Public kernel command-line reference
This public reference explains purpose, accepted values, latency implications, failure modes, and post-boot verification. It intentionally does not publish a universal HFTKernel command line: exact values depend on CPU topology, NUMA placement, NIC queues, timekeeping, storage, security policy, and workload.
Engineering rule
A production profile must map housekeeping CPUs, trading CPUs, SMT siblings, NUMA nodes, NIC and storage queues, RCU threads, workqueues, time sources, and application affinity as one system.
CPU isolation, IRQ placement, and NUMA behavior are performance controls. Mitigations, LSM, audit, ASLR, watchdog, and machine-check settings require a separate security and operational decision.
A parameter can be unsupported, redundant, overridden by firmware, or changed later by userspace. The effective state in sysfs, procfs, dmesg, IRQ affinity, and measured latency is authoritative.
Production profile by request
HFTKernel engineering maps trading and housekeeping CPUs, SMT siblings, NUMA nodes, NIC and storage queues, management access, recovery, timekeeping, and security as one system before selecting the boot parameters.
Parameter reference
Search by parameter, subsystem, value, risk, or verification command. The public reference explains the control without selecting a production value.
No parameters match this search. Clear the query or search for a subsystem such as CPU, IRQ, IOMMU, security, or NVMe.
5 parameters
Parameters that select the kernel and root filesystem, define early mount behavior, expose the serial console, and reserve memory for kdump.
BOOT_IMAGE
Boot-loader metadata; not a latency control
GRUB commonly appends this token to record the selected kernel image. The upstream kernel does not use it as a tuning policy; it is mainly useful for diagnostics and correlating a boot with a specific image.
BOOT_IMAGE=/boot/vmlinuz-<version>
Filesystem-style path used by many GRUB configurations.
BOOT_IMAGE=(hd0,gpt2)/vmlinuz-<version>
GRUB device notation.
omitted
Valid; the selected image is still determined by the boot loader.
A copied BOOT_IMAGE string can be stale or cosmetic. The running kernel identity is authoritative.
cat /proc/cmdline
uname -r
cat /proc/versionroot
Kernel/initramfs root-device selection
Selects the block device or logical identity that will become the root filesystem. An initramfs may resolve the value before the real root is mounted.
root=UUID=<filesystem-uuid>
Stable filesystem identifier; generally preferred over a mutable device name.
root=PARTUUID=<partition-uuid>
Stable partition-table identifier.
root=LABEL=<label> or root=PARTLABEL=<label>
Human-readable filesystem or partition label.
root=/dev/nvme0n1p2 or root=/dev/mapper/<name>
Direct device path; simple, but naming may vary with discovery order.
An incorrect value prevents boot. Verify the initramfs contains the required storage, LVM, RAID, or encryption drivers before deployment.
findmnt -no SOURCE /
blkid
cat /proc/cmdlinero
Initial root-filesystem mount mode
Requests that the kernel mount the root filesystem read-only initially. The init system normally performs checks and remounts it read-write later.
ro
Initial read-only mount.
rw
Initial read-write mount.
Changing it can alter early-boot repair and initramfs behavior; test recovery paths.
findmnt -no OPTIONS /
cat /proc/cmdlineconsole
Kernel console routing
Controls where kernel console messages are sent. Serial-console values define the device, baud rate, parity, and data bits; virtual and local-console targets are also available for supported platforms.
console=tty0
Local virtual terminal.
console=ttyS<N>,<baud><parity><bits>
8250-compatible serial console; examples include 115200n8 and 9600n8.
console=hvc0
Hypervisor virtual console on supported guests.
console=null
Discard console output.
multiple console= tokens
Mirror kernel output to more than one eligible console; verify which device becomes /dev/console.
Heavy console output can be expensive, especially on a slow serial device. Control log level and rate rather than blindly disabling recovery access.
cat /proc/consoles
dmesg | head
stty -F /dev/ttyS0 2>/dev/null || truecrashkernel
kdump memory reservation
Reserves memory for a capture kernel that can write a vmcore after a panic. The value auto is implemented by some distributions, but it is not a universally portable upstream sizing policy.
crashkernel=<size>
Reserve a fixed amount, for example 512M.
crashkernel=<range>:<size>[,<range>:<size>…]
Select reservation size by installed RAM.
crashkernel=<size>,high plus crashkernel=<size>,low
Split high and low reservations on supported architectures.
crashkernel=<size>,cma
Use a CMA-backed reservation where supported.
crashkernel=auto
Distribution-specific automatic sizing; confirm support in the target kernel and boot tooling.
omitted
No crash-kernel reservation; kdump cannot capture a vmcore.
Reserved RAM is unavailable to the primary kernel. An undersized capture kernel fails when it is needed most.
grep -i "Crash kernel" /proc/iomem
systemctl status kdump 2>/dev/null || systemctl status kdump-tools 2>/dev/null || true
dmesg | grep -i crashkernel5 parameters
Controls for C-states, P-states, energy-performance bias, and simultaneous multithreading.
intel_idle.max_cstate
Intel cpuidle driver selection and depth
Controls the deepest idle state exposed by intel_idle. A value of 0 disables intel_idle and falls back to another idle driver, usually acpi_idle; it does not by itself guarantee that the CPU remains in C0.
0
Disable intel_idle and fall back to the platform alternative.
1
Expose only the shallowest intel_idle state.
2–9
Allow progressively deeper states up to the selected driver index, subject to CPU support.
omitted
Use the driver default and platform state table.
Shallow idle improves wake-up consistency but increases power, heat, fan demand, and possibly sustained-frequency pressure.
cat /sys/devices/system/cpu/cpuidle/current_driver
grep -H . /sys/devices/system/cpu/cpu0/cpuidle/state*/name 2>/dev/null
turbostat --quiet --show CPU,c1,c3,c6,c7 2>/dev/null || trueprocessor.max_cstate
ACPI processor idle-state limit
Limits the deepest ACPI idle state registered by the processor idle driver. It matters primarily when acpi_idle is active, including cases where another idle driver has been disabled or is unavailable.
0
On current upstream code, no ACPI C-state passes the registration loop; the resulting fallback behavior must be verified on the target platform.
1
Limit to C1.
2–8
Allow ACPI states up to the selected depth, when firmware exposes them.
9 or another value above the normal limit
Can override some DMI blacklist limits; this is not a latency recommendation.
omitted
Use firmware and driver defaults.
Using 0 can produce platform-specific fallback behavior. Do not treat it as a portable synonym for “C0 only.”
cat /sys/devices/system/cpu/cpuidle/current_driver
grep -H . /sys/devices/system/cpu/cpu0/cpuidle/state*/name 2>/dev/null
cat /sys/module/processor/parameters/max_cstate 2>/dev/null || trueintel_pstate
Intel CPU frequency-scaling driver mode
Selects the operating mode of the intel_pstate frequency-scaling driver or prevents it from loading. The chosen mode changes control semantics, HWP behavior, and the available governors.
disable
Do not enable intel_pstate.
active
Use intel_pstate active mode and its internal performance/powersave algorithms.
passive
Use intel_pstate as a scaling driver under generic cpufreq governors.
force
Force intel_pstate on otherwise excluded systems; platform thermal and power controls may be affected.
no_hwp
Do not enable Hardware P-states.
hwp_only
Load only where HWP is available.
support_acpi_ppc
Honor ACPI _PPC limits.
per_cpu_perf_limits
Expose per-logical-CPU performance limits.
no_cas
Disable capacity-aware scheduling support on hybrid systems.
A fixed maximum-frequency policy can increase thermal throttling and reduce all-core sustainability. Measure frequency residency and tail latency together.
cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver 2>/dev/null
cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null
cpupower frequency-info 2>/dev/null || trueepb
Non-standard boot token; Intel Energy Performance Bias is normally configured through sysfs or x86_energy_perf_policy
Represents an Energy Performance Bias policy in kernel trees or boot tooling that explicitly consume the token. Upstream Linux normally exposes Intel EPB per CPU through energy_perf_bias and does not define epb= as a generic kernel command-line parameter.
0
Maximum performance bias in the EPB interface.
1–14
Intermediate performance/energy trade-off.
15
Maximum energy-saving bias.
performance, balance-performance, normal, balance-power, power
Named values accepted by the per-CPU sysfs interface on supported kernels.
Firmware, suspend/resume, CPU hotplug, or a power-management service can overwrite EPB. Treat the selected policy as managed runtime state and verify it continuously.
grep -H . /sys/devices/system/cpu/cpu*/power/energy_perf_bias 2>/dev/null
x86_energy_perf_policy --debug 2>/dev/null | head -n 40 || true
dmesg | grep -i "unknown kernel command line.*epb" || truenosmt
Simultaneous multithreading control
Disables secondary SMT threads so each physical core exposes at most one online logical CPU. This can reduce sibling contention in execution units, caches, and some interrupt paths.
nosmt
Disable SMT at boot; runtime re-enable may remain possible when the platform and kernel permit it.
nosmt=force
Force SMT off and prevent runtime re-enable.
omitted
Use firmware and kernel defaults.
Disabling SMT reduces logical CPU capacity and may move more background work onto fewer housekeeping CPUs.
cat /sys/devices/system/cpu/smt/control
cat /sys/devices/system/cpu/smt/active
lscpu -e=CPU,CORE,SOCKET,ONLINE6 parameters
The core latency-control group: full-dynticks CPUs, scheduler-domain isolation, housekeeping affinity, timer skew, and RCU callback offload.
nohz
Idle tick suppression
Controls kernel tickless-idle behavior when the kernel was built with the required NO_HZ support. The enabled mode allows idle CPUs to stop the periodic scheduler tick.
on
Enable tickless idle where supported.
off
Disable tickless idle and retain periodic ticks.
omitted
Use the kernel configuration default.
The parameter has no effect if the running kernel lacks the corresponding build-time support.
grep -E "CONFIG_NO_HZ(_IDLE|_FULL)?=" /boot/config-$(uname -r) 2>/dev/null
cat /proc/cmdlineskew_tick
Per-CPU periodic-tick phase distribution
Controls whether periodic tick activity is offset across CPUs instead of firing all CPU ticks at the same instant. Enabling the feature can reduce lock contention and synchronized noise on large systems.
0
Do not intentionally skew periodic ticks.
1
Distribute tick phases across CPUs.
The trade-off is higher power consumption because package-wide idle opportunities can be reduced.
cat /proc/cmdline
trace-cmd record -e timer -e irq -e sched sleep 5 2>/dev/null || trueirqaffinity
Default IRQ affinity mask
Sets the default CPU list for IRQs that do not receive a more specific affinity policy. The selected CPU mask determines where otherwise-unassigned interrupt handling begins.
irqaffinity=<cpu-list>
Comma-separated CPUs and ranges, for example 0,4-7.
omitted
Use the architecture/kernel default affinity mask.
CPU 0 can become a bottleneck. Managed MSI-X interrupts may not obey the default mask in the same way as ordinary IRQs.
cat /proc/irq/default_smp_affinity
grep -H . /proc/irq/*/smp_affinity_list 2>/dev/null | head -n 80
cat /proc/interruptsisolcpus
Scheduler-domain and managed-IRQ isolation
Selects CPUs and isolation flags for scheduler-domain removal, full-dynticks behavior, and managed-IRQ avoidance. Domain isolation is an irreversible boot-time decision until the next reboot.
isolcpus=<cpu-list>
Legacy form; domain isolation is implied.
isolcpus=domain,<cpu-list>
Remove the CPUs from scheduler load-balancing domains.
isolcpus=nohz,<cpu-list>
Enable full-dynticks isolation behavior for the CPUs.
isolcpus=managed_irq,<cpu-list>
Best-effort exclusion from managed IRQ masks when housekeeping CPUs are available.
combined flags
Example: domain,nohz,managed_irq,2-15.
Isolation does not automatically move kernel threads, workqueues, device queues, timers, or application threads. It is one component of a complete housekeeping design.
cat /sys/devices/system/cpu/isolated
cat /sys/devices/system/cpu/nohz_full
taskset -pc $$
cat /proc/interruptsnohz_full
Full-dynticks CPU set
Stops the periodic scheduler tick on listed CPUs while they run a suitable workload, reducing recurring kernel interruption. At least one housekeeping CPU remains outside the set; the boot CPU is automatically excluded.
nohz_full=<cpu-list>
Select full-dynticks CPUs, for example 2-15,18-31.
nohz_full=all
Request all possible CPUs; the kernel still retains required housekeeping CPUs.
omitted
No boot-selected full-dynticks CPUs.
A listed CPU can still receive interrupts, kernel-thread work, page faults, TLB shootdowns, and cross-CPU calls unless those paths are controlled separately.
cat /sys/devices/system/cpu/nohz_full
cat /proc/cmdline
grep -E "CONFIG_NO_HZ_FULL=|CONFIG_RCU_NOCB_CPU=" /boot/config-$(uname -r) 2>/dev/nullrcu_nocbs
RCU callback offload
Moves RCU callback invocation away from selected CPUs into dedicated kthreads. A bare token does not select CPUs at boot; an explicit CPU list or a compatible runtime mechanism is required.
rcu_nocbs=<cpu-list>
Offload callbacks for the listed CPUs, for example rcu_nocbs=1-3.
rcu_nocbs with no argument
No CPUs selected at boot; eligible CPUs may be toggled later through cpusets/runtime interfaces.
rcu_nocb_poll
Make nocb kthreads poll rather than depend on wakeups; can reduce wake-up latency at a substantial power cost.
omitted
Use normal callback placement, except that nohz_full CPUs are automatically offloaded by current kernels.
Offloading shifts work; it does not remove it. Undersized housekeeping CPUs can build callback backlogs and create system-wide stalls.
ps -eLo pid,tid,psr,cls,rtprio,comm | grep -E "rcuo|rcuc"
grep -E "rcu_nocbs|nohz_full" /proc/cmdline
cat /sys/devices/system/cpu/nohz_full4 parameters
Timekeeping and platform-level controls that can affect wake-up latency, periodic work, and device-path predictability.
pcie_aspm.policy
PCI Express Active State Power Management policy
Selects the PCIe Active State Power Management policy. Available policies trade link wake-up latency against platform power use, subject to firmware and kernel control of each link.
default
Use firmware/default policy.
performance
Prioritize performance and disable ASPM/Clock PM under kernel policy.
powersave
Enable power-saving link states with a balanced policy.
powersupersave
Use the most aggressive available power-saving policy.
Power consumption rises, and some firmware-controlled links may not follow the requested policy.
cat /sys/module/pcie_aspm/parameters/policy 2>/dev/null
lspci -vv | grep -E "LnkCap:|LnkCtl:" | head -n 80acpi_pad.disable
Version/vendor-specific ACPI Processor Aggregator control
Controls a kernel-tree-specific ACPI Processor Aggregator switch intended to prevent idle-injection work. Current upstream acpi_pad code may not expose this module parameter, so support must be verified in the exact kernel and distribution.
acpi_pad.disable=1
Supported only by kernel trees that expose this module parameter.
acpi_pad.disable=0
Enable/default behavior on trees that implement the parameter.
driver/module blacklist policy
Portable operational alternative when the driver is modular and has been validated as unnecessary.
Removing platform power-management behavior can affect firmware expectations. Validate on the exact server model and BIOS revision.
ls -la /sys/module/acpi_pad/parameters 2>/dev/null || true
grep -w acpi_pad /proc/modules 2>/dev/null || true
dmesg | grep -i "unknown kernel command line.*acpi_pad" || trueclocksource
Kernel timekeeping source selection
Selects a named kernel clocksource. On modern invariant, synchronized systems, TSC can offer low read overhead and high resolution, while other platforms may require a different validated source.
clocksource=tsc
Force TSC when the kernel considers it available.
clocksource=hpet
Use HPET where available; often higher read overhead.
clocksource=acpi_pm
Use the ACPI PM timer where available.
clocksource=kvm-clock, hyperv_clocksource, xen, or another listed source
Hypervisor/platform-specific options.
omitted
Let the kernel select the best rated stable source.
Do not add tsc=reliable merely to suppress warnings. That separate override disables stability checks and is appropriate only for a validated platform contract.
cat /sys/devices/system/clocksource/clocksource0/current_clocksource
cat /sys/devices/system/clocksource/clocksource0/available_clocksource
dmesg | grep -Ei "clocksource|tsc"no_timer_check
x86 timer-IRQ source-check workaround
Disables a boot-time check intended to detect broken timer interrupt routing. It is a compatibility workaround for specific hardware or virtual-machine environments, not a general latency optimization.
no_timer_check
Skip the timer routing check.
omitted
Run normal kernel timer checks.
Suppressing a diagnostic can hide a platform timer-routing problem that later appears as lost ticks or timekeeping instability.
cat /proc/cmdline
dmesg | grep -Ei "timer.*check|timer.*irq|APIC timer"9 parameters
High-impact switches that trade security or failure diagnostics for lower overhead. These require an explicit production risk decision.
selinux
SELinux initialization
Controls whether SELinux initializes and which boot-time policy mode is used. Disabling initialization removes policy enforcement and SELinux audit hooks from the active system.
selinux=0
Disable SELinux at boot.
selinux=1 or omitted
Allow SELinux initialization when built and configured.
enforcing=0
Related alternative: initialize SELinux in permissive mode so denials are logged but not enforced.
enforcing=1
Start enforcing when policy supports it.
selinux=0 is a security decision, not a generic HFT requirement. Re-enabling normally requires a reboot and may require filesystem relabeling.
getenforce 2>/dev/null || true
sestatus 2>/dev/null || true
cat /sys/fs/selinux/enforce 2>/dev/null || truenosoftlockup
Soft-lockup detector
Disables the watchdog that reports CPUs spending too long without scheduling the watchdog thread.
nosoftlockup
Disable soft-lockup detection.
omitted
Use the configured watchdog policy.
watchdog_thresh=<seconds>
Related tuning: change the lockup detection threshold instead of disabling it.
Without the detector, a stalled CPU can remain invisible until an external health check or hardware watchdog acts.
cat /proc/sys/kernel/watchdog 2>/dev/null
cat /proc/sys/kernel/soft_watchdog 2>/dev/null || true
dmesg | grep -i watchdogmitigations
CPU vulnerability mitigation policy
Selects a CPU-vulnerability mitigation policy. Available modes trade context-switch and speculation-control overhead against protection from applicable hardware vulnerabilities.
off
Disable all optional mitigations.
auto
Enable mitigations according to CPU vulnerability status and kernel defaults.
auto,nosmt
Automatic mitigations plus SMT disable where required.
omitted
Use the compiled/default policy.
This can expose kernel, process, VM, and cross-thread data depending on the CPU. The latency gain is hardware- and workload-specific.
grep . /sys/devices/system/cpu/vulnerabilities/*
cat /proc/cmdline
dmesg | grep -i mitigationaudit
Linux audit subsystem startup state
Controls whether the kernel audit subsystem is enabled at boot. The selected state affects event-generation overhead and the evidence available for security, compliance, and incident response.
audit=0 or audit=off
Disable audit for the boot; it cannot be fully enabled later without reboot.
audit=1 or audit=on
Enable audit at boot.
omitted
Use the configured kernel/distribution default.
Disabling audit can invalidate compliance, incident-response, and forensic requirements.
auditctl -s 2>/dev/null || true
cat /proc/cmdline
dmesg | grep -i "audit.*enabled"mce
x86 machine-check handling
Controls x86 Machine Check Exception handling and related recovery behavior. Disabling it removes asynchronous hardware-error reporting as well as critical telemetry for CPU, memory, and interconnect faults.
off
Disable machine-check handling.
no_cmci
Disable corrected-error interrupt handling and use polling where supported.
dont_log_ce
Do not log corrected errors.
ignore_ce
Ignore corrected errors.
no_lmce
Disable Local Machine Check Exception support.
bootlog or nobootlog
Control logging of machine checks found during boot on supporting kernels.
omitted
Use normal machine-check handling.
Disabling MCE can turn a diagnosable degrading component into silent data corruption, unexplained resets, or untraceable latency spikes.
dmesg | grep -Ei "mce|machine check|hardware error"
ls /sys/devices/system/machinecheck 2>/dev/null || true
systemctl status rasdaemon 2>/dev/null || truenomce
Legacy x86-32 machine-check switch
Disables Machine Check Exception support on 32-bit x86 kernels. It is not the normal x86-64 control and can be redundant when another machine-check policy is already selected.
nomce
Disable MCE on supported 32-bit x86 builds.
omitted
Use the normal architecture policy.
Keeping redundant or architecture-inapplicable tokens makes a boot configuration harder to audit and can hide incorrect assumptions.
uname -m
cat /proc/cmdline
dmesg | grep -Ei "mce|machine check"norandmaps
Userspace address-space randomization
Disables userspace ASLR, equivalent to setting kernel.randomize_va_space=0. Virtual addresses become more repeatable, but exploitation resistance is materially reduced.
norandmaps
Disable userspace address-space randomization.
omitted
Use the sysctl/default ASLR policy.
kernel.randomize_va_space=0, 1, or 2
Runtime/sysctl policy: disabled, conservative randomization, or full randomization.
This weakens defense against memory-corruption exploits across the entire host.
sysctl kernel.randomize_va_space
cat /proc/cmdlinenowatchdog
Kernel lockup watchdog master switch
Disables both hard-lockup and soft-lockup watchdogs. Separate narrow watchdog-disable switches can therefore become redundant when this flag is present.
nowatchdog
Disable kernel lockup watchdogs.
omitted
Use the configured watchdog policy.
watchdog_thresh=<seconds>
Related alternative: retain detection but raise the threshold.
A hard or soft lockup can persist without a kernel report. Ensure another independent liveness mechanism remains.
cat /proc/sys/kernel/watchdog 2>/dev/null
cat /proc/sys/kernel/nmi_watchdog 2>/dev/null
dmesg | grep -i watchdognmi_watchdog
Hard-lockup NMI watchdog
Controls the NMI-based hard-lockup detector and, on supported x86 systems, its periodic performance-counter activity.
0
Disable the NMI watchdog.
1
Enable the NMI watchdog when supported.
omitted
Use the kernel/distribution default.
Disabling it removes an important signal for CPUs that stop handling normal interrupts.
cat /proc/sys/kernel/nmi_watchdog
dmesg | grep -i "NMI watchdog"3 parameters
Controls automatic page migration and DMA translation policy for stable locality and predictable device paths.
numa_balancing
Automatic NUMA page migration
Controls automatic NUMA balancing, which samples memory access by periodically protecting pages and may migrate tasks or pages. The chosen state trades automatic locality correction against page-fault and migration noise.
disable
Disable automatic NUMA balancing.
enable
Enable automatic NUMA balancing.
omitted
Use the kernel/distribution default.
With automatic balancing off, poor application placement remains poor. Explicitly bind memory and validate remote-access counters.
sysctl kernel.numa_balancing
numactl --hardware
numastat -p $$ 2>/dev/null || trueintel_iommu
Intel DMAR/IOMMU initialization
Controls Intel IOMMU initialization and related DMA-remapping or interrupt-remapping capabilities, subject to hardware and firmware support.
on
Enable the Intel IOMMU driver.
off
Disable it.
igfx_off
Bypass the integrated graphics DMAR unit.
sp_off
Disable IOMMU superpage support.
sm_on or sm_off
Allow or disallow Intel scalable mode.
strict
Deprecated driver-specific request equivalent to iommu.strict=1.
tboot_noforce
Do not let tboot force the IOMMU on; lowers DMA-attack protection.
Firmware defects and translation policy can affect device latency or stability. Validate each server/BIOS generation.
dmesg | grep -Ei "DMAR|IOMMU"
find /sys/kernel/iommu_groups -maxdepth 1 -type d 2>/dev/null | head
lspci -vv | grep -i "IOMMU\|ATS" | head -n 40iommu
Default DMA passthrough policy
Selects the default IOMMU domain policy for ordinary devices. Passthrough or identity mapping can reduce DMA translation overhead for trusted devices, while translated domains provide stronger isolation.
iommu=pt
Default to passthrough mode.
iommu=nopt
Default to translated DMA mode.
iommu.passthrough=1
Modern explicit passthrough control.
iommu.passthrough=0
Use IOMMU translation by default.
iommu.strict=0 or 1
Related translated-mode invalidation policy: lazy or strict.
iommu=off, force, noforce, soft, merge, nomerge
Architecture-specific general controls; not direct synonyms for passthrough.
Passthrough weakens DMA isolation. A faulty or compromised device may access host memory outside its intended buffers.
dmesg | grep -Ei "IOMMU.*(passthrough|Default domain)|DMAR"
find /sys/kernel/iommu_groups -maxdepth 2 -type l 2>/dev/null | head -n 403 parameters
Userspace NIC naming behavior and storage timeout/retry settings that determine how quickly faults become visible.
net.ifnames
systemd/udev predictable interface naming policy
Controls predictable interface naming in systemd/udev. Disabling it can restore legacy names such as eth0 when the distribution allows it; this is a userspace convention passed on the kernel command line, not a networking-latency switch.
0
Disable the predictable NamePolicy.
1 or omitted
Allow predictable naming according to the active systemd naming scheme and .link policy.
Legacy ethX ordering can change when hardware, firmware, or probe order changes. A mistaken interface identity is more dangerous than any naming preference.
ip -br link
udevadm test-builtin net_id /sys/class/net/$(ls /sys/class/net | head -n1) 2>/dev/null | head -n 40 || true
cat /proc/cmdlinenvme_core.io_timeout
NVMe I/O command timeout in seconds
Sets the NVMe I/O timeout input in seconds. Current upstream stores the module parameter as an unsigned integer with a default of 30, then converts it to the block-layer timeout in jiffies; the effective queue timeout must therefore be verified after boot.
30
Current upstream default in seconds; verify the target kernel.
a finite positive integer
Explicit timeout in seconds.
4294967295
Maximum 32-bit unsigned input, not an infinity token. The driver expression nvme_io_timeout * HZ can overflow before it becomes the effective request timeout; on a 1000 Hz kernel this value can resolve to about 49.7 days rather than 136 years.
A very large or overflowed timeout can leave I/O blocked for an unexpected period and delay reset, failover, or application recovery. Treat the value observed in /sys/block/<device>/queue/io_timeout as the effective contract.
cat /sys/module/nvme_core/parameters/io_timeout
grep -H . /sys/block/nvme*/queue/io_timeout 2>/dev/null || true
grep '^CONFIG_HZ=' /boot/config-$(uname -r) 2>/dev/null || true
nvme list 2>/dev/null || true
dmesg | grep -i nvmenvme_core.max_retries
Maximum NVMe command retries
Sets the maximum number of retries for eligible NVMe commands. Current upstream stores it as an unsigned byte and defaults to 5.
0
Do not retry eligible commands.
1–255
Maximum retry count; 10 doubles the current upstream default.
omitted
Use the kernel default.
More retries can extend tail latency and delay failover. Fewer retries can expose transient media or transport errors sooner.
cat /sys/module/nvme_core/parameters/max_retries
dmesg | grep -Ei "nvme.*(retry|timeout|reset)"How profiles are engineered
A maintainable profile separates invariant platform choices from topology-specific CPU lists and high-risk security overrides. HFTKernel evaluates these layers together, then delivers a reviewable, testable, and reversible configuration.
Root device, initial mount mode, serial console, and tested kdump reservation.
Idle driver, frequency policy, PCIe ASPM, clocksource, NUMA, and IOMMU policy.
Housekeeping CPUs, full-dynticks CPUs, RCU offload, default IRQ mask, queue affinity, and application cpusets.
Workqueue masks, kernel-thread affinity, EPB/governor policy, NIC queues, memory binding, and service CPU affinity.
Security mitigations, LSM, audit, ASLR, watchdog, and machine-check policy reviewed independently.
Post-boot verification
The command line is only an input. This checklist confirms the running kernel, CPU topology, full-dynticks set, IRQ placement, clocksource, power policy, IOMMU, security state, and NVMe recovery policy.
printf '%s\n' '== kernel and cmdline =='
uname -a
cat /proc/cmdline
printf '%s\n' '== CPU topology and isolation =='
lscpu -e=CPU,CORE,SOCKET,NODE,ONLINE
cat /sys/devices/system/cpu/isolated
cat /sys/devices/system/cpu/nohz_full
cat /sys/devices/system/cpu/smt/control
printf '%s\n' '== idle and frequency =='
cat /sys/devices/system/cpu/cpuidle/current_driver
cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver 2>/dev/null || true
cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null || true
grep -H . /sys/devices/system/cpu/cpu*/power/energy_perf_bias 2>/dev/null || true
printf '%s\n' '== IRQ and RCU placement =='
cat /proc/irq/default_smp_affinity
cat /proc/interrupts
ps -eLo pid,tid,psr,cls,rtprio,comm | grep -E 'rcuo|rcuc|irq/' || true
printf '%s\n' '== clock, NUMA, and IOMMU =='
cat /sys/devices/system/clocksource/clocksource0/current_clocksource
cat /sys/devices/system/clocksource/clocksource0/available_clocksource
sysctl kernel.numa_balancing
dmesg | grep -Ei 'DMAR|IOMMU|clocksource|tsc'
printf '%s\n' '== watchdog, security, and storage =='
sysctl kernel.watchdog kernel.nmi_watchdog kernel.randomize_va_space 2>/dev/null || true
grep . /sys/devices/system/cpu/vulnerabilities/*
cat /sys/module/nvme_core/parameters/io_timeout 2>/dev/null || true
grep -H . /sys/block/nvme*/queue/io_timeout 2>/dev/null || true
cat /sys/module/nvme_core/parameters/max_retries 2>/dev/null || truePrimary references
Always check the documentation and source for the exact kernel version, distribution patches, boot loader, firmware, and userspace stack deployed on the target host.