s dashboard.  This pattern is a common one often referred to as a Thundering Herd.  Once a resource or service is made available, everyone tries to use it all at once. This is common, but was amplified by the bug in our dashboard logic. The fix for this behavior has already been released via a hotfix shortly after the impact was over.  We’ll be introducing changes to the dashboard that include random delays to spread out retries and reduce contention as well. 

Finally, the Tenant Service was not allocated sufficient capacity to handle spikes in load like this. We’ve allocated substantially more resources to this service, and are improving the monitoring so that we will be proactively alerted before this service hits capacity limits.

Improving Visibility

We immediately saw an increase in our API usage but found it difficult to identify which requests were retries vs new requests.  Had we known that we were seeing a sustained large volume of new requests, it would have made it easier to identify the issue as a loop in the dashboard.  We are adding changes to how we call our APIs from our dashboard to include additional information, including if the request is a retry or new request.

We’re very sorry about the disruption.  We will continue to investigate this issue and make improvements to our systems and processes.

Седмицата (8–13 септември)

Post Syndicated from Светла Енчева original https://www.toest.bg/sedmitsata-8-13-septemvri/

Седмицата (8–13 септември)

Какво по-гадно от септември? Новините. Думите не са мои, а на Е.Т., която ни изненада с ново видео още преди края на лятната ваканция на „Тоест“. С това ми спести чуденето дали да споделя прозренията ѝ в началото, или в края на бюлетина – просто ще направя и двете. В началото – епизодът изненада, в края – редовният.

Освен че са гадни, новините стават и все по-абсурдни. След Путин, който опакова желанието си Украйна да се предаде без бой като стремеж към мир, Тръмп се опитва да достигне още по-голямо майсторство в осъществяването на принципа от „1984“ на Оруел „Войната е мир“. След като си поиска Нобелова награда за мир, той преименува Министерството на отбраната на САЩ на Министерство на войната и не престана да праща военни части в американските градове, които не му харесват. Само през последните дни Израел бомбардира жилищен район в катарската столица Доха, защото там имало висши функционери на „Хамас“, а Полша свали с изтребители руски дронове, навлезли във въздушното ѝ пространство. Такива са чудесата на днешния мир.

На тази „миролюбива“ вълна оставаме с бюлетина на Йоанна Елми „Гласовете на Америка“. Седмият му брой е посветен на убийството на неоконсервативния активист Чарли Кърк, застрелян точно по време на разговор със студенти за масовите престрелки в САЩ. Задават се мрачни времена както за САЩ, така и за света, не без страх заключава Йоанна.

В България ситуацията все повече заприличва на виц, макар да не ни е смешно. Да вземем историята с шефа на полицията в Русе, при която нищо от първоначалната официална информация не се потвърди. Не отивал, а се прибирал. Не на фитнес, а от кръчма (пардон, от ресторант). Но дано пострадалият се възстанови (прави ли ви впечатление впрочем липсата на информация за състоянието му?), фактите излязат наяве и всички виновни понесат отговорността си.

Случаят в Русе е един от ярките примери за провалите на МВР, които според Емилия Милчева са жокерът на новия политически сезон, защото имат потенциала да раздрусат властта. Истинската опасност за стабилността на управляващите идва не от предстоящия вот на недоверие, а от улицата, смята Емилия. Виждаме знаци за това в серията малки бунтове във все повече градове. На фона на нарастващ институционален разпад МВР се превръща в декор, изобразяващ, че на държавата всъщност хич не ѝ пука за правата на гражданите ѝ.

Тази седмица беше 9 септември, та се сетих за стихотворението „Добрият празник“ на Цветан Ангелов. В него лирическият герой – момченце, се радва, че Девети септември му купил палтенце и сандалки, дал му геврече, че и знаменце за парада. А през 2025 г. на живеещите в източната част на София 9 септември им даде топла вода, тоест „Топлофикация“ им я пусна след повече от седмица профилактика. Но софиянци да не се оплакват, че смърдели – по различни оценки в България между четвърт и половин милион души нямат достъп (постоянен или никакъв) до питейна вода.

Като стана дума за Девети септември, много младежи днес вярват, че по времето на социализма хората са живели по-добре, отколкото днес, и са били по-щастливи. Нашите автори Теодора Станимирова и Стелиян Ботев също са млади, но не мислят така. Независимо един от друг те предложиха теми, свързани със социалистическите концлагери. Теодора е събрала спомени на оцелели, в които се разказва за смърт, глад и унижения. Стелиян търси отговор на въпроса как архитектурата може да бъде своеобразен език на паметта за травматичното ни минало.

Септември неизбежно се свързва с началото на учебната година. Донка Дойчева-Попова и Пейо Попов проведоха вдъхновяващ разговор за математиката, хората и радостта с неконвенционалния преподавател по физика Лъчезар Симеонов, чиято школа посещават от ученици до пенсионери. Освен да прочетете разговора с него, може и да го чуете в неподправения му блясък.

Донка впрочем ще е първата от пишещите за „Тоест“, които вие, нашите читатели, вече в качеството си на зрители, ще имате възможността да видите в новата ни рубрика „Тоест разговаряме“. В нея телевизионният журналист и съосновател на „Тоест“ Владислав Севов ще ни среща веднъж месечно с някои от авторите в сайта. Разговорът, който ще се проведе тази събота, 13 септември, от 16 ч., ще се излъчва пряко. Ще можете да го гледате в канала ни в Youtube, както и във Facebook.

Разговорите са предпоставка за формиране на общност. Книгите – също. В рубриката „Тези хора“ Ина Иванова ни среща с преводачката от нидерландски Мария Енчева, която заедно с Йордан Жечев създава независимата книжарница „Махала“, и около това място се завихря общност. Как го постигат? Ами като предлагат само книги, които лично харесват.

Навечерието на новата учебна година е подходящ повод да си спомним, че в България има деца, с чиито семейства образователната система няма как да се оправдае – по простата причина, че те нямат родители, които да се грижат за тях. В първата си от поредица статии Евгения Тонева ни разказва за реформата на домовете за деца – между обещанията и реалността. Приключването на процеса на деинституционализация на домовете се обявява с фанфари, но за стотици деца на практика нищо не се променя.

Както ви обещах в началото, завършвам прегледа на новото в „Тоест“ с още един епизод на „Т.Е. от Е.Т“, в който Елена Телбис говори за гадни неща по начин, който ни кара да се засмеем.

Дойде време и за препоръката ми. Ако и вие като мен харесвате Педро Алмодовар, вероятно ще ви се услади и сериалът „Гняв“ (Rage на английски, Furia на испански) по HBO MAX. Макар да не са режисирани от известния испански режисьор, разказаните в него преплитащи се истории на няколко жени определено носят алмодоварски дух. Не само заради участието на звездата от „Всичко за майка ми“ Сесилия Рот, а и заради начина, по който са едновременно смешно-тъжни, брутални и абсурдни. За себе си кръстих сериала „Жени отвъд ръба на нервната криза“.

За финал препоръчвам да ни ударите едно рамо, ако ви харесва да ни четете, защото съществуваме благодарение на подкрепата от читателите ни.

Assessing the Quality of Dried Squid

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/09/assessing-the-quality-of-dried-squid.html

Research:

Nondestructive detection of multiple dried squid qualities by hyperspectral imaging combined with 1D-KAN-CNN

Abstract: Given that dried squid is a highly regarded marine product in Oriental countries, the global food industry requires a swift and noninvasive quality assessment of this product. The current study therefore uses visible­near-infrared (VIS-NIR) hyperspectral imaging and deep learning (DL) methodologies. We acquired and preprocessed VIS-NIR (400­1000 nm) hyperspectral reflectance images of 93 dried squid samples. Important wavelengths were selected using competitive adaptive reweighted sampling, principal component analysis, and the successive projections algorithm. Based on a Kolmogorov-Arnold network (KAN), we introduce a one-dimensional, KAN convolutional neural network (1D-KAN-CNN) for nondestructive measurements of fat, protein, and total volatile basic nitrogen….

A Cyberattack Victim Notification Framework

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/09/a-cyberattack-victim-notification-framework.html

Interesting analysis:

When cyber incidents occur, victims should be notified in a timely manner so they have the opportunity to assess and remediate any harm. However, providing notifications has proven a challenge across industry.

When making notifications, companies often do not know the true identity of victims and may only have a single email address through which to provide the notification. Victims often do not trust these notifications, as cyber criminals often use the pretext of an account compromise as a phishing lure.

[…]

This report explores the challenges associated with developing the native-notification concept and lays out a roadmap for overcoming them. It also examines other opportunities for more narrow changes that could both increase the likelihood that victims will both receive and trust notifications and be able to access support resources.

The report concludes with three main recommendations for cloud service providers (CSPs) and other stakeholders:

  1. Improve existing notification processes and develop best practices for industry.
  2. Support the development of “middleware” necessary to share notifications with victims privately, securely, and across multiple platforms including through native notifications.
  3. Improve support for victims following notification.

While further work remains to be done to develop and evaluate the CSRB’s proposed native notification capability, much progress can be made by implementing better notification and support practices by cloud service providers and other stakeholders in the near term.

Tuning guide for AMD Amazon EC2 instances

Post Syndicated from Suyash Nadkarni original https://aws.amazon.com/blogs/compute/tuning-guide-for-amd-amazon-ec2-instances/

As organizations migrate more mission-critical workloads to the cloud, optimizing for price-performance becomes a key consideration. Amazon Elastic Compute Cloud (Amazon EC2) instances powered by AMD EPYC processors deliver high core density, large memory bandwidth, and hardware-enabled security features, making them a strong option for a wide range of compute, memory, and I/O-intensive workloads. In this post, we explain how to choose the right AMD-based Amazon EC2 instance types and describe tuning techniques that can help users improve workload efficiency. Whether you’re running simulations, large-scale analytics, or inference workloads, this post provides practical guidance for optimizing AMD-powered Amazon EC2 instance.

Amazon EC2 offers AMD-based instances built on multiple generations of AMD EPYC processors. This post focuses on optimization strategies for the 3rd and 4th generation families, which provide enhanced capabilities for compute and memory-intensive workloads.

  • 3rd generation (M6a, R6a, C6a, Hpc6a): Balances compute, memory, and storage—well-suited for analytics, web servers, and high-performance computing.
  • 4th generation (M7a, R7a, C7a, Hpc7a): Deliver up to 50% better performance over earlier AMD generations These instances introduce AVX-512 support, DDR5 memory, and Simultaneous Multithreading (SMT) turned off, SMT is a technology that allows a single physical core to run multiple threads concurrently; with SMT disabled, each virtual CPU (vCPU) maps directly to a physical core, which can improve workload isolation and consistency.

Choosing the right AMD EPYC powered Amazon EC2 instance type

Selecting the right AMD EPYC powered Amazon EC2 instance type starts with understanding how your application uses compute, memory, storage, and networking resources. Each instance family is optimized for specific workload characteristics.

Compute-intensive workloads

These workloads involve large-scale calculations, simulations, or encoding tasks, and they often need high CPU throughput and advanced instruction set support.

Recommended instances: C7a, Hpc7a, C6a, Hpc6a
Use cases: Scientific computing, financial modelling, media transcoding, encryption, machine learning (ML) inference

Big data and analytics

Applications that process and analyze large datasets benefit from high memory bandwidth and a balanced compute-to-memory ratio.

Recommended instances: R7a, M7a, R6a, M6a
Use cases: Stream processing, real-time analytics, business intelligence tools, distributed caching

Database workloads

Database workloads typically need consistent memory performance and high I/O throughput for read/write operations.

Recommended instances: R7a, M7a, R6a, M6a
Use cases: Relational databases (MySQL, PostgreSQL), NoSQL databases (MongoDB, Cassandra), in-memory databases (Redis)

Web and application servers

These applications handle variable request loads and benefit from balanced compute, memory, and network performance.

Recommended instances: C7a, M7a, C6a, M6a
Use cases: Web servers, content management systems, e-commerce platforms, API endpoints

AI/ML on CPU

ML tasks that do not need GPUs—such as inference or preprocessing—can run efficiently on CPU-based instances.

Recommended instances: M7a, R7a, C7a
Use cases: Model inference, natural language processing, computer vision, recommendation engines

High Performance Computing (HPC)

These workloads need high core counts, memory bandwidth, and low-latency networking for tightly coupled computations.

Recommended instances: Hpc7a, Hpc6a, R7a, M7a
Use cases: Computational fluid dynamics, genomics, seismic analysis, engineering simulations

Aligning your instance type with the needs of your workload helps provide predictable performance and cost efficiency. Services such as Amazon EC2 Auto Scaling and AWS Compute Optimizer can assist with ongoing instance selection and scaling decisions.

Optimizing AMD EPYC powered Amazon EC2 instances

Amazon EC2 instances powered by 4th generation AMD EPYC processors use a modular chiplet architecture, as shown in the following figure. Each processor includes multiple Core Complex Dies (CCDs), and each CCD contains one or more core complexes (CCXs). A CCX groups up to eight physical cores, with each core having 1 MB of dedicated L2 cache and all eight cores sharing a 32 MB L3 cache. These CCDs are connected to a central I/O die, which manages memory and interconnects across the chip.

Figure 1: Layout of the ‘Zen 4’ CPU die with 8 cores per die

Figure 1: Layout of the ‘Zen 4’ CPU die with 8 cores per die

The modular architecture of 4th generation AMD EPYC processors enables Amazon EC2 instances such as m7a.24xlarge and m7a.48xlarge to support high core counts-up to 96 physical cores per socket. For example:

  • m7a.24xlarge provides 96 physical cores from a single socket.
  • m7a.48xlarge spans two sockets, offering 192 physical cores.

Understanding how Amazon EC2 instance sizes map to physical processor layouts can help you optimize for performance and cache locality. Workloads that involve shared memory access or thread synchronization, such as high-performance computing or in-memory databases, can benefit from selecting instance sizes that minimize cross-socket communication and make efficient use of shared L3 cache, as shown in the following figure.

Figure 2: Layout of the ‘EPYC Chiplet’ CPU

Figure 2: Layout of the ‘EPYC Chiplet’ CPU

Amazon EC2 instances powered by 4th generation AMD EPYC processors operate with SMT turned off. In this configuration, each vCPU maps directly to a physical core, eliminating resource sharing such as execution units and cache between sibling threads. This design can reduce intra-core interference and help provide more consistent performance under certain workloads. Users can isolate threads at the core level and observe lower variability and more stable throughput for workloads, such as high-performance computing, ML inference, and transactional databases.

CPU optimizations

Tools such as htop can help identify CPU usage patterns, system load averages, and per-process resource consumption. CPU usage should be evaluated in the context of your workload and performance requirements. If usage consistently reaches 100%, then it may indicate that the workload is CPU-bound and not optimally balanced. Before modifying the instance size, enabling Auto Scaling, or switching instance families, evaluations must be conducted for the tuning opportunities that could improve performance without changing infrastructure. Load averages that regularly exceed the number of vCPUs can also signal compute saturation and may warrant further optimization.

L3 cache usage

The L3 cache is a shared, high-speed memory layer used by a group of CPU cores. On AMD-based Amazon EC2, cores are organized into L3 cache slices, each shared by a subset of cores on the same socket. Threads scheduled within the same slice can access shared data more efficiently, reducing memory latency. On 4th generation AMD instances such as m7a.2xlarge or r7a.2xlarge, all vCPUs typically map to cores within a single L3 slice, which ensures consistent cache locality. For larger sizes (for example m7a.8xlarge and above), thread pinning—assigning threads to specific physical cores—can help maintain this locality. Thread pinning can reduce performance variability in workloads with shared-memory access patterns.

You can pin threads using the taskset command:

taskset -c 0-3 ./your_application

This example pins your application to CPU cores 0 through 3. To determine which cores share the same L3 cache region, use tools such as lscpu or lstopo to inspect the system’s CPU topology. Grouping related threads on cores that share an L3 cache can improve performance consistency for workloads with frequent shared-memory access.

Docker container optimization

In containerized environments running on AMD-based Amazon EC2 instances, tuning CPU-related settings can improve workload consistency and efficiency—particularly for compute-intensive or latency-sensitive applications. Although default configurations work for many general-purpose scenarios, certain workloads may benefit from more explicit control over how CPU resources are allocated. By default, container runtimes such as Docker allow the operating system to schedule containers across any available CPU cores. This flexible scheduling can lead to variability in performance when containers move across cores that don’t share cache. To reduce this variability and improve cache efficiency, containers can be pinned to specific cores using the --cpuset-cpus flag.

docker run --cpuset-cpus="1,3" my-container

This setting restricts the container to use only the specified cores. In this example, cores 1 and 3 are used for demonstration. The actual core selection should be based on CPU topology to make sure of cache-efficient scheduling. Pinning containers to cores that share L3 cache can reduce scheduling overhead and improve consistency for workloads with shared-memory access patterns.

CPU frequency governor settings

Some operating systems adjust CPU frequency dynamically to save power. This is typically controlled by a setting called the CPU frequency governor. Although this behavior is efficient for general-purpose workloads, it may introduce latency or performance variability in compute-sensitive environments. For workloads that need consistently high CPU performance—such as high-throughput data processing, simulations, or real-time applications—we recommend setting the CPU governor to performance mode. This makes sure that the CPU runs at its maximum frequency under load, avoiding time spent ramping up from lower power states.

You can apply this setting on bare metal instances or Amazon EC2 Dedicated Hosts using the following command:

sudo cpupower frequency-set -g performance

Before applying, consider benchmarking workload performance with other CPU frequency governors (such as ondemand or schedutil) to make sure that the performance setting provides measurable benefits without unnecessary energy trade-offs.

Use architecture-specific compiler flags

When compiling performance-sensitive C or C++ applications, architecture-specific flags such as -march=znverX can unlock AMD EPYC–specific optimizations, including improved vectorization and floating-point performance. Although this is beneficial for compute-heavy workloads, it may reduce portability across architectures. To balance performance and flexibility, consider implementing runtime feature detection and dispatching an approach used by many optimized libraries to adapt behavior based on the underlying CPU.

Before using these flags, verify that your compiler version supports them and make sure that the target EC2 instance architecture matches the specified flag. For example, a binary compiled with -march=znver4 may fail with an illegal instruction error (SIGILL) if run on earlier-generation instances such as M5a.The following table outlines the appropriate flags and minimum supported compiler versions for each AMD EPYC generation:

AMD EPYC Generation -march Flag Minimum GCC Version Minimum LLVM/Clang Version
4th generation (for example M7a) znver4 GCC 12 Clang 15
3rd generation (for example M6a) znver3 GCC 11 Clang 13
2nd generation (for example M5a) znver2 GCC 9 Clang 11

The following flags are supported for GCC 11+ or LLVM Clang 13+:

# 4th Gen EPYC (M7a, R7a, C7a, Hpc7a)
-march=znver4

# 3rd Gen EPYC (M6a, R6a, C6a)
-march=znver3

# 2nd Gen EPYC (M5a, R5a, C5a)
-march=znver2

When to enable AVX-512 and VNNI instructions

4th generation AMD EPYC powered Amazon EC2 instances support advanced single instruction, multiple data (SIMD) instruction sets such as AVX2, AVX-512, and VNNI. These can improve throughput for vector-heavy workloads such as ML inference, image processing, or scientific simulations. However, these flags are generation-specific—attempting to run binaries compiled with AVX-512 on unsupported instances (for example 2nd generation M5a) may result in runtime errors such as illegal instruction (SIGILL).

When compiling C or C++ code:

gcc -mavx2 -mavx512f -O2 your_program.c -o your_program

To better understand which optimizations are applied, use the following:

-ftree-vectorizer-verbose=2 -fopt-info-vec-missed

This helps identify loops that benefit from vectorization and those that don’t. Only enable these optimizations if your workload benefits and you’ve validated compatibility with the instance generation in use. Avoid applying AVX flags indiscriminately, because it may reduce portability and increase binary complexity.

AMD Optimizing CPU Libraries

The AMD Optimizing CPU Libraries (AOCL) provide performance-tuned math libraries specifically designed for AMD EPYC processors. These libraries include optimized implementations of commonly used functions in scientific computing, engineering, and ML workloads. You can link your applications against AOCL to use processor-specific optimizations without rewriting your code. AOCL includes libraries for vector and scalar math, random number generation, FFT, BLAS, and LAPACK, among others.

Setting up AOCL

  • Set the AOCL_ROOT environment variable to point to the installation directory:
    export AOCL_ROOT=/path/to/aocl

  • Compile your application with the appropriate include and library paths:
    gcc -I$AOCL_ROOT/include -L$AOCL_ROOT/lib -lamdlibm -lm your_program.c -o your_program

  • Vector and scalar math optimization: you can enable more vectorized or scalar math tuning flags for specific workloads:
    # Vector math optimization
    gcc -lamdlibm -fveclib=AMDLIBM -lm your_program.c -o your_program
    		
    # Faster scalar math
    gcc -lamdlibm -fsclrlib=AMDLIBM -lamdlibmfast -lm your_program.c -o your_program

  • AOCL runtime profiling: AOCL supports runtime profiling, which helps developers identify which mathematical operations dominate execution time. To enable profiling, run the following:
    export AOCL_PROFILE=1
    ./your_program

After running this, a report file named aocl_profile_report.txt is generated. It provides a function-level breakdown of call counts, execution time, and thread usage. Developers can use this to focus optimization efforts on high-impact operations.

Conclusion

This post explored how to select AMD-based Amazon EC2 instance types that align with specific workload characteristics, and how to apply tuning techniques focused on CPU usage, thread placement, cache efficiency, and math library optimization. These approaches are especially relevant for compute-bound or latency-sensitive workloads where consistent performance is critical.

Ready to get started? Sign in to the AWS Management Console and launch AMD EPYC powered Amazon EC2 instances to begin optimizing your workloads today.

The collective thoughts of the interwebz