Documentation for /proc/sys/kernel/* kernel version 2.2.10 (c) 1998, 1999, Rik van Riel <riel@nl.linux.org> (c) 2009, Shen Feng<shen@cn.fujitsu.com> For general info and legal blurb, please look in README. ============================================================== This file contains documentation for the sysctl files in/proc/sys/kernel/ and is valid for Linux kernel version 2.2. The files in this directory can be used to tune and monitormiscellaneous and general things in the operation of the Linuxkernel. Since some of the files _can_ be used to screw up yoursystem, it is advisable to read both documentation and sourcebefore actually making adjustments. Currently, these files might (depending on your configuration)show up in /proc/sys/kernel: - acct- acpi_video_flags- auto_msgmni- bootloader_type [ X86 only ]- bootloader_version [ X86 only ]- callhome [ S390 only ]- cap_last_cap- core_pattern- core_pipe_limit- core_uses_pid- ctrl-alt-del- dmesg_restrict- domainname- hostname- hotplug- hardlockup_all_cpu_backtrace- hung_task_panic- hung_task_check_count- hung_task_timeout_secs- hung_task_warnings- kexec_load_disabled- kptr_restrict- kstack_depth_to_print [ X86 only ]- l2cr [ PPC only ]- modprobe ==> Documentation/debugging-modules.txt- modules_disabled- msg_next_id [ sysv ipc ]- msgmax- msgmnb- msgmni- nmi_watchdog- osrelease- ostype- overflowgid- overflowuid- panic- panic_on_oops- panic_on_stackoverflow- panic_on_unrecovered_nmi- panic_on_warn- perf_cpu_time_max_percent- perf_event_paranoid- perf_event_max_stack- perf_event_max_contexts_per_stack- pid_max- powersave-nap [ PPC only ]- printk- printk_delay- printk_ratelimit- printk_ratelimit_burst- pty ==> Documentation/filesystems/devpts.txt- randomize_va_space- real-root-dev ==> Documentation/initrd.txt- reboot-cmd [ SPARC only ]- rtsig-max- rtsig-nr- sem- sem_next_id [ sysv ipc ]- sg-big-buff [ generic SCSI device (sg) ]- shm_next_id [ sysv ipc ]- shm_rmid_forced- shmall- shmmax [ sysv ipc ]- shmmni- softlockup_all_cpu_backtrace- soft_watchdog- stop-a [ SPARC only ]- sysrq ==> Documentation/sysrq.txt- sysctl_writes_strict- tainted- threads-max- unknown_nmi_panic- watchdog- watchdog_thresh- version ============================================================== acct: highwater lowwater frequency If BSD-style process accounting is enabled these values controlits behaviour. If free space on filesystem where the log livesgoes below <lowwater>% accounting suspends. If free space getsabove <highwater>% accounting resumes. <Frequency> determineshow often do we check the amount of free space (value is inseconds). Default:4 2 30That is, suspend accounting if there left <= 2% free; resume itif we got >=4%; consider information about amount of free spacevalid for 30 seconds. ============================================================== acpi_video_flags: flags See Doc*/kernel/power/video.txt, it allows mode of video boot to beset during run time. ============================================================== auto_msgmni: This variable has no effect and may be removed in future kernelreleases. Reading it always returns 0.Up to Linux 3.17, it enabled/disabled automatic recomputing of msgmniupon memory add/remove or upon ipc namespace creation/removal.Echoing "1" into this file enabled msgmni automatic recomputing.Echoing "0" turned it off. auto_msgmni default value was 1. ============================================================== bootloader_type: x86 bootloader identification This gives the bootloader type number as indicated by the bootloader,shifted left by 4, and OR'd with the low four bits of the bootloaderversion. The reason for this encoding is that this used to match thetype_of_loader field in the kernel header; the encoding is kept forbackwards compatibility. That is, if the full bootloader type numberis 0x15 and the full version number is 0x234, this file will containthe value 340 = 0x154. See the type_of_loader and ext_loader_type fields inDocumentation/x86/boot.txt for additional information. ============================================================== bootloader_version: x86 bootloader version The complete bootloader version number. In the example above, thisfile will contain the value 564 = 0x234. See the type_of_loader and ext_loader_ver fields inDocumentation/x86/boot.txt for additional information. ============================================================== callhome: Controls the kernel's callhome behavior in case of a kernel panic. The s390 hardware allows an operating system to send a notificationto a service organization (callhome) in case of an operating system panic. When the value in this file is 0 (which is the default behavior)nothing happens in case of a kernel panic. If this value is set to "1"the complete kernel oops message is send to the IBM customer serviceorganization in case the mainframe the Linux operating system is runningon has a service contract with IBM. ============================================================== cap_last_cap Highest valid capability of the running kernel. ExportsCAP_LAST_CAP from the kernel. ============================================================== core_pattern: core_pattern is used to specify a core dumpfile pattern name.. max length 128 characters; default value is "core". core_pattern is used as a pattern template for the output filename; certain string patterns (beginning with '%') are substituted with their actual values.. backward compatibility with core_uses_pid: If core_pattern does not include "%p" (default does not) and core_uses_pid is set, then .PID will be appended to the filename.. corename format specifiers: %<NUL> '%' is dropped %% output one '%' %p pid %P global pid (init PID namespace) %i tid %I global tid (init PID namespace) %u uid (in initial user namespace) %g gid (in initial user namespace) %d dump mode, matches PR_SET_DUMPABLE and /proc/sys/fs/suid_dumpable %s signal number %t UNIX time of dump %h hostname %e executable filename (may be shortened) %E executable path %<OTHER> both are dropped. If the first character of the pattern is a '|', the kernel will treat the rest of the pattern as a command to run. The core dump will be written to the standard input of that program instead of to a file. ============================================================== core_pipe_limit: This sysctl is only applicable when core_pattern is configured to pipecore files to a user space helper (when the first character ofcore_pattern is a '|', see above). When collecting cores via a pipeto an application, it is occasionally useful for the collectingapplication to gather data about the crashing process from its/proc/pid directory. In order to do this safely, the kernel must waitfor the collecting process to exit, so as not to remove the crashingprocesses proc files prematurely. This in turn creates thepossibility that a misbehaving userspace collecting process can blockthe reaping of a crashed process simply by never exiting. This sysctldefends against that. It defines how many concurrent crashingprocesses may be piped to user space applications in parallel. Ifthis value is exceeded, then those crashing processes above that valueare noted via the kernel log and their cores are skipped. 0 is aspecial value, indicating that unlimited processes may be captured inparallel, but that no waiting will take place (i.e. the collectingprocess is not guaranteed access to /proc/<crashing pid>/). Thisvalue defaults to 0. ============================================================== core_uses_pid: The default coredump filename is "core". By settingcore_uses_pid to 1, the coredump filename becomes core.PID.If core_pattern does not include "%p" (default does not)and core_uses_pid is set, then .PID will be appended tothe filename. ============================================================== ctrl-alt-del: When the value in this file is 0, ctrl-alt-del is trapped andsent to the init(1) program to handle a graceful restart.When, however, the value is > 0, Linux's reaction to a VulcanNerve Pinch (tm) will be an immediate reboot, without evensyncing its dirty buffers. Note: when a program (like dosemu) has the keyboard in 'raw'mode, the ctrl-alt-del is intercepted by the program before itever reaches the kernel tty layer, and it's up to the programto decide what to do with it. ============================================================== dmesg_restrict: This toggle indicates whether unprivileged users are preventedfrom using dmesg(8) to view messages from the kernel's log buffer.When dmesg_restrict is set to (0) there are no restrictions. Whendmesg_restrict is set set to (1), users must have CAP_SYSLOG to usedmesg(8). The kernel config option CONFIG_SECURITY_DMESG_RESTRICT sets thedefault value of dmesg_restrict. ============================================================== domainname & hostname: These files can be used to set the NIS/YP domainname and thehostname of your box in exactly the same way as the commandsdomainname and hostname, i.e.:# echo "darkstar" > /proc/sys/kernel/hostname# echo "mydomain" > /proc/sys/kernel/domainnamehas the same effect as# hostname "darkstar"# domainname "mydomain" Note, however, that the classic darkstar.frop.org has thehostname "darkstar" and DNS (Internet Domain Name Server)domainname "frop.org", not to be confused with the NIS (NetworkInformation Service) or YP (Yellow Pages) domainname. These twodomain names are in general different. For a detailed discussionsee the hostname(1) man page. ==============================================================hardlockup_all_cpu_backtrace: This value controls the hard lockup detector behavior when a hardlockup condition is detected as to whether or not to gather furtherdebug information. If enabled, arch-specific all-CPU stack dumpingwill be initiated. 0: do nothing. This is the default behavior. 1: on detection capture more debug information.============================================================== hotplug: Path for the hotplug policy agent.Default value is "/sbin/hotplug". ============================================================== hung_task_panic: Controls the kernel's behavior when a hung task is detected.This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. 0: continue operation. This is the default behavior. 1: panic immediately. ============================================================== hung_task_check_count: The upper bound on the number of tasks that are checked.This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. ============================================================== hung_task_timeout_secs: Check interval. When a task in D state did not get scheduledfor more than this value report a warning.This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. 0: means infinite timeout - no checking done.Possible values to set are in range {0..LONG_MAX/HZ}. ============================================================== hung_task_warnings: The maximum number of warnings to report. During a check intervalif a hung task is detected, this value is decreased by 1.When this value reaches 0, no more warnings will be reported.This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. -1: report an infinite number of warnings. ============================================================== kexec_load_disabled: A toggle indicating if the kexec_load syscall has been disabled. Thisvalue defaults to 0 (false: kexec_load enabled), but can be set to 1(true: kexec_load disabled). Once true, kexec can no longer be used, andthe toggle cannot be set back to false. This allows a kexec image to beloaded before disabling the syscall, allowing a system to set up (andlater use) an image without it being altered. Generally used togetherwith the "modules_disabled" sysctl. ============================================================== kptr_restrict: This toggle indicates whether restrictions are placed onexposing kernel addresses via /proc and other interfaces. When kptr_restrict is set to (0), the default, there are no restrictions. When kptr_restrict is set to (1), kernel pointers printed using the %pKformat specifier will be replaced with 0's unless the user has CAP_SYSLOGand effective user and group ids are equal to the real ids. This isbecause %pK checks are done at read() time rather than open() time, soif permissions are elevated between the open() and the read() (e.g viaa setuid binary) then %pK will not leak kernel pointers to unprivilegedusers. Note, this is a temporary solution only. The correct long-termsolution is to do the permission checks at open() time. Consider removingworld read permissions from files that use %pK, and using dmesg_restrictto protect against uses of %pK in dmesg(8) if leaking kernel pointervalues to unprivileged users is a concern. When kptr_restrict is set to (2), kernel pointers printed using%pK will be replaced with 0's regardless of privileges. ============================================================== kstack_depth_to_print: (X86 only) Controls the number of words to print when dumping the rawkernel stack. ============================================================== l2cr: (PPC only) This flag controls the L2 cache of G3 processor boards. If0, the cache is disabled. Enabled if nonzero. ============================================================== modules_disabled: A toggle value indicating if modules are allowed to be loadedin an otherwise modular kernel. This toggle defaults to off(0), but can be set true (1). Once true, modules can beneither loaded nor unloaded, and the toggle cannot be set backto false. Generally used with the "kexec_load_disabled" toggle. ============================================================== msg_next_id, sem_next_id, and shm_next_id: These three toggles allows to specify desired id for next allocated IPCobject: message, semaphore or shared memory respectively. By default they are equal to -1, which means generic allocation logic.Possible values to set are in range {0..INT_MAX}. Notes:1) kernel doesn't guarantee, that new object will have desired id. So,it's up to userspace, how to handle an object with "wrong" id.2) Toggle with non-default value will be set back to -1 by kernel aftersuccessful IPC object allocation. ============================================================== nmi_watchdog: This parameter can be used to control the NMI watchdog(i.e. the hard lockup detector) on x86 systems. 0 - disable the hard lockup detector 1 - enable the hard lockup detector The hard lockup detector monitors each CPU for its ability to respond totimer interrupts. The mechanism utilizes CPU performance counter registersthat are programmed to generate Non-Maskable Interrupts (NMIs) periodicallywhile a CPU is busy. Hence, the alternative name 'NMI watchdog'. The NMI watchdog is disabled by default if the kernel is running as a guestin a KVM virtual machine. This default can be overridden by adding nmi_watchdog=1 to the guest kernel command line (see Documentation/kernel-parameters.txt). ============================================================== numa_balancing Enables/disables automatic page fault based NUMA memorybalancing. Memory is moved automatically to nodesthat access it often. Enables/disables automatic NUMA memory balancing. On NUMA machines, thereis a performance penalty if remote memory is accessed by a CPU. When thisfeature is enabled the kernel samples what task thread is accessing memoryby periodically unmapping pages and later trapping a page fault. At thetime of the page fault, it is determined if the data being accessed shouldbe migrated to a local memory node. The unmapping of pages and trapping faults incur additional overhead thatideally is offset by improved memory locality but there is no universalguarantee. If the target workload is already bound to NUMA nodes then thisfeature should be disabled. Otherwise, if the system overhead from thefeature is too high then the rate the kernel samples for NUMA hintingfaults may be controlled by the numa_balancing_scan_period_min_ms,numa_balancing_scan_delay_ms, numa_balancing_scan_period_max_ms,numa_balancing_scan_size_mb, and numa_balancing_settle_count sysctls. ============================================================== numa_balancing_scan_period_min_ms, numa_balancing_scan_delay_ms,numa_balancing_scan_period_max_ms, numa_balancing_scan_size_mb Automatic NUMA balancing scans tasks address space and unmaps pages todetect if pages are properly placed or if the data should be migrated to amemory node local to where the task is running. Every "scan delay" the taskscans the next "scan size" number of pages in its address space. When theend of the address space is reached the scanner restarts from the beginning. In combination, the "scan delay" and "scan size" determine the scan rate.When "scan delay" decreases, the scan rate increases. The scan delay andhence the scan rate of every task is adaptive and depends on historicalbehaviour. If pages are properly placed then the scan delay increases,otherwise the scan delay decreases. The "scan size" is not adaptive butthe higher the "scan size", the higher the scan rate. Higher scan rates incur higher system overhead as page faults must betrapped and potentially data must be migrated. However, the higher the scanLines 1–500 of 1032. Load more
Documentation for /proc/sys/kernel/* kernel version 2.2.10 (c) 1998, 1999, Rik van Riel <riel@nl.linux.org> (c) 2009, Shen Feng<shen@cn.fujitsu.com> For general info and legal blurb, please look in README. ============================================================== This file contains documentation for the sysctl files in /proc/sys/kernel/ and is valid for Linux kernel version 2.2. The files in this directory can be used to tune and monitor miscellaneous and general things in the operation of the Linux kernel. Since some of the files _can_ be used to screw up your system, it is advisable to read both documentation and source before actually making adjustments. Currently, these files might (depending on your configuration) show up in /proc/sys/kernel: - acct - acpi_video_flags - auto_msgmni - bootloader_type [ X86 only ] - bootloader_version [ X86 only ] - callhome [ S390 only ] - cap_last_cap - core_pattern - core_pipe_limit - core_uses_pid - ctrl-alt-del - dmesg_restrict - domainname - hostname - hotplug - hardlockup_all_cpu_backtrace - hung_task_panic - hung_task_check_count - hung_task_timeout_secs - hung_task_warnings - kexec_load_disabled - kptr_restrict - kstack_depth_to_print [ X86 only ] - l2cr [ PPC only ] - modprobe ==> Documentation/debugging-modules.txt - modules_disabled - msg_next_id [ sysv ipc ] - msgmax - msgmnb - msgmni - nmi_watchdog - osrelease - ostype - overflowgid - overflowuid - panic - panic_on_oops - panic_on_stackoverflow - panic_on_unrecovered_nmi - panic_on_warn - perf_cpu_time_max_percent - perf_event_paranoid - perf_event_max_stack - perf_event_max_contexts_per_stack - pid_max - powersave-nap [ PPC only ] - printk - printk_delay - printk_ratelimit - printk_ratelimit_burst - pty ==> Documentation/filesystems/devpts.txt - randomize_va_space - real-root-dev ==> Documentation/initrd.txt - reboot-cmd [ SPARC only ] - rtsig-max - rtsig-nr - sem - sem_next_id [ sysv ipc ] - sg-big-buff [ generic SCSI device (sg) ] - shm_next_id [ sysv ipc ] - shm_rmid_forced - shmall - shmmax [ sysv ipc ] - shmmni - softlockup_all_cpu_backtrace - soft_watchdog - stop-a [ SPARC only ] - sysrq ==> Documentation/sysrq.txt - sysctl_writes_strict - tainted - threads-max - unknown_nmi_panic - watchdog - watchdog_thresh - version ============================================================== acct: highwater lowwater frequency If BSD-style process accounting is enabled these values control its behaviour. If free space on filesystem where the log lives goes below <lowwater>% accounting suspends. If free space gets above <highwater>% accounting resumes. <Frequency> determines how often do we check the amount of free space (value is in seconds). Default: 4 2 30 That is, suspend accounting if there left <= 2% free; resume it if we got >=4%; consider information about amount of free space valid for 30 seconds. ============================================================== acpi_video_flags: flags See Doc*/kernel/power/video.txt, it allows mode of video boot to be set during run time. ============================================================== auto_msgmni: This variable has no effect and may be removed in future kernel releases. Reading it always returns 0. Up to Linux 3.17, it enabled/disabled automatic recomputing of msgmni upon memory add/remove or upon ipc namespace creation/removal. Echoing "1" into this file enabled msgmni automatic recomputing. Echoing "0" turned it off. auto_msgmni default value was 1. ============================================================== bootloader_type: x86 bootloader identification This gives the bootloader type number as indicated by the bootloader, shifted left by 4, and OR'd with the low four bits of the bootloader version. The reason for this encoding is that this used to match the type_of_loader field in the kernel header; the encoding is kept for backwards compatibility. That is, if the full bootloader type number is 0x15 and the full version number is 0x234, this file will contain the value 340 = 0x154. See the type_of_loader and ext_loader_type fields in Documentation/x86/boot.txt for additional information. ============================================================== bootloader_version: x86 bootloader version The complete bootloader version number. In the example above, this file will contain the value 564 = 0x234. See the type_of_loader and ext_loader_ver fields in Documentation/x86/boot.txt for additional information. ============================================================== callhome: Controls the kernel's callhome behavior in case of a kernel panic. The s390 hardware allows an operating system to send a notification to a service organization (callhome) in case of an operating system panic. When the value in this file is 0 (which is the default behavior) nothing happens in case of a kernel panic. If this value is set to "1" the complete kernel oops message is send to the IBM customer service organization in case the mainframe the Linux operating system is running on has a service contract with IBM. ============================================================== cap_last_cap Highest valid capability of the running kernel. Exports CAP_LAST_CAP from the kernel. ============================================================== core_pattern: core_pattern is used to specify a core dumpfile pattern name. . max length 128 characters; default value is "core" . core_pattern is used as a pattern template for the output filename; certain string patterns (beginning with '%') are substituted with their actual values. . backward compatibility with core_uses_pid: If core_pattern does not include "%p" (default does not) and core_uses_pid is set, then .PID will be appended to the filename. . corename format specifiers: %<NUL> '%' is dropped %% output one '%' %p pid %P global pid (init PID namespace) %i tid %I global tid (init PID namespace) %u uid (in initial user namespace) %g gid (in initial user namespace) %d dump mode, matches PR_SET_DUMPABLE and /proc/sys/fs/suid_dumpable %s signal number %t UNIX time of dump %h hostname %e executable filename (may be shortened) %E executable path %<OTHER> both are dropped . If the first character of the pattern is a '|', the kernel will treat the rest of the pattern as a command to run. The core dump will be written to the standard input of that program instead of to a file. ============================================================== core_pipe_limit: This sysctl is only applicable when core_pattern is configured to pipe core files to a user space helper (when the first character of core_pattern is a '|', see above). When collecting cores via a pipe to an application, it is occasionally useful for the collecting application to gather data about the crashing process from its /proc/pid directory. In order to do this safely, the kernel must wait for the collecting process to exit, so as not to remove the crashing processes proc files prematurely. This in turn creates the possibility that a misbehaving userspace collecting process can block the reaping of a crashed process simply by never exiting. This sysctl defends against that. It defines how many concurrent crashing processes may be piped to user space applications in parallel. If this value is exceeded, then those crashing processes above that value are noted via the kernel log and their cores are skipped. 0 is a special value, indicating that unlimited processes may be captured in parallel, but that no waiting will take place (i.e. the collecting process is not guaranteed access to /proc/<crashing pid>/). This value defaults to 0. ============================================================== core_uses_pid: The default coredump filename is "core". By setting core_uses_pid to 1, the coredump filename becomes core.PID. If core_pattern does not include "%p" (default does not) and core_uses_pid is set, then .PID will be appended to the filename. ============================================================== ctrl-alt-del: When the value in this file is 0, ctrl-alt-del is trapped and sent to the init(1) program to handle a graceful restart. When, however, the value is > 0, Linux's reaction to a Vulcan Nerve Pinch (tm) will be an immediate reboot, without even syncing its dirty buffers. Note: when a program (like dosemu) has the keyboard in 'raw' mode, the ctrl-alt-del is intercepted by the program before it ever reaches the kernel tty layer, and it's up to the program to decide what to do with it. ============================================================== dmesg_restrict: This toggle indicates whether unprivileged users are prevented from using dmesg(8) to view messages from the kernel's log buffer. When dmesg_restrict is set to (0) there are no restrictions. When dmesg_restrict is set set to (1), users must have CAP_SYSLOG to use dmesg(8). The kernel config option CONFIG_SECURITY_DMESG_RESTRICT sets the default value of dmesg_restrict. ============================================================== domainname & hostname: These files can be used to set the NIS/YP domainname and the hostname of your box in exactly the same way as the commands domainname and hostname, i.e.: # echo "darkstar" > /proc/sys/kernel/hostname # echo "mydomain" > /proc/sys/kernel/domainname has the same effect as # hostname "darkstar" # domainname "mydomain" Note, however, that the classic darkstar.frop.org has the hostname "darkstar" and DNS (Internet Domain Name Server) domainname "frop.org", not to be confused with the NIS (Network Information Service) or YP (Yellow Pages) domainname. These two domain names are in general different. For a detailed discussion see the hostname(1) man page. ============================================================== hardlockup_all_cpu_backtrace: This value controls the hard lockup detector behavior when a hard lockup condition is detected as to whether or not to gather further debug information. If enabled, arch-specific all-CPU stack dumping will be initiated. 0: do nothing. This is the default behavior. 1: on detection capture more debug information. ============================================================== hotplug: Path for the hotplug policy agent. Default value is "/sbin/hotplug". ============================================================== hung_task_panic: Controls the kernel's behavior when a hung task is detected. This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. 0: continue operation. This is the default behavior. 1: panic immediately. ============================================================== hung_task_check_count: The upper bound on the number of tasks that are checked. This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. ============================================================== hung_task_timeout_secs: Check interval. When a task in D state did not get scheduled for more than this value report a warning. This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. 0: means infinite timeout - no checking done. Possible values to set are in range {0..LONG_MAX/HZ}. ============================================================== hung_task_warnings: The maximum number of warnings to report. During a check interval if a hung task is detected, this value is decreased by 1. When this value reaches 0, no more warnings will be reported. This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. -1: report an infinite number of warnings. ============================================================== kexec_load_disabled: A toggle indicating if the kexec_load syscall has been disabled. This value defaults to 0 (false: kexec_load enabled), but can be set to 1 (true: kexec_load disabled). Once true, kexec can no longer be used, and the toggle cannot be set back to false. This allows a kexec image to be loaded before disabling the syscall, allowing a system to set up (and later use) an image without it being altered. Generally used together with the "modules_disabled" sysctl. ============================================================== kptr_restrict: This toggle indicates whether restrictions are placed on exposing kernel addresses via /proc and other interfaces. When kptr_restrict is set to (0), the default, there are no restrictions. When kptr_restrict is set to (1), kernel pointers printed using the %pK format specifier will be replaced with 0's unless the user has CAP_SYSLOG and effective user and group ids are equal to the real ids. This is because %pK checks are done at read() time rather than open() time, so if permissions are elevated between the open() and the read() (e.g via a setuid binary) then %pK will not leak kernel pointers to unprivileged users. Note, this is a temporary solution only. The correct long-term solution is to do the permission checks at open() time. Consider removing world read permissions from files that use %pK, and using dmesg_restrict to protect against uses of %pK in dmesg(8) if leaking kernel pointer values to unprivileged users is a concern. When kptr_restrict is set to (2), kernel pointers printed using %pK will be replaced with 0's regardless of privileges. ============================================================== kstack_depth_to_print: (X86 only) Controls the number of words to print when dumping the raw kernel stack. ============================================================== l2cr: (PPC only) This flag controls the L2 cache of G3 processor boards. If 0, the cache is disabled. Enabled if nonzero. ============================================================== modules_disabled: A toggle value indicating if modules are allowed to be loaded in an otherwise modular kernel. This toggle defaults to off (0), but can be set true (1). Once true, modules can be neither loaded nor unloaded, and the toggle cannot be set back to false. Generally used with the "kexec_load_disabled" toggle. ============================================================== msg_next_id, sem_next_id, and shm_next_id: These three toggles allows to specify desired id for next allocated IPC object: message, semaphore or shared memory respectively. By default they are equal to -1, which means generic allocation logic. Possible values to set are in range {0..INT_MAX}. Notes: 1) kernel doesn't guarantee, that new object will have desired id. So, it's up to userspace, how to handle an object with "wrong" id. 2) Toggle with non-default value will be set back to -1 by kernel after successful IPC object allocation. ============================================================== nmi_watchdog: This parameter can be used to control the NMI watchdog (i.e. the hard lockup detector) on x86 systems. 0 - disable the hard lockup detector 1 - enable the hard lockup detector The hard lockup detector monitors each CPU for its ability to respond to timer interrupts. The mechanism utilizes CPU performance counter registers that are programmed to generate Non-Maskable Interrupts (NMIs) periodically while a CPU is busy. Hence, the alternative name 'NMI watchdog'. The NMI watchdog is disabled by default if the kernel is running as a guest in a KVM virtual machine. This default can be overridden by adding nmi_watchdog=1 to the guest kernel command line (see Documentation/kernel-parameters.txt). ============================================================== numa_balancing Enables/disables automatic page fault based NUMA memory balancing. Memory is moved automatically to nodes that access it often. Enables/disables automatic NUMA memory balancing. On NUMA machines, there is a performance penalty if remote memory is accessed by a CPU. When this feature is enabled the kernel samples what task thread is accessing memory by periodically unmapping pages and later trapping a page fault. At the time of the page fault, it is determined if the data being accessed should be migrated to a local memory node. The unmapping of pages and trapping faults incur additional overhead that ideally is offset by improved memory locality but there is no universal guarantee. If the target workload is already bound to NUMA nodes then this feature should be disabled. Otherwise, if the system overhead from the feature is too high then the rate the kernel samples for NUMA hinting faults may be controlled by the numa_balancing_scan_period_min_ms, numa_balancing_scan_delay_ms, numa_balancing_scan_period_max_ms, numa_balancing_scan_size_mb, and numa_balancing_settle_count sysctls. ============================================================== numa_balancing_scan_period_min_ms, numa_balancing_scan_delay_ms, numa_balancing_scan_period_max_ms, numa_balancing_scan_size_mb Automatic NUMA balancing scans tasks address space and unmaps pages to detect if pages are properly placed or if the data should be migrated to a memory node local to where the task is running. Every "scan delay" the task scans the next "scan size" number of pages in its address space. When the end of the address space is reached the scanner restarts from the beginning. In combination, the "scan delay" and "scan size" determine the scan rate. When "scan delay" decreases, the scan rate increases. The scan delay and hence the scan rate of every task is adaptive and depends on historical behaviour. If pages are properly placed then the scan delay increases, otherwise the scan delay decreases. The "scan size" is not adaptive but the higher the "scan size", the higher the scan rate. Higher scan rates incur higher system overhead as page faults must be trapped and potentially data must be migrated. However, the higher the scan