Re: [RFC PATCH 00/56] Dynamic mitigations

[Breno Leitao]

On Tue, Oct 14, 2025 at 06:06:48PM +0000, Kaplan, David wrote:
> The cloud guys on this thread may be able to offer some additional color here since I believe that's where you're most likely to have this situation.

Here is my view on what happens on the Meta fleet.

Each workload selects a set of attack vectors and decides on its own
security threat model.

To meet the security requirements of that workload, the machine needs to
be rebooted, so a workload switch usually means a reboot or kexec, which
is not ideal.

This solution would remove that extra kexec on a workload switch.

--breno