I'm reading up on cpu shielding using Alex Tsariounov's cset utility here: https://rt.wiki.kernel.org/index.php/Cpuset_Management_Utility/tutorial

In the tutorial I'm finding the wording around migrating kernel threads from having access to all cpus to running only in a certain cpuset a bit ambiguous

The tutorial says the following:

Some kernel threads can be moved into the unshielded system cpuset as well. These are the threads that are not bound to specific CPUs.

If a kernel thread is bound to a specific CPU, then it is generally not a good idea to move that thread to the system set because at worst it may hang the system and at best it will slow the system down significantly. These threads are usually the IRQ threads on a real time Linux kernel, for example, and you may want to not move these kernel threads into system. If you leave them in the root cpuset, then they will have access to all CPUs.

The tutorial then goes on to say:

However, if your application demands an even "quieter" shield, then you can move all movable kernel threads into the unshielded system set with the following command.

[zuul:cpuset-trunk]# cset shield -k on cset: --> activating kthread
shielding cset: kthread shield activated, moving 70 tasks into system
cpuset... [==================================================]% cset:
done

I am confused by this final sentence. By using the word however, it seems to suggest that you typically should not move the movable kernel threads into the unshielded system set.

Is this the case, or is it safe to move kernel threads which can be moved into a cpuset, thereby preventing them from running on some cpus?