This parameter configures the zlib hardware support for IBM Z architectures.

Format: { on | off | def_only | inf_only | always }

The options are:

This parameter enables support for pseudo non-maskable interrupts (NMIs) in the kernel.

To use this parameter you need to build the kernel with the CONFIG_ARM64_PSEUDO_NMI configuration item.

Bitmask for conditionally calling panic() in add_taint()

Format: <hex>[,nousertaint]

A hexadecimal bitmask which represents a set of TAINT flags that will cause the kernel to panic when the add_taint() system call is invoked with any of the flags in this set. The optional nousertaint switch prevents userspace-forced crashes by writing to the /proc/sys/kernel/tainted file any flagset that matches the bitmask in panic_on_taint.

For for more information see the upstream documentation.

Format: <bool>

This parameter enables hosting of protected virtual machines which are isolated from the hypervisor if the hardware support is present.

This parameter enables elimination of Tree-RCU softirq processing.

If you set this parameter to zero, it moves all RCU_SOFTIRQ processing to per-CPU rcuc kthreads. If you set rcutree.use_softirq to a non-zero value (default), RCU_SOFTIRQ is used by default. Specify rcutree.use_softirq=0 to use rcuc kthreads.

This parameter enables the split lock detection. When enabled, and if hardware support is present, atomic instructions that access data across cache line boundaries will result in an alignment check exception.

The options are:

This parameter controls the Special Register Buffer Data Sampling (SRBDS) mitigation.

Certain CPUs are vulnerable to a Microarchitectural Data Sampling (MDS)-like exploit which can leak bits from the random number generator.

By default, microcode mitigates this issue. However, the microcode fix can cause the RDRAND and RDSEED instructions to become much slower. Among other effects, this will result in reduced throughput from the urandom kernel random number source device.

To disable the microcode mitigation, set the following option:

Format: { on | off | y | n | 1 | 0 }

This parameter controls the use of the Protected Execution Facility on pSeries systems.

This parameter disables the PV optimizations which forces the guest to run as generic guest with no PV drivers.

Currently supported are XEN HVM, KVM, HYPER_V and VMWARE guests.

This parameter specifies a huge page size. Use this parameter in conjunction with the hugepages parameter to pre-allocate a number of huge pages of the specified size.

Specify the hugepagesz and hugepages parameters in pairs such as:

hugepagesz=2M hugepages=512

The hugepagesz parameter can only be specified once on the command line for a specific huge page size. Valid huge page sizes are architecture dependent.

This parameter specifies the number of huge pages to pre-allocate. This parameter typically follows the valid hugepagesz or default_hugepagesz parameter.

However, if hugepages is the first or the only HugeTLB command-line parameter, it implicitly specifies the number of huge pages of the default size to allocate. If the number of huge pages of the default size is implicitly specified, it can not be overwritten by the hugepagesz + hugepages parameter pair for the default size.

For example, on an architecture with 2M default huge page size:

hugepages=256 hugepagesz=2M hugepages=512

Settings from the example above results in allocation of 256 2M huge pages and a warning message that the hugepages=512 parameter was ignored. If hugepages is preceded by invalid hugepagesz, hugepages will be ignored.

This parameter specifies the default huge page size. You can specify default_hugepagesz only once on the command-line. Optionally, you can follow default_hugepagesz with the hugepages parameter to pre-allocate a specific number of huge pages of the default size. Also, you can implicitly specify the number of default-sized huge pages to pre-allocate.

For example, on an architecture with 2M default huge page size:

hugepages=256
default_hugepagesz=2M hugepages=256
hugepages=256 default_hugepagesz=2M

Settings from the example above all results in allocation of 256 2M huge pages. Valid default huge page size is architecture dependent.

Format: { "old_map", "nochunk", "noruntime", "debug", "nosoftreserve" }

The options are:

Intel IOMMU driver Direct Memory Access Remapping (DMAR).

The added options are:

This parameter forces the usage of a specific amount of memory.

The amount of memory to be used in cases as follows:

Various Peripheral Component Interconnect (PCI) subsystem options.

Some options herein operate on a specific device or a set of devices (<pci_dev>). These are specified in one of the following formats:

[<domain>:]<bus>:<dev>.<func>[/<dev>.<func>]*
pci:<vendor>:<device>[:<subvendor>:<subdevice>]

Note that the first format specifies a PCI bus/device/function address which may change if new hardware is inserted, if motherboard firmware changes, or due to changes caused by other kernel parameters. If the domain is left unspecified, it is taken to be zero. Optionally, a path to a device through multiple device/function addresses can be specified after the base address (this is more robust against renumbering issues). The second format selects devices using IDs from the configuration space which may match multiple devices in the system.

The options are:

Peripheral Component Interconnect Express (PCIe) port services handling.

The options are:

The default USB device authorization.

The options are:

A list of quirk entries to augment the built-in USB core quirk list. The list entries are separated by commas. Each entry has the form VendorID:ProductID:Flags, for example quirks=0781:5580:bk,0a5c:5834:gij. The IDs are 4-digit hex numbers and Flags is a set of letters. Each letter will change the built-in quirk; setting it if it is clear and clearing it if it is set.

The added flags:

This parameter is based on the restrictions in the Openwall software and provides protection by allowing to avoid unintentional writes to an attacker-controlled FIFO where a program intended to create a regular file.

The options are:

This parameter is similar to the protected_fifos parameter, however it avoids writes to an attacker-controlled regular file where a program intended to create one.

The options are: