Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | Documentation for /proc/sys/kernel/* kernel version 2.2.10 |
| 2 | (c) 1998, 1999, Rik van Riel <riel@nl.linux.org> |
Shen Feng | 760df93 | 2009-04-02 16:57:20 -0700 | [diff] [blame] | 3 | (c) 2009, Shen Feng<shen@cn.fujitsu.com> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 4 | |
| 5 | For general info and legal blurb, please look in README. |
| 6 | |
| 7 | ============================================================== |
| 8 | |
| 9 | This file contains documentation for the sysctl files in |
| 10 | /proc/sys/kernel/ and is valid for Linux kernel version 2.2. |
| 11 | |
| 12 | The files in this directory can be used to tune and monitor |
| 13 | miscellaneous and general things in the operation of the Linux |
| 14 | kernel. Since some of the files _can_ be used to screw up your |
| 15 | system, it is advisable to read both documentation and source |
| 16 | before actually making adjustments. |
| 17 | |
| 18 | Currently, these files might (depending on your configuration) |
| 19 | show up in /proc/sys/kernel: |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 20 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 21 | - acct |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 22 | - acpi_video_flags |
| 23 | - auto_msgmni |
H. Peter Anvin | d75757a | 2009-12-11 14:23:44 -0800 | [diff] [blame] | 24 | - bootloader_type [ X86 only ] |
| 25 | - bootloader_version [ X86 only ] |
Hans-Joachim Picht | c114728a | 2009-09-11 10:28:47 +0200 | [diff] [blame] | 26 | - callhome [ S390 only ] |
Dan Ballard | 73efc03 | 2011-10-31 17:11:20 -0700 | [diff] [blame] | 27 | - cap_last_cap |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 28 | - core_pattern |
Neil Horman | a293980 | 2009-09-23 15:56:56 -0700 | [diff] [blame] | 29 | - core_pipe_limit |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 30 | - core_uses_pid |
| 31 | - ctrl-alt-del |
Dan Rosenberg | eaf06b2 | 2010-11-11 14:05:18 -0800 | [diff] [blame] | 32 | - dmesg_restrict |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 33 | - domainname |
| 34 | - hostname |
| 35 | - hotplug |
Jiri Kosina | 5553787 | 2015-11-05 18:44:41 -0800 | [diff] [blame] | 36 | - hardlockup_all_cpu_backtrace |
Aaron Tomlin | 270750db | 2014-01-20 17:34:13 +0000 | [diff] [blame] | 37 | - hung_task_panic |
| 38 | - hung_task_check_count |
| 39 | - hung_task_timeout_secs |
| 40 | - hung_task_warnings |
Kees Cook | 7984754 | 2014-01-23 15:55:59 -0800 | [diff] [blame] | 41 | - kexec_load_disabled |
Dan Rosenberg | 455cd5a | 2011-01-12 16:59:41 -0800 | [diff] [blame] | 42 | - kptr_restrict |
Chuck Ebbert | 0741f4d | 2006-12-07 02:14:11 +0100 | [diff] [blame] | 43 | - kstack_depth_to_print [ X86 only ] |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 44 | - l2cr [ PPC only ] |
Michael Opdenacker | ac76cff | 2008-02-13 15:03:32 -0800 | [diff] [blame] | 45 | - modprobe ==> Documentation/debugging-modules.txt |
Kees Cook | 3d43321 | 2009-04-02 15:49:29 -0700 | [diff] [blame] | 46 | - modules_disabled |
Stanislav Kinsbursky | 03f5956 | 2013-01-04 15:34:50 -0800 | [diff] [blame] | 47 | - msg_next_id [ sysv ipc ] |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 48 | - msgmax |
| 49 | - msgmnb |
| 50 | - msgmni |
Shen Feng | 760df93 | 2009-04-02 16:57:20 -0700 | [diff] [blame] | 51 | - nmi_watchdog |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 52 | - osrelease |
| 53 | - ostype |
| 54 | - overflowgid |
| 55 | - overflowuid |
| 56 | - panic |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 57 | - panic_on_oops |
Mitsuo Hayasaka | 55af779 | 2011-11-29 15:08:36 +0900 | [diff] [blame] | 58 | - panic_on_stackoverflow |
Prarit Bhargava | 9e3961a | 2014-12-10 15:45:50 -0800 | [diff] [blame] | 59 | - panic_on_unrecovered_nmi |
| 60 | - panic_on_warn |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 61 | - pid_max |
| 62 | - powersave-nap [ PPC only ] |
| 63 | - printk |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 64 | - printk_delay |
| 65 | - printk_ratelimit |
| 66 | - printk_ratelimit_burst |
Jiri Kosina | 1ec7fd5 | 2008-02-09 23:24:08 +0100 | [diff] [blame] | 67 | - randomize_va_space |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 68 | - real-root-dev ==> Documentation/initrd.txt |
| 69 | - reboot-cmd [ SPARC only ] |
| 70 | - rtsig-max |
| 71 | - rtsig-nr |
| 72 | - sem |
Stanislav Kinsbursky | 03f5956 | 2013-01-04 15:34:50 -0800 | [diff] [blame] | 73 | - sem_next_id [ sysv ipc ] |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 74 | - sg-big-buff [ generic SCSI device (sg) ] |
Stanislav Kinsbursky | 03f5956 | 2013-01-04 15:34:50 -0800 | [diff] [blame] | 75 | - shm_next_id [ sysv ipc ] |
Vasiliy Kulikov | b34a6b1 | 2011-07-26 16:08:48 -0700 | [diff] [blame] | 76 | - shm_rmid_forced |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 77 | - shmall |
| 78 | - shmmax [ sysv ipc ] |
| 79 | - shmmni |
Aaron Tomlin | ed23587 | 2014-06-23 13:22:05 -0700 | [diff] [blame] | 80 | - softlockup_all_cpu_backtrace |
Ulrich Obergfell | 195daf6 | 2015-04-14 15:44:13 -0700 | [diff] [blame] | 81 | - soft_watchdog |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 82 | - stop-a [ SPARC only ] |
| 83 | - sysrq ==> Documentation/sysrq.txt |
Kees Cook | f4aacea | 2014-06-06 14:37:19 -0700 | [diff] [blame] | 84 | - sysctl_writes_strict |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 85 | - tainted |
| 86 | - threads-max |
Shen Feng | 760df93 | 2009-04-02 16:57:20 -0700 | [diff] [blame] | 87 | - unknown_nmi_panic |
Ulrich Obergfell | 195daf6 | 2015-04-14 15:44:13 -0700 | [diff] [blame] | 88 | - watchdog |
Li Zefan | 08825c9 | 2013-05-17 10:31:20 +0800 | [diff] [blame] | 89 | - watchdog_thresh |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 90 | - version |
| 91 | |
| 92 | ============================================================== |
| 93 | |
| 94 | acct: |
| 95 | |
| 96 | highwater lowwater frequency |
| 97 | |
| 98 | If BSD-style process accounting is enabled these values control |
| 99 | its behaviour. If free space on filesystem where the log lives |
| 100 | goes below <lowwater>% accounting suspends. If free space gets |
| 101 | above <highwater>% accounting resumes. <Frequency> determines |
| 102 | how often do we check the amount of free space (value is in |
| 103 | seconds). Default: |
| 104 | 4 2 30 |
| 105 | That is, suspend accounting if there left <= 2% free; resume it |
| 106 | if we got >=4%; consider information about amount of free space |
| 107 | valid for 30 seconds. |
| 108 | |
| 109 | ============================================================== |
| 110 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 111 | acpi_video_flags: |
| 112 | |
| 113 | flags |
| 114 | |
| 115 | See Doc*/kernel/power/video.txt, it allows mode of video boot to be |
| 116 | set during run time. |
| 117 | |
| 118 | ============================================================== |
| 119 | |
| 120 | auto_msgmni: |
| 121 | |
Manfred Spraul | 0050ee0 | 2014-12-12 16:58:17 -0800 | [diff] [blame] | 122 | This variable has no effect and may be removed in future kernel |
| 123 | releases. Reading it always returns 0. |
| 124 | Up to Linux 3.17, it enabled/disabled automatic recomputing of msgmni |
| 125 | upon memory add/remove or upon ipc namespace creation/removal. |
| 126 | Echoing "1" into this file enabled msgmni automatic recomputing. |
| 127 | Echoing "0" turned it off. auto_msgmni default value was 1. |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 128 | |
| 129 | |
| 130 | ============================================================== |
| 131 | |
H. Peter Anvin | d75757a | 2009-12-11 14:23:44 -0800 | [diff] [blame] | 132 | bootloader_type: |
| 133 | |
| 134 | x86 bootloader identification |
| 135 | |
| 136 | This gives the bootloader type number as indicated by the bootloader, |
| 137 | shifted left by 4, and OR'd with the low four bits of the bootloader |
| 138 | version. The reason for this encoding is that this used to match the |
| 139 | type_of_loader field in the kernel header; the encoding is kept for |
| 140 | backwards compatibility. That is, if the full bootloader type number |
| 141 | is 0x15 and the full version number is 0x234, this file will contain |
| 142 | the value 340 = 0x154. |
| 143 | |
| 144 | See the type_of_loader and ext_loader_type fields in |
| 145 | Documentation/x86/boot.txt for additional information. |
| 146 | |
| 147 | ============================================================== |
| 148 | |
| 149 | bootloader_version: |
| 150 | |
| 151 | x86 bootloader version |
| 152 | |
| 153 | The complete bootloader version number. In the example above, this |
| 154 | file will contain the value 564 = 0x234. |
| 155 | |
| 156 | See the type_of_loader and ext_loader_ver fields in |
| 157 | Documentation/x86/boot.txt for additional information. |
| 158 | |
| 159 | ============================================================== |
| 160 | |
Hans-Joachim Picht | c114728a | 2009-09-11 10:28:47 +0200 | [diff] [blame] | 161 | callhome: |
| 162 | |
| 163 | Controls the kernel's callhome behavior in case of a kernel panic. |
| 164 | |
| 165 | The s390 hardware allows an operating system to send a notification |
| 166 | to a service organization (callhome) in case of an operating system panic. |
| 167 | |
| 168 | When the value in this file is 0 (which is the default behavior) |
| 169 | nothing happens in case of a kernel panic. If this value is set to "1" |
| 170 | the complete kernel oops message is send to the IBM customer service |
| 171 | organization in case the mainframe the Linux operating system is running |
| 172 | on has a service contract with IBM. |
| 173 | |
| 174 | ============================================================== |
| 175 | |
Dan Ballard | 73efc03 | 2011-10-31 17:11:20 -0700 | [diff] [blame] | 176 | cap_last_cap |
| 177 | |
| 178 | Highest valid capability of the running kernel. Exports |
| 179 | CAP_LAST_CAP from the kernel. |
| 180 | |
| 181 | ============================================================== |
| 182 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 183 | core_pattern: |
| 184 | |
| 185 | core_pattern is used to specify a core dumpfile pattern name. |
Matthias Urlichs | cd08104 | 2006-10-11 01:21:57 -0700 | [diff] [blame] | 186 | . max length 128 characters; default value is "core" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 187 | . core_pattern is used as a pattern template for the output filename; |
| 188 | certain string patterns (beginning with '%') are substituted with |
| 189 | their actual values. |
| 190 | . backward compatibility with core_uses_pid: |
| 191 | If core_pattern does not include "%p" (default does not) |
| 192 | and core_uses_pid is set, then .PID will be appended to |
| 193 | the filename. |
| 194 | . corename format specifiers: |
| 195 | %<NUL> '%' is dropped |
| 196 | %% output one '%' |
| 197 | %p pid |
Stéphane Graber | 65aafb1 | 2013-09-11 14:24:32 -0700 | [diff] [blame] | 198 | %P global pid (init PID namespace) |
Oleg Nesterov | b03023e | 2014-10-13 15:53:35 -0700 | [diff] [blame] | 199 | %i tid |
| 200 | %I global tid (init PID namespace) |
Nicolas Iooss | 5202efe | 2015-06-25 15:03:51 -0700 | [diff] [blame] | 201 | %u uid (in initial user namespace) |
| 202 | %g gid (in initial user namespace) |
Oleg Nesterov | 12a2b4b | 2012-10-04 17:15:25 -0700 | [diff] [blame] | 203 | %d dump mode, matches PR_SET_DUMPABLE and |
| 204 | /proc/sys/fs/suid_dumpable |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 205 | %s signal number |
| 206 | %t UNIX time of dump |
| 207 | %h hostname |
Jiri Slaby | 57cc083 | 2011-05-26 16:25:46 -0700 | [diff] [blame] | 208 | %e executable filename (may be shortened) |
| 209 | %E executable path |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 210 | %<OTHER> both are dropped |
Matthias Urlichs | cd08104 | 2006-10-11 01:21:57 -0700 | [diff] [blame] | 211 | . If the first character of the pattern is a '|', the kernel will treat |
| 212 | the rest of the pattern as a command to run. The core dump will be |
| 213 | written to the standard input of that program instead of to a file. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 214 | |
| 215 | ============================================================== |
| 216 | |
Neil Horman | a293980 | 2009-09-23 15:56:56 -0700 | [diff] [blame] | 217 | core_pipe_limit: |
| 218 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 219 | This sysctl is only applicable when core_pattern is configured to pipe |
| 220 | core files to a user space helper (when the first character of |
| 221 | core_pattern is a '|', see above). When collecting cores via a pipe |
| 222 | to an application, it is occasionally useful for the collecting |
| 223 | application to gather data about the crashing process from its |
| 224 | /proc/pid directory. In order to do this safely, the kernel must wait |
| 225 | for the collecting process to exit, so as not to remove the crashing |
| 226 | processes proc files prematurely. This in turn creates the |
| 227 | possibility that a misbehaving userspace collecting process can block |
| 228 | the reaping of a crashed process simply by never exiting. This sysctl |
| 229 | defends against that. It defines how many concurrent crashing |
| 230 | processes may be piped to user space applications in parallel. If |
| 231 | this value is exceeded, then those crashing processes above that value |
| 232 | are noted via the kernel log and their cores are skipped. 0 is a |
| 233 | special value, indicating that unlimited processes may be captured in |
| 234 | parallel, but that no waiting will take place (i.e. the collecting |
| 235 | process is not guaranteed access to /proc/<crashing pid>/). This |
| 236 | value defaults to 0. |
Neil Horman | a293980 | 2009-09-23 15:56:56 -0700 | [diff] [blame] | 237 | |
| 238 | ============================================================== |
| 239 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 240 | core_uses_pid: |
| 241 | |
| 242 | The default coredump filename is "core". By setting |
| 243 | core_uses_pid to 1, the coredump filename becomes core.PID. |
| 244 | If core_pattern does not include "%p" (default does not) |
| 245 | and core_uses_pid is set, then .PID will be appended to |
| 246 | the filename. |
| 247 | |
| 248 | ============================================================== |
| 249 | |
| 250 | ctrl-alt-del: |
| 251 | |
| 252 | When the value in this file is 0, ctrl-alt-del is trapped and |
| 253 | sent to the init(1) program to handle a graceful restart. |
| 254 | When, however, the value is > 0, Linux's reaction to a Vulcan |
| 255 | Nerve Pinch (tm) will be an immediate reboot, without even |
| 256 | syncing its dirty buffers. |
| 257 | |
| 258 | Note: when a program (like dosemu) has the keyboard in 'raw' |
| 259 | mode, the ctrl-alt-del is intercepted by the program before it |
| 260 | ever reaches the kernel tty layer, and it's up to the program |
| 261 | to decide what to do with it. |
| 262 | |
| 263 | ============================================================== |
| 264 | |
Dan Rosenberg | eaf06b2 | 2010-11-11 14:05:18 -0800 | [diff] [blame] | 265 | dmesg_restrict: |
| 266 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 267 | This toggle indicates whether unprivileged users are prevented |
| 268 | from using dmesg(8) to view messages from the kernel's log buffer. |
| 269 | When dmesg_restrict is set to (0) there are no restrictions. When |
Serge E. Hallyn | 38ef4c2 | 2010-12-08 15:19:01 +0000 | [diff] [blame] | 270 | dmesg_restrict is set set to (1), users must have CAP_SYSLOG to use |
Dan Rosenberg | eaf06b2 | 2010-11-11 14:05:18 -0800 | [diff] [blame] | 271 | dmesg(8). |
| 272 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 273 | The kernel config option CONFIG_SECURITY_DMESG_RESTRICT sets the |
| 274 | default value of dmesg_restrict. |
Dan Rosenberg | eaf06b2 | 2010-11-11 14:05:18 -0800 | [diff] [blame] | 275 | |
| 276 | ============================================================== |
| 277 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 278 | domainname & hostname: |
| 279 | |
| 280 | These files can be used to set the NIS/YP domainname and the |
| 281 | hostname of your box in exactly the same way as the commands |
| 282 | domainname and hostname, i.e.: |
| 283 | # echo "darkstar" > /proc/sys/kernel/hostname |
| 284 | # echo "mydomain" > /proc/sys/kernel/domainname |
| 285 | has the same effect as |
| 286 | # hostname "darkstar" |
| 287 | # domainname "mydomain" |
| 288 | |
| 289 | Note, however, that the classic darkstar.frop.org has the |
| 290 | hostname "darkstar" and DNS (Internet Domain Name Server) |
| 291 | domainname "frop.org", not to be confused with the NIS (Network |
| 292 | Information Service) or YP (Yellow Pages) domainname. These two |
| 293 | domain names are in general different. For a detailed discussion |
| 294 | see the hostname(1) man page. |
| 295 | |
| 296 | ============================================================== |
Jiri Kosina | 5553787 | 2015-11-05 18:44:41 -0800 | [diff] [blame] | 297 | hardlockup_all_cpu_backtrace: |
| 298 | |
| 299 | This value controls the hard lockup detector behavior when a hard |
| 300 | lockup condition is detected as to whether or not to gather further |
| 301 | debug information. If enabled, arch-specific all-CPU stack dumping |
| 302 | will be initiated. |
| 303 | |
| 304 | 0: do nothing. This is the default behavior. |
| 305 | |
| 306 | 1: on detection capture more debug information. |
| 307 | ============================================================== |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 308 | |
| 309 | hotplug: |
| 310 | |
| 311 | Path for the hotplug policy agent. |
| 312 | Default value is "/sbin/hotplug". |
| 313 | |
| 314 | ============================================================== |
| 315 | |
Aaron Tomlin | 270750db | 2014-01-20 17:34:13 +0000 | [diff] [blame] | 316 | hung_task_panic: |
| 317 | |
| 318 | Controls the kernel's behavior when a hung task is detected. |
| 319 | This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. |
| 320 | |
| 321 | 0: continue operation. This is the default behavior. |
| 322 | |
| 323 | 1: panic immediately. |
| 324 | |
| 325 | ============================================================== |
| 326 | |
| 327 | hung_task_check_count: |
| 328 | |
| 329 | The upper bound on the number of tasks that are checked. |
| 330 | This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. |
| 331 | |
| 332 | ============================================================== |
| 333 | |
| 334 | hung_task_timeout_secs: |
| 335 | |
| 336 | Check interval. When a task in D state did not get scheduled |
| 337 | for more than this value report a warning. |
| 338 | This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. |
| 339 | |
| 340 | 0: means infinite timeout - no checking done. |
Liu Hua | 80df284 | 2014-04-07 15:38:57 -0700 | [diff] [blame] | 341 | Possible values to set are in range {0..LONG_MAX/HZ}. |
Aaron Tomlin | 270750db | 2014-01-20 17:34:13 +0000 | [diff] [blame] | 342 | |
| 343 | ============================================================== |
| 344 | |
Aaron Tomlin | 70e0ac5 | 2014-01-27 09:00:57 +0000 | [diff] [blame] | 345 | hung_task_warnings: |
Aaron Tomlin | 270750db | 2014-01-20 17:34:13 +0000 | [diff] [blame] | 346 | |
| 347 | The maximum number of warnings to report. During a check interval |
Aaron Tomlin | 70e0ac5 | 2014-01-27 09:00:57 +0000 | [diff] [blame] | 348 | if a hung task is detected, this value is decreased by 1. |
| 349 | When this value reaches 0, no more warnings will be reported. |
Aaron Tomlin | 270750db | 2014-01-20 17:34:13 +0000 | [diff] [blame] | 350 | This file shows up if CONFIG_DETECT_HUNG_TASK is enabled. |
| 351 | |
| 352 | -1: report an infinite number of warnings. |
| 353 | |
| 354 | ============================================================== |
| 355 | |
Kees Cook | 7984754 | 2014-01-23 15:55:59 -0800 | [diff] [blame] | 356 | kexec_load_disabled: |
| 357 | |
| 358 | A toggle indicating if the kexec_load syscall has been disabled. This |
| 359 | value defaults to 0 (false: kexec_load enabled), but can be set to 1 |
| 360 | (true: kexec_load disabled). Once true, kexec can no longer be used, and |
| 361 | the toggle cannot be set back to false. This allows a kexec image to be |
| 362 | loaded before disabling the syscall, allowing a system to set up (and |
| 363 | later use) an image without it being altered. Generally used together |
| 364 | with the "modules_disabled" sysctl. |
| 365 | |
| 366 | ============================================================== |
| 367 | |
Dan Rosenberg | 455cd5a | 2011-01-12 16:59:41 -0800 | [diff] [blame] | 368 | kptr_restrict: |
| 369 | |
| 370 | This toggle indicates whether restrictions are placed on |
Ryan Mallon | 312b4e2 | 2013-11-12 15:08:51 -0800 | [diff] [blame] | 371 | exposing kernel addresses via /proc and other interfaces. |
| 372 | |
| 373 | When kptr_restrict is set to (0), the default, there are no restrictions. |
| 374 | |
| 375 | When kptr_restrict is set to (1), kernel pointers printed using the %pK |
| 376 | format specifier will be replaced with 0's unless the user has CAP_SYSLOG |
| 377 | and effective user and group ids are equal to the real ids. This is |
| 378 | because %pK checks are done at read() time rather than open() time, so |
| 379 | if permissions are elevated between the open() and the read() (e.g via |
| 380 | a setuid binary) then %pK will not leak kernel pointers to unprivileged |
| 381 | users. Note, this is a temporary solution only. The correct long-term |
| 382 | solution is to do the permission checks at open() time. Consider removing |
| 383 | world read permissions from files that use %pK, and using dmesg_restrict |
| 384 | to protect against uses of %pK in dmesg(8) if leaking kernel pointer |
| 385 | values to unprivileged users is a concern. |
| 386 | |
| 387 | When kptr_restrict is set to (2), kernel pointers printed using |
| 388 | %pK will be replaced with 0's regardless of privileges. |
Dan Rosenberg | 455cd5a | 2011-01-12 16:59:41 -0800 | [diff] [blame] | 389 | |
| 390 | ============================================================== |
| 391 | |
Chuck Ebbert | 0741f4d | 2006-12-07 02:14:11 +0100 | [diff] [blame] | 392 | kstack_depth_to_print: (X86 only) |
| 393 | |
| 394 | Controls the number of words to print when dumping the raw |
| 395 | kernel stack. |
| 396 | |
| 397 | ============================================================== |
| 398 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 399 | l2cr: (PPC only) |
| 400 | |
| 401 | This flag controls the L2 cache of G3 processor boards. If |
| 402 | 0, the cache is disabled. Enabled if nonzero. |
| 403 | |
| 404 | ============================================================== |
| 405 | |
Kees Cook | 3d43321 | 2009-04-02 15:49:29 -0700 | [diff] [blame] | 406 | modules_disabled: |
| 407 | |
| 408 | A toggle value indicating if modules are allowed to be loaded |
| 409 | in an otherwise modular kernel. This toggle defaults to off |
| 410 | (0), but can be set true (1). Once true, modules can be |
| 411 | neither loaded nor unloaded, and the toggle cannot be set back |
Kees Cook | 7984754 | 2014-01-23 15:55:59 -0800 | [diff] [blame] | 412 | to false. Generally used with the "kexec_load_disabled" toggle. |
Kees Cook | 3d43321 | 2009-04-02 15:49:29 -0700 | [diff] [blame] | 413 | |
| 414 | ============================================================== |
| 415 | |
Stanislav Kinsbursky | 03f5956 | 2013-01-04 15:34:50 -0800 | [diff] [blame] | 416 | msg_next_id, sem_next_id, and shm_next_id: |
| 417 | |
| 418 | These three toggles allows to specify desired id for next allocated IPC |
| 419 | object: message, semaphore or shared memory respectively. |
| 420 | |
| 421 | By default they are equal to -1, which means generic allocation logic. |
| 422 | Possible values to set are in range {0..INT_MAX}. |
| 423 | |
| 424 | Notes: |
| 425 | 1) kernel doesn't guarantee, that new object will have desired id. So, |
| 426 | it's up to userspace, how to handle an object with "wrong" id. |
| 427 | 2) Toggle with non-default value will be set back to -1 by kernel after |
| 428 | successful IPC object allocation. |
| 429 | |
| 430 | ============================================================== |
| 431 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 432 | nmi_watchdog: |
| 433 | |
Ulrich Obergfell | 195daf6 | 2015-04-14 15:44:13 -0700 | [diff] [blame] | 434 | This parameter can be used to control the NMI watchdog |
| 435 | (i.e. the hard lockup detector) on x86 systems. |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 436 | |
Ulrich Obergfell | 195daf6 | 2015-04-14 15:44:13 -0700 | [diff] [blame] | 437 | 0 - disable the hard lockup detector |
| 438 | 1 - enable the hard lockup detector |
| 439 | |
| 440 | The hard lockup detector monitors each CPU for its ability to respond to |
| 441 | timer interrupts. The mechanism utilizes CPU performance counter registers |
| 442 | that are programmed to generate Non-Maskable Interrupts (NMIs) periodically |
| 443 | while a CPU is busy. Hence, the alternative name 'NMI watchdog'. |
| 444 | |
| 445 | The NMI watchdog is disabled by default if the kernel is running as a guest |
| 446 | in a KVM virtual machine. This default can be overridden by adding |
| 447 | |
| 448 | nmi_watchdog=1 |
| 449 | |
| 450 | to the guest kernel command line (see Documentation/kernel-parameters.txt). |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 451 | |
| 452 | ============================================================== |
| 453 | |
Mel Gorman | 10fc05d | 2013-10-07 11:28:40 +0100 | [diff] [blame] | 454 | numa_balancing |
| 455 | |
| 456 | Enables/disables automatic page fault based NUMA memory |
| 457 | balancing. Memory is moved automatically to nodes |
| 458 | that access it often. |
| 459 | |
| 460 | Enables/disables automatic NUMA memory balancing. On NUMA machines, there |
| 461 | is a performance penalty if remote memory is accessed by a CPU. When this |
| 462 | feature is enabled the kernel samples what task thread is accessing memory |
| 463 | by periodically unmapping pages and later trapping a page fault. At the |
| 464 | time of the page fault, it is determined if the data being accessed should |
| 465 | be migrated to a local memory node. |
| 466 | |
| 467 | The unmapping of pages and trapping faults incur additional overhead that |
| 468 | ideally is offset by improved memory locality but there is no universal |
| 469 | guarantee. If the target workload is already bound to NUMA nodes then this |
| 470 | feature should be disabled. Otherwise, if the system overhead from the |
| 471 | feature is too high then the rate the kernel samples for NUMA hinting |
| 472 | faults may be controlled by the numa_balancing_scan_period_min_ms, |
Mel Gorman | 930aa17 | 2013-10-07 11:29:37 +0100 | [diff] [blame] | 473 | numa_balancing_scan_delay_ms, numa_balancing_scan_period_max_ms, |
Rik van Riel | 52bf84a | 2014-01-27 17:03:40 -0500 | [diff] [blame] | 474 | numa_balancing_scan_size_mb, and numa_balancing_settle_count sysctls. |
Mel Gorman | 10fc05d | 2013-10-07 11:28:40 +0100 | [diff] [blame] | 475 | |
| 476 | ============================================================== |
| 477 | |
| 478 | numa_balancing_scan_period_min_ms, numa_balancing_scan_delay_ms, |
Mel Gorman | 930aa17 | 2013-10-07 11:29:37 +0100 | [diff] [blame] | 479 | numa_balancing_scan_period_max_ms, numa_balancing_scan_size_mb |
Mel Gorman | 10fc05d | 2013-10-07 11:28:40 +0100 | [diff] [blame] | 480 | |
| 481 | Automatic NUMA balancing scans tasks address space and unmaps pages to |
| 482 | detect if pages are properly placed or if the data should be migrated to a |
| 483 | memory node local to where the task is running. Every "scan delay" the task |
| 484 | scans the next "scan size" number of pages in its address space. When the |
| 485 | end of the address space is reached the scanner restarts from the beginning. |
| 486 | |
| 487 | In combination, the "scan delay" and "scan size" determine the scan rate. |
| 488 | When "scan delay" decreases, the scan rate increases. The scan delay and |
| 489 | hence the scan rate of every task is adaptive and depends on historical |
| 490 | behaviour. If pages are properly placed then the scan delay increases, |
| 491 | otherwise the scan delay decreases. The "scan size" is not adaptive but |
| 492 | the higher the "scan size", the higher the scan rate. |
| 493 | |
| 494 | Higher scan rates incur higher system overhead as page faults must be |
| 495 | trapped and potentially data must be migrated. However, the higher the scan |
| 496 | rate, the more quickly a tasks memory is migrated to a local node if the |
| 497 | workload pattern changes and minimises performance impact due to remote |
| 498 | memory accesses. These sysctls control the thresholds for scan delays and |
| 499 | the number of pages scanned. |
| 500 | |
Mel Gorman | 598f0ec | 2013-10-07 11:28:55 +0100 | [diff] [blame] | 501 | numa_balancing_scan_period_min_ms is the minimum time in milliseconds to |
| 502 | scan a tasks virtual memory. It effectively controls the maximum scanning |
| 503 | rate for each task. |
Mel Gorman | 10fc05d | 2013-10-07 11:28:40 +0100 | [diff] [blame] | 504 | |
| 505 | numa_balancing_scan_delay_ms is the starting "scan delay" used for a task |
| 506 | when it initially forks. |
| 507 | |
Mel Gorman | 598f0ec | 2013-10-07 11:28:55 +0100 | [diff] [blame] | 508 | numa_balancing_scan_period_max_ms is the maximum time in milliseconds to |
| 509 | scan a tasks virtual memory. It effectively controls the minimum scanning |
| 510 | rate for each task. |
Mel Gorman | 10fc05d | 2013-10-07 11:28:40 +0100 | [diff] [blame] | 511 | |
| 512 | numa_balancing_scan_size_mb is how many megabytes worth of pages are |
| 513 | scanned for a given scan. |
| 514 | |
Mel Gorman | 10fc05d | 2013-10-07 11:28:40 +0100 | [diff] [blame] | 515 | ============================================================== |
| 516 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 517 | osrelease, ostype & version: |
| 518 | |
| 519 | # cat osrelease |
| 520 | 2.1.88 |
| 521 | # cat ostype |
| 522 | Linux |
| 523 | # cat version |
| 524 | #5 Wed Feb 25 21:49:24 MET 1998 |
| 525 | |
| 526 | The files osrelease and ostype should be clear enough. Version |
| 527 | needs a little more clarification however. The '#5' means that |
| 528 | this is the fifth kernel built from this source base and the |
| 529 | date behind it indicates the time the kernel was built. |
| 530 | The only way to tune these values is to rebuild the kernel :-) |
| 531 | |
| 532 | ============================================================== |
| 533 | |
| 534 | overflowgid & overflowuid: |
| 535 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 536 | if your architecture did not always support 32-bit UIDs (i.e. arm, |
| 537 | i386, m68k, sh, and sparc32), a fixed UID and GID will be returned to |
| 538 | applications that use the old 16-bit UID/GID system calls, if the |
| 539 | actual UID or GID would exceed 65535. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 540 | |
| 541 | These sysctls allow you to change the value of the fixed UID and GID. |
| 542 | The default is 65534. |
| 543 | |
| 544 | ============================================================== |
| 545 | |
| 546 | panic: |
| 547 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 548 | The value in this file represents the number of seconds the kernel |
| 549 | waits before rebooting on a panic. When you use the software watchdog, |
| 550 | the recommended setting is 60. |
| 551 | |
| 552 | ============================================================== |
| 553 | |
Hidehiro Kawai | 9f318e3 | 2015-12-14 11:19:14 +0100 | [diff] [blame] | 554 | panic_on_io_nmi: |
| 555 | |
| 556 | Controls the kernel's behavior when a CPU receives an NMI caused by |
| 557 | an IO error. |
| 558 | |
| 559 | 0: try to continue operation (default) |
| 560 | |
| 561 | 1: panic immediately. The IO error triggered an NMI. This indicates a |
| 562 | serious system condition which could result in IO data corruption. |
| 563 | Rather than continuing, panicking might be a better choice. Some |
| 564 | servers issue this sort of NMI when the dump button is pushed, |
| 565 | and you can use this option to take a crash dump. |
| 566 | |
| 567 | ============================================================== |
| 568 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 569 | panic_on_oops: |
| 570 | |
| 571 | Controls the kernel's behaviour when an oops or BUG is encountered. |
| 572 | |
| 573 | 0: try to continue operation |
| 574 | |
Matt LaPlante | a982ac0 | 2007-05-09 07:35:06 +0200 | [diff] [blame] | 575 | 1: panic immediately. If the `panic' sysctl is also non-zero then the |
Maxime Bizon | 8b23d04d | 2006-08-05 12:14:32 -0700 | [diff] [blame] | 576 | machine will be rebooted. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 577 | |
| 578 | ============================================================== |
| 579 | |
Mitsuo Hayasaka | 55af779 | 2011-11-29 15:08:36 +0900 | [diff] [blame] | 580 | panic_on_stackoverflow: |
| 581 | |
| 582 | Controls the kernel's behavior when detecting the overflows of |
| 583 | kernel, IRQ and exception stacks except a user stack. |
| 584 | This file shows up if CONFIG_DEBUG_STACKOVERFLOW is enabled. |
| 585 | |
| 586 | 0: try to continue operation. |
| 587 | |
| 588 | 1: panic immediately. |
| 589 | |
| 590 | ============================================================== |
| 591 | |
Prarit Bhargava | 9e3961a | 2014-12-10 15:45:50 -0800 | [diff] [blame] | 592 | panic_on_unrecovered_nmi: |
| 593 | |
| 594 | The default Linux behaviour on an NMI of either memory or unknown is |
| 595 | to continue operation. For many environments such as scientific |
| 596 | computing it is preferable that the box is taken out and the error |
| 597 | dealt with than an uncorrected parity/ECC error get propagated. |
| 598 | |
| 599 | A small number of systems do generate NMI's for bizarre random reasons |
| 600 | such as power management so the default is off. That sysctl works like |
| 601 | the existing panic controls already in that directory. |
| 602 | |
| 603 | ============================================================== |
| 604 | |
| 605 | panic_on_warn: |
| 606 | |
| 607 | Calls panic() in the WARN() path when set to 1. This is useful to avoid |
| 608 | a kernel rebuild when attempting to kdump at the location of a WARN(). |
| 609 | |
| 610 | 0: only WARN(), default behaviour. |
| 611 | |
| 612 | 1: call panic() after printing out WARN() location. |
| 613 | |
| 614 | ============================================================== |
| 615 | |
Dave Hansen | 14c63f1 | 2013-06-21 08:51:36 -0700 | [diff] [blame] | 616 | perf_cpu_time_max_percent: |
| 617 | |
| 618 | Hints to the kernel how much CPU time it should be allowed to |
| 619 | use to handle perf sampling events. If the perf subsystem |
| 620 | is informed that its samples are exceeding this limit, it |
| 621 | will drop its sampling frequency to attempt to reduce its CPU |
| 622 | usage. |
| 623 | |
| 624 | Some perf sampling happens in NMIs. If these samples |
| 625 | unexpectedly take too long to execute, the NMIs can become |
| 626 | stacked up next to each other so much that nothing else is |
| 627 | allowed to execute. |
| 628 | |
| 629 | 0: disable the mechanism. Do not monitor or correct perf's |
| 630 | sampling rate no matter how CPU time it takes. |
| 631 | |
| 632 | 1-100: attempt to throttle perf's sample rate to this |
| 633 | percentage of CPU. Note: the kernel calculates an |
| 634 | "expected" length of each sample event. 100 here means |
| 635 | 100% of that expected length. Even if this is set to |
| 636 | 100, you may still see sample throttling if this |
| 637 | length is exceeded. Set to 0 if you truly do not care |
| 638 | how much CPU is consumed. |
| 639 | |
| 640 | ============================================================== |
| 641 | |
Mitsuo Hayasaka | 55af779 | 2011-11-29 15:08:36 +0900 | [diff] [blame] | 642 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 643 | pid_max: |
| 644 | |
Robert P. J. Day | beb7dd8 | 2007-05-09 07:14:03 +0200 | [diff] [blame] | 645 | PID allocation wrap value. When the kernel's next PID value |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 646 | reaches this value, it wraps back to a minimum PID value. |
| 647 | PIDs of value pid_max or larger are not allocated. |
| 648 | |
| 649 | ============================================================== |
| 650 | |
Pavel Emelyanov | b8f566b | 2012-01-12 17:20:27 -0800 | [diff] [blame] | 651 | ns_last_pid: |
| 652 | |
| 653 | The last pid allocated in the current (the one task using this sysctl |
| 654 | lives in) pid namespace. When selecting a pid for a next task on fork |
| 655 | kernel tries to allocate a number starting from this one. |
| 656 | |
| 657 | ============================================================== |
| 658 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 659 | powersave-nap: (PPC only) |
| 660 | |
| 661 | If set, Linux-PPC will use the 'nap' mode of powersaving, |
| 662 | otherwise the 'doze' mode will be used. |
| 663 | |
| 664 | ============================================================== |
| 665 | |
| 666 | printk: |
| 667 | |
| 668 | The four values in printk denote: console_loglevel, |
| 669 | default_message_loglevel, minimum_console_loglevel and |
| 670 | default_console_loglevel respectively. |
| 671 | |
| 672 | These values influence printk() behavior when printing or |
| 673 | logging error messages. See 'man 2 syslog' for more info on |
| 674 | the different loglevels. |
| 675 | |
| 676 | - console_loglevel: messages with a higher priority than |
| 677 | this will be printed to the console |
Paul Bolle | 87889e1 | 2011-02-06 21:00:41 +0100 | [diff] [blame] | 678 | - default_message_loglevel: messages without an explicit priority |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 679 | will be printed with this priority |
| 680 | - minimum_console_loglevel: minimum (highest) value to which |
| 681 | console_loglevel can be set |
| 682 | - default_console_loglevel: default value for console_loglevel |
| 683 | |
| 684 | ============================================================== |
| 685 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 686 | printk_delay: |
| 687 | |
| 688 | Delay each printk message in printk_delay milliseconds |
| 689 | |
| 690 | Value from 0 - 10000 is allowed. |
| 691 | |
| 692 | ============================================================== |
| 693 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 694 | printk_ratelimit: |
| 695 | |
| 696 | Some warning messages are rate limited. printk_ratelimit specifies |
| 697 | the minimum length of time between these messages (in jiffies), by |
| 698 | default we allow one every 5 seconds. |
| 699 | |
| 700 | A value of 0 will disable rate limiting. |
| 701 | |
| 702 | ============================================================== |
| 703 | |
| 704 | printk_ratelimit_burst: |
| 705 | |
| 706 | While long term we enforce one message per printk_ratelimit |
| 707 | seconds, we do allow a burst of messages to pass through. |
| 708 | printk_ratelimit_burst specifies the number of messages we can |
| 709 | send before ratelimiting kicks in. |
| 710 | |
| 711 | ============================================================== |
| 712 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 713 | randomize_va_space: |
Jiri Kosina | 1ec7fd5 | 2008-02-09 23:24:08 +0100 | [diff] [blame] | 714 | |
| 715 | This option can be used to select the type of process address |
| 716 | space randomization that is used in the system, for architectures |
| 717 | that support this feature. |
| 718 | |
Horst Schirmeier | b7f5ab6 | 2009-07-03 14:20:17 +0200 | [diff] [blame] | 719 | 0 - Turn the process address space randomization off. This is the |
| 720 | default for architectures that do not support this feature anyways, |
| 721 | and kernels that are booted with the "norandmaps" parameter. |
Jiri Kosina | 1ec7fd5 | 2008-02-09 23:24:08 +0100 | [diff] [blame] | 722 | |
| 723 | 1 - Make the addresses of mmap base, stack and VDSO page randomized. |
| 724 | This, among other things, implies that shared libraries will be |
Horst Schirmeier | b7f5ab6 | 2009-07-03 14:20:17 +0200 | [diff] [blame] | 725 | loaded to random addresses. Also for PIE-linked binaries, the |
| 726 | location of code start is randomized. This is the default if the |
| 727 | CONFIG_COMPAT_BRK option is enabled. |
Jiri Kosina | 1ec7fd5 | 2008-02-09 23:24:08 +0100 | [diff] [blame] | 728 | |
Horst Schirmeier | b7f5ab6 | 2009-07-03 14:20:17 +0200 | [diff] [blame] | 729 | 2 - Additionally enable heap randomization. This is the default if |
| 730 | CONFIG_COMPAT_BRK is disabled. |
| 731 | |
| 732 | There are a few legacy applications out there (such as some ancient |
Jiri Kosina | 1ec7fd5 | 2008-02-09 23:24:08 +0100 | [diff] [blame] | 733 | versions of libc.so.5 from 1996) that assume that brk area starts |
Horst Schirmeier | b7f5ab6 | 2009-07-03 14:20:17 +0200 | [diff] [blame] | 734 | just after the end of the code+bss. These applications break when |
| 735 | start of the brk area is randomized. There are however no known |
Jiri Kosina | 1ec7fd5 | 2008-02-09 23:24:08 +0100 | [diff] [blame] | 736 | non-legacy applications that would be broken this way, so for most |
Horst Schirmeier | b7f5ab6 | 2009-07-03 14:20:17 +0200 | [diff] [blame] | 737 | systems it is safe to choose full randomization. |
| 738 | |
| 739 | Systems with ancient and/or broken binaries should be configured |
| 740 | with CONFIG_COMPAT_BRK enabled, which excludes the heap from process |
| 741 | address space randomization. |
Jiri Kosina | 1ec7fd5 | 2008-02-09 23:24:08 +0100 | [diff] [blame] | 742 | |
| 743 | ============================================================== |
| 744 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 745 | reboot-cmd: (Sparc only) |
| 746 | |
| 747 | ??? This seems to be a way to give an argument to the Sparc |
| 748 | ROM/Flash boot loader. Maybe to tell it what to do after |
| 749 | rebooting. ??? |
| 750 | |
| 751 | ============================================================== |
| 752 | |
| 753 | rtsig-max & rtsig-nr: |
| 754 | |
| 755 | The file rtsig-max can be used to tune the maximum number |
| 756 | of POSIX realtime (queued) signals that can be outstanding |
| 757 | in the system. |
| 758 | |
| 759 | rtsig-nr shows the number of RT signals currently queued. |
| 760 | |
| 761 | ============================================================== |
| 762 | |
| 763 | sg-big-buff: |
| 764 | |
| 765 | This file shows the size of the generic SCSI (sg) buffer. |
| 766 | You can't tune it just yet, but you could change it on |
| 767 | compile time by editing include/scsi/sg.h and changing |
| 768 | the value of SG_BIG_BUFF. |
| 769 | |
| 770 | There shouldn't be any reason to change this value. If |
| 771 | you can come up with one, you probably know what you |
| 772 | are doing anyway :) |
| 773 | |
| 774 | ============================================================== |
| 775 | |
Carlos Alberto Lopez Perez | 358e419 | 2013-01-04 15:35:05 -0800 | [diff] [blame] | 776 | shmall: |
| 777 | |
| 778 | This parameter sets the total amount of shared memory pages that |
| 779 | can be used system wide. Hence, SHMALL should always be at least |
| 780 | ceil(shmmax/PAGE_SIZE). |
| 781 | |
| 782 | If you are not sure what the default PAGE_SIZE is on your Linux |
| 783 | system, you can run the following command: |
| 784 | |
| 785 | # getconf PAGE_SIZE |
| 786 | |
| 787 | ============================================================== |
| 788 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 789 | shmmax: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 790 | |
| 791 | This value can be used to query and set the run time limit |
| 792 | on the maximum shared memory segment size that can be created. |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 793 | Shared memory segments up to 1Gb are now supported in the |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 794 | kernel. This value defaults to SHMMAX. |
| 795 | |
| 796 | ============================================================== |
| 797 | |
Vasiliy Kulikov | b34a6b1 | 2011-07-26 16:08:48 -0700 | [diff] [blame] | 798 | shm_rmid_forced: |
| 799 | |
| 800 | Linux lets you set resource limits, including how much memory one |
| 801 | process can consume, via setrlimit(2). Unfortunately, shared memory |
| 802 | segments are allowed to exist without association with any process, and |
| 803 | thus might not be counted against any resource limits. If enabled, |
| 804 | shared memory segments are automatically destroyed when their attach |
| 805 | count becomes zero after a detach or a process termination. It will |
| 806 | also destroy segments that were created, but never attached to, on exit |
| 807 | from the process. The only use left for IPC_RMID is to immediately |
| 808 | destroy an unattached segment. Of course, this breaks the way things are |
| 809 | defined, so some applications might stop working. Note that this |
| 810 | feature will do you no good unless you also configure your resource |
| 811 | limits (in particular, RLIMIT_AS and RLIMIT_NPROC). Most systems don't |
| 812 | need this. |
| 813 | |
| 814 | Note that if you change this from 0 to 1, already created segments |
| 815 | without users and with a dead originative process will be destroyed. |
| 816 | |
| 817 | ============================================================== |
| 818 | |
Kees Cook | f4aacea | 2014-06-06 14:37:19 -0700 | [diff] [blame] | 819 | sysctl_writes_strict: |
| 820 | |
| 821 | Control how file position affects the behavior of updating sysctl values |
| 822 | via the /proc/sys interface: |
| 823 | |
| 824 | -1 - Legacy per-write sysctl value handling, with no printk warnings. |
| 825 | Each write syscall must fully contain the sysctl value to be |
| 826 | written, and multiple writes on the same sysctl file descriptor |
| 827 | will rewrite the sysctl value, regardless of file position. |
Kees Cook | 41662f5 | 2016-01-20 15:00:45 -0800 | [diff] [blame] | 828 | 0 - Same behavior as above, but warn about processes that perform writes |
| 829 | to a sysctl file descriptor when the file position is not 0. |
| 830 | 1 - (default) Respect file position when writing sysctl strings. Multiple |
| 831 | writes will append to the sysctl value buffer. Anything past the max |
| 832 | length of the sysctl value buffer will be ignored. Writes to numeric |
| 833 | sysctl entries must always be at file position 0 and the value must |
| 834 | be fully contained in the buffer sent in the write syscall. |
Kees Cook | f4aacea | 2014-06-06 14:37:19 -0700 | [diff] [blame] | 835 | |
| 836 | ============================================================== |
| 837 | |
Aaron Tomlin | ed23587 | 2014-06-23 13:22:05 -0700 | [diff] [blame] | 838 | softlockup_all_cpu_backtrace: |
| 839 | |
| 840 | This value controls the soft lockup detector thread's behavior |
| 841 | when a soft lockup condition is detected as to whether or not |
| 842 | to gather further debug information. If enabled, each cpu will |
| 843 | be issued an NMI and instructed to capture stack trace. |
| 844 | |
| 845 | This feature is only applicable for architectures which support |
| 846 | NMI. |
| 847 | |
| 848 | 0: do nothing. This is the default behavior. |
| 849 | |
| 850 | 1: on detection capture more debug information. |
| 851 | |
| 852 | ============================================================== |
| 853 | |
Ulrich Obergfell | 195daf6 | 2015-04-14 15:44:13 -0700 | [diff] [blame] | 854 | soft_watchdog |
| 855 | |
| 856 | This parameter can be used to control the soft lockup detector. |
| 857 | |
| 858 | 0 - disable the soft lockup detector |
| 859 | 1 - enable the soft lockup detector |
| 860 | |
| 861 | The soft lockup detector monitors CPUs for threads that are hogging the CPUs |
| 862 | without rescheduling voluntarily, and thus prevent the 'watchdog/N' threads |
| 863 | from running. The mechanism depends on the CPUs ability to respond to timer |
| 864 | interrupts which are needed for the 'watchdog/N' threads to be woken up by |
| 865 | the watchdog timer function, otherwise the NMI watchdog - if enabled - can |
| 866 | detect a hard lockup condition. |
| 867 | |
| 868 | ============================================================== |
| 869 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 870 | tainted: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 871 | |
| 872 | Non-zero if the kernel has been tainted. Numeric values, which |
| 873 | can be ORed together: |
| 874 | |
Greg Kroah-Hartman | bb20698 | 2008-10-17 15:01:07 -0700 | [diff] [blame] | 875 | 1 - A module with a non-GPL license has been loaded, this |
| 876 | includes modules with no license. |
| 877 | Set by modutils >= 2.4.9 and module-init-tools. |
| 878 | 2 - A module was force loaded by insmod -f. |
| 879 | Set by modutils >= 2.4.9 and module-init-tools. |
| 880 | 4 - Unsafe SMP processors: SMP with CPUs not designed for SMP. |
| 881 | 8 - A module was forcibly unloaded from the system by rmmod -f. |
| 882 | 16 - A hardware machine check error occurred on the system. |
| 883 | 32 - A bad page was discovered on the system. |
| 884 | 64 - The user has asked that the system be marked "tainted". This |
| 885 | could be because they are running software that directly modifies |
| 886 | the hardware, or for other reasons. |
| 887 | 128 - The system has died. |
| 888 | 256 - The ACPI DSDT has been overridden with one supplied by the user |
| 889 | instead of using the one provided by the hardware. |
| 890 | 512 - A kernel warning has occurred. |
| 891 | 1024 - A module from drivers/staging was loaded. |
Larry Finger | f5fe184 | 2012-02-06 09:49:50 -0800 | [diff] [blame] | 892 | 2048 - The system is working around a severe firmware bug. |
| 893 | 4096 - An out-of-tree module has been loaded. |
Mathieu Desnoyers | 66cc69e | 2014-03-13 12:11:30 +1030 | [diff] [blame] | 894 | 8192 - An unsigned module has been loaded in a kernel supporting module |
| 895 | signature. |
Josh Hunt | 69361ee | 2014-08-08 14:22:31 -0700 | [diff] [blame] | 896 | 16384 - A soft lockup has previously occurred on the system. |
Seth Jennings | c5f4546 | 2014-12-16 11:58:18 -0600 | [diff] [blame] | 897 | 32768 - The kernel has been live patched. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 898 | |
Shen Feng | 760df93 | 2009-04-02 16:57:20 -0700 | [diff] [blame] | 899 | ============================================================== |
| 900 | |
Heinrich Schuchardt | 0ec62af | 2015-04-16 12:47:53 -0700 | [diff] [blame] | 901 | threads-max |
| 902 | |
| 903 | This value controls the maximum number of threads that can be created |
| 904 | using fork(). |
| 905 | |
| 906 | During initialization the kernel sets this value such that even if the |
| 907 | maximum number of threads is created, the thread structures occupy only |
| 908 | a part (1/8th) of the available RAM pages. |
| 909 | |
| 910 | The minimum value that can be written to threads-max is 20. |
| 911 | The maximum value that can be written to threads-max is given by the |
| 912 | constant FUTEX_TID_MASK (0x3fffffff). |
| 913 | If a value outside of this range is written to threads-max an error |
| 914 | EINVAL occurs. |
| 915 | |
| 916 | The value written is checked against the available RAM pages. If the |
| 917 | thread structures would occupy too much (more than 1/8th) of the |
| 918 | available RAM pages threads-max is reduced accordingly. |
| 919 | |
| 920 | ============================================================== |
| 921 | |
Shen Feng | 760df93 | 2009-04-02 16:57:20 -0700 | [diff] [blame] | 922 | unknown_nmi_panic: |
| 923 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 924 | The value in this file affects behavior of handling NMI. When the |
| 925 | value is non-zero, unknown NMI is trapped and then panic occurs. At |
| 926 | that time, kernel debugging information is displayed on console. |
Shen Feng | 760df93 | 2009-04-02 16:57:20 -0700 | [diff] [blame] | 927 | |
Borislav Petkov | 807094c | 2011-07-23 10:39:29 -0700 | [diff] [blame] | 928 | NMI switch that most IA32 servers have fires unknown NMI up, for |
| 929 | example. If a system hangs up, try pressing the NMI switch. |
Li Zefan | 08825c9 | 2013-05-17 10:31:20 +0800 | [diff] [blame] | 930 | |
| 931 | ============================================================== |
| 932 | |
Ulrich Obergfell | 195daf6 | 2015-04-14 15:44:13 -0700 | [diff] [blame] | 933 | watchdog: |
| 934 | |
| 935 | This parameter can be used to disable or enable the soft lockup detector |
| 936 | _and_ the NMI watchdog (i.e. the hard lockup detector) at the same time. |
| 937 | |
| 938 | 0 - disable both lockup detectors |
| 939 | 1 - enable both lockup detectors |
| 940 | |
| 941 | The soft lockup detector and the NMI watchdog can also be disabled or |
| 942 | enabled individually, using the soft_watchdog and nmi_watchdog parameters. |
| 943 | If the watchdog parameter is read, for example by executing |
| 944 | |
| 945 | cat /proc/sys/kernel/watchdog |
| 946 | |
| 947 | the output of this command (0 or 1) shows the logical OR of soft_watchdog |
| 948 | and nmi_watchdog. |
| 949 | |
| 950 | ============================================================== |
| 951 | |
Chris Metcalf | fe4ba3c | 2015-06-24 16:55:45 -0700 | [diff] [blame] | 952 | watchdog_cpumask: |
| 953 | |
| 954 | This value can be used to control on which cpus the watchdog may run. |
| 955 | The default cpumask is all possible cores, but if NO_HZ_FULL is |
| 956 | enabled in the kernel config, and cores are specified with the |
| 957 | nohz_full= boot argument, those cores are excluded by default. |
| 958 | Offline cores can be included in this mask, and if the core is later |
| 959 | brought online, the watchdog will be started based on the mask value. |
| 960 | |
| 961 | Typically this value would only be touched in the nohz_full case |
| 962 | to re-enable cores that by default were not running the watchdog, |
| 963 | if a kernel lockup was suspected on those cores. |
| 964 | |
| 965 | The argument value is the standard cpulist format for cpumasks, |
| 966 | so for example to enable the watchdog on cores 0, 2, 3, and 4 you |
| 967 | might say: |
| 968 | |
| 969 | echo 0,2-4 > /proc/sys/kernel/watchdog_cpumask |
| 970 | |
| 971 | ============================================================== |
| 972 | |
Li Zefan | 08825c9 | 2013-05-17 10:31:20 +0800 | [diff] [blame] | 973 | watchdog_thresh: |
| 974 | |
| 975 | This value can be used to control the frequency of hrtimer and NMI |
| 976 | events and the soft and hard lockup thresholds. The default threshold |
| 977 | is 10 seconds. |
| 978 | |
| 979 | The softlockup threshold is (2 * watchdog_thresh). Setting this |
| 980 | tunable to zero will disable lockup detection altogether. |
| 981 | |
| 982 | ============================================================== |