Documentation/admin-guide/hw-vuln/multihit.rst

Source file repositories/reference/linux-study-clean/Documentation/admin-guide/hw-vuln/multihit.rst

File Facts

System
Linux kernel
Corpus path
Documentation/admin-guide/hw-vuln/multihit.rst
Extension
.rst
Size
6752 bytes
Lines
168
Domain
Support Tooling And Documentation
Bucket
Documentation
Inferred role
Support Tooling And Documentation: documentation
Status
atlas-only

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

iTLB multihit
=============

iTLB multihit is an erratum where some processors may incur a machine check
error, possibly resulting in an unrecoverable CPU lockup, when an
instruction fetch hits multiple entries in the instruction TLB. This can
occur when the page size is changed along with either the physical address
or cache type. A malicious guest running on a virtualized system can
exploit this erratum to perform a denial of service attack.


Affected processors
-------------------

Variations of this erratum are present on most Intel Core and Xeon processor
models. The erratum is not present on:

   - non-Intel processors

   - Some Atoms (Airmont, Bonnell, Goldmont, GoldmontPlus, Saltwell, Silvermont)

   - Intel processors that have the PSCHANGE_MC_NO bit set in the
     IA32_ARCH_CAPABILITIES MSR.


Related CVEs
------------

The following CVE entry is related to this issue:

   ==============  =================================================
   CVE-2018-12207  Machine Check Error Avoidance on Page Size Change
   ==============  =================================================


Problem
-------

Privileged software, including OS and virtual machine managers (VMM), are in
charge of memory management. A key component in memory management is the control
of the page tables. Modern processors use virtual memory, a technique that creates
the illusion of a very large memory for processors. This virtual space is split
into pages of a given size. Page tables translate virtual addresses to physical
addresses.

To reduce latency when performing a virtual to physical address translation,
processors include a structure, called TLB, that caches recent translations.
There are separate TLBs for instruction (iTLB) and data (dTLB).

Under this errata, instructions are fetched from a linear address translated
using a 4 KB translation cached in the iTLB. Privileged software modifies the
paging structure so that the same linear address using large page size (2 MB, 4
MB, 1 GB) with a different physical address or memory type.  After the page
structure modification but before the software invalidates any iTLB entries for
the linear address, a code fetch that happens on the same linear address may
cause a machine-check error which can result in a system hang or shutdown.


Attack scenarios
----------------

Attacks against the iTLB multihit erratum can be mounted from malicious
guests in a virtualized system.


iTLB multihit system information
--------------------------------

The Linux kernel provides a sysfs interface to enumerate the current iTLB
multihit status of the system:whether the system is vulnerable and which

Annotation

Implementation Notes