[PATCH v12 12/12] x86/vmscape: Add cmdline vmscape=on to override attack vector controls
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date: 2026-06-23 17:35:43
Also in:
bpf, kvm, linux-doc, lkml
Subsystem:
documentation, the rest, x86 architecture (32-bit and 64-bit), x86 hardware vulnerabilities · Maintainers:
Jonathan Corbet, Linus Torvalds, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, Peter Zijlstra, Josh Poimboeuf
In general, individual mitigation knobs override the attack vector controls. For VMSCAPE, =ibpb exists but nothing to select BHB clearing mitigation. The =force option would select BHB clearing when supported, but with a side-effect of also forcing the bug, hence deploying the mitigation on unaffected parts too. Add a new cmdline option vmscape=on to enable the mitigation based on the VMSCAPE variant the CPU is affected by. Reviewed-by: Nikolay Borisov <redacted> Tested-by: Jon Kohler <redacted> Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> --- Documentation/admin-guide/hw-vuln/vmscape.rst | 4 ++++ Documentation/admin-guide/kernel-parameters.txt | 2 ++ arch/x86/kernel/cpu/bugs.c | 2 ++ 3 files changed, 8 insertions(+)
diff --git a/Documentation/admin-guide/hw-vuln/vmscape.rst b/Documentation/admin-guide/hw-vuln/vmscape.rst
index 7c40cf70ad7a..2558a5c3d956 100644
--- a/Documentation/admin-guide/hw-vuln/vmscape.rst
+++ b/Documentation/admin-guide/hw-vuln/vmscape.rst@@ -117,3 +117,7 @@ The mitigation can be controlled via the ``vmscape=`` command line parameter: Choose the mitigation based on the VMSCAPE variant the CPU is affected by. (default when CONFIG_MITIGATION_VMSCAPE=y) + + * ``vmscape=on``: + + Same as ``auto``, except that it overrides attack vector controls.
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 38594df8859f..1320baf9264c 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt@@ -8342,6 +8342,8 @@ Kernel parameters unaffected processors auto - (default) use IBPB or BHB clear mitigation based on CPU + on - same as "auto", but override attack + vector control vsyscall= [X86-64,EARLY] Controls the behavior of vsyscalls (i.e. calls to
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index fbdb137720c4..4e0b77fb21dd 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c@@ -3088,6 +3088,8 @@ static int __init vmscape_parse_cmdline(char *str) } else if (!strcmp(str, "force")) { setup_force_cpu_bug(X86_BUG_VMSCAPE); vmscape_mitigation = VMSCAPE_MITIGATION_ON; + } else if (!strcmp(str, "on")) { + vmscape_mitigation = VMSCAPE_MITIGATION_ON; } else if (!strcmp(str, "auto")) { vmscape_mitigation = VMSCAPE_MITIGATION_AUTO; } else {
--
2.34.1