tssphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget0/translations/zh_CN/admin-guide/hw-vuln/multihitmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget0/translations/zh_TW/admin-guide/hw-vuln/multihitmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget0/translations/it_IT/admin-guide/hw-vuln/multihitmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget0/translations/ja_JP/admin-guide/hw-vuln/multihitmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget0/translations/ko_KR/admin-guide/hw-vuln/multihitmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget0/translations/sp_SP/admin-guide/hw-vuln/multihitmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhsection)}(hhh](htitle)}(h iTLB multihith]h iTLB multihit}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhJ/var/lib/git/docbuild/linux/Documentation/admin-guide/hw-vuln/multihit.rsthKubh paragraph)}(hXiTLB multihit is an erratum where some processors may incur a machine check error, possibly resulting in an unrecoverable CPU lockup, when an instruction fetch hits multiple entries in the instruction TLB. This can occur when the page size is changed along with either the physical address or cache type. A malicious guest running on a virtualized system can exploit this erratum to perform a denial of service attack.h]hXiTLB multihit is an erratum where some processors may incur a machine check error, possibly resulting in an unrecoverable CPU lockup, when an instruction fetch hits multiple entries in the instruction TLB. This can occur when the page size is changed along with either the physical address or cache type. A malicious guest running on a virtualized system can exploit this erratum to perform a denial of service attack.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hhh](h)}(hAffected processorsh]hAffected processors}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhK ubh)}(hsVariations of this erratum are present on most Intel Core and Xeon processor models. The erratum is not present on:h]hsVariations of this erratum are present on most Intel Core and Xeon processor models. The erratum is not present on:}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh block_quote)}(h- non-Intel processors - Some Atoms (Airmont, Bonnell, Goldmont, GoldmontPlus, Saltwell, Silvermont) - Intel processors that have the PSCHANGE_MC_NO bit set in the IA32_ARCH_CAPABILITIES MSR. h]h bullet_list)}(hhh](h list_item)}(hnon-Intel processors h]h)}(hnon-Intel processorsh]hnon-Intel processors}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhubah}(h]h ]h"]h$]h&]uh1hhhubh)}(hLSome Atoms (Airmont, Bonnell, Goldmont, GoldmontPlus, Saltwell, Silvermont) h]h)}(hKSome Atoms (Airmont, Bonnell, Goldmont, GoldmontPlus, Saltwell, Silvermont)h]hKSome Atoms (Airmont, Bonnell, Goldmont, GoldmontPlus, Saltwell, Silvermont)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1hhhubh)}(hZIntel processors that have the PSCHANGE_MC_NO bit set in the IA32_ARCH_CAPABILITIES MSR. h]h)}(hXIntel processors that have the PSCHANGE_MC_NO bit set in the IA32_ARCH_CAPABILITIES MSR.h]hXIntel processors that have the PSCHANGE_MC_NO bit set in the IA32_ARCH_CAPABILITIES MSR.}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj#ubah}(h]h ]h"]h$]h&]uh1hhhubeh}(h]h ]h"]h$]h&]bullet-uh1hhhhKhhubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubeh}(h]affected-processorsah ]h"]affected processorsah$]h&]uh1hhhhhhhhK ubh)}(hhh](h)}(h Related CVEsh]h Related CVEs}(hjThhhNhNubah}(h]h ]h"]h$]h&]uh1hhjQhhhhhKubh)}(h1The following CVE entry is related to this issue:h]h1The following CVE entry is related to this issue:}(hjbhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjQhhubh)}(h============== ================================================= CVE-2018-12207 Machine Check Error Avoidance on Page Size Change ============== ================================================= h]htable)}(hhh]htgroup)}(hhh](hcolspec)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1j~hj{ubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthK1uh1j~hj{ubhtbody)}(hhh]hrow)}(hhh](hentry)}(hhh]h)}(hCVE-2018-12207h]hCVE-2018-12207}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h1Machine Check Error Avoidance on Page Size Changeh]h1Machine Check Error Avoidance on Page Size Change}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jhj{ubeh}(h]h ]h"]h$]h&]colsKuh1jyhjvubah}(h]h ]h"]h$]h&]uh1jthjpubah}(h]h ]h"]h$]h&]uh1hhhhKhjQhhubeh}(h] related-cvesah ]h"] related cvesah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hProblemh]hProblem}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK%ubh)}(hXPrivileged software, including OS and virtual machine managers (VMM), are in charge of memory management. A key component in memory management is the control of the page tables. Modern processors use virtual memory, a technique that creates the illusion of a very large memory for processors. This virtual space is split into pages of a given size. Page tables translate virtual addresses to physical addresses.h]hXPrivileged software, including OS and virtual machine managers (VMM), are in charge of memory management. A key component in memory management is the control of the page tables. Modern processors use virtual memory, a technique that creates the illusion of a very large memory for processors. This virtual space is split into pages of a given size. Page tables translate virtual addresses to physical addresses.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK'hjhhubh)}(hTo reduce latency when performing a virtual to physical address translation, processors include a structure, called TLB, that caches recent translations. There are separate TLBs for instruction (iTLB) and data (dTLB).h]hTo reduce latency when performing a virtual to physical address translation, processors include a structure, called TLB, that caches recent translations. There are separate TLBs for instruction (iTLB) and data (dTLB).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK.hjhhubh)}(hXUnder this errata, instructions are fetched from a linear address translated using a 4 KB translation cached in the iTLB. Privileged software modifies the paging structure so that the same linear address using large page size (2 MB, 4 MB, 1 GB) with a different physical address or memory type. After the page structure modification but before the software invalidates any iTLB entries for the linear address, a code fetch that happens on the same linear address may cause a machine-check error which can result in a system hang or shutdown.h]hXUnder this errata, instructions are fetched from a linear address translated using a 4 KB translation cached in the iTLB. Privileged software modifies the paging structure so that the same linear address using large page size (2 MB, 4 MB, 1 GB) with a different physical address or memory type. After the page structure modification but before the software invalidates any iTLB entries for the linear address, a code fetch that happens on the same linear address may cause a machine-check error which can result in a system hang or shutdown.}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK2hjhhubeh}(h]problemah ]h"]problemah$]h&]uh1hhhhhhhhK%ubh)}(hhh](h)}(hAttack scenariosh]hAttack scenarios}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj8hhhhhKhj8hhubeh}(h]attack-scenariosah ]h"]attack scenariosah$]h&]uh1hhhhhhhhKubah}(h]h ]h"]h$]h&]uh1jhj$ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hKVM: Mitigation: VMX disabledh]hKVM: Mitigation: VMX disabled}(hjahhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKUhj^ubah}(h]h ]h"]h$]h&]uh1jhj[ubj)}(hhh]h)}(hKKVM is not vulnerable because Virtual Machine Extensions (VMX) is disabled.h]hKKVM is not vulnerable because Virtual Machine Extensions (VMX) is disabled.}(hjxhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKVhjuubah}(h]h ]h"]h$]h&]uh1jhj[ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hKVM: Vulnerableh]hKVM: Vulnerable}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKWhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h6The processor is vulnerable, but no mitigation enabledh]h6The processor is vulnerable, but no mitigation enabled}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKXhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]colsKuh1jyhjubah}(h]h ]h"]h$]h&]uh1jthj_hhhNhNubeh}(h] itlb-multihit-system-informationah ]h"] itlb multihit system informationah$]h&]uh1hhhhhhhhKCubh)}(hhh](h)}(hEnumeration of the erratumh]hEnumeration of the erratum}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK\ubh)}(hA new bit has been allocated in the IA32_ARCH_CAPABILITIES (PSCHANGE_MC_NO) msr and will be set on CPU's which are mitigated against this issue.h]hA new bit has been allocated in the IA32_ARCH_CAPABILITIES (PSCHANGE_MC_NO) msr and will be set on CPU’s which are mitigated against this issue.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK^hjhhubh)}(hX======================================= =========== =============================== IA32_ARCH_CAPABILITIES MSR Not present Possibly vulnerable,check model IA32_ARCH_CAPABILITIES[PSCHANGE_MC_NO] '0' Likely vulnerable,check model IA32_ARCH_CAPABILITIES[PSCHANGE_MC_NO] '1' Not vulnerable ======================================= =========== =============================== h]ju)}(hhh]jz)}(hhh](j)}(hhh]h}(h]h ]h"]h$]h&]colwidthK'uh1j~hj ubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1j~hj ubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1j~hj ubj)}(hhh](j)}(hhh](j)}(hhh]h)}(hIA32_ARCH_CAPABILITIES MSRh]hIA32_ARCH_CAPABILITIES MSR}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKbhj1ubah}(h]h ]h"]h$]h&]uh1jhj.ubj)}(hhh]h)}(h Not presenth]h Not present}(hjKhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKbhjHubah}(h]h ]h"]h$]h&]uh1jhj.ubj)}(hhh]h)}(hPossibly vulnerable,check modelh]hPossibly vulnerable,check model}(hjbhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKbhj_ubah}(h]h ]h"]h$]h&]uh1jhj.ubeh}(h]h ]h"]h$]h&]uh1jhj+ubj)}(hhh](j)}(hhh]h)}(h&IA32_ARCH_CAPABILITIES[PSCHANGE_MC_NO]h]h&IA32_ARCH_CAPABILITIES[PSCHANGE_MC_NO]}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKchjubah}(h]h ]h"]h$]h&]uh1jhj|ubj)}(hhh]h)}(h'0'h]h‘0’}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKchjubah}(h]h ]h"]h$]h&]uh1jhj|ubj)}(hhh]h)}(hLikely vulnerable,check modelh]hLikely vulnerable,check model}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKchjubah}(h]h ]h"]h$]h&]uh1jhj|ubeh}(h]h ]h"]h$]h&]uh1jhj+ubj)}(hhh](j)}(hhh]h)}(h&IA32_ARCH_CAPABILITIES[PSCHANGE_MC_NO]h]h&IA32_ARCH_CAPABILITIES[PSCHANGE_MC_NO]}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKdhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h'1'h]h‘1’}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKdhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hNot vulnerableh]hNot vulnerable}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKdhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhj+ubeh}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]colsKuh1jyhjubah}(h]h ]h"]h$]h&]uh1jthjubah}(h]h ]h"]h$]h&]uh1hhhhKahjhhubeh}(h]enumeration-of-the-erratumah ]h"]enumeration of the erratumah$]h&]uh1hhhhhhhhK\ubh)}(hhh](h)}(hMitigation mechanismh]hMitigation mechanism}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj9hhhhhKiubh)}(hThis erratum can be mitigated by restricting the use of large page sizes to non-executable pages. This forces all iTLB entries to be 4K, and removes the possibility of multiple hits.h]hThis erratum can be mitigated by restricting the use of large page sizes to non-executable pages. This forces all iTLB entries to be 4K, and removes the possibility of multiple hits.}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKkhj9hhubh)}(hIn order to mitigate the vulnerability, KVM initially marks all huge pages as non-executable. If the guest attempts to execute in one of those pages, the page is broken down into 4K pages, which are then marked executable.h]hIn order to mitigate the vulnerability, KVM initially marks all huge pages as non-executable. If the guest attempts to execute in one of those pages, the page is broken down into 4K pages, which are then marked executable.}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKohj9hhubh)}(hXIf EPT is disabled or not available on the host, KVM is in control of TLB flushes and the problematic situation cannot happen. However, the shadow EPT paging mechanism used by nested virtualization is vulnerable, because the nested guest can trigger multiple iTLB hits by modifying its own (non-nested) page tables. For simplicity, KVM will make large pages non-executable in all shadow paging modes.h]hXIf EPT is disabled or not available on the host, KVM is in control of TLB flushes and the problematic situation cannot happen. However, the shadow EPT paging mechanism used by nested virtualization is vulnerable, because the nested guest can trigger multiple iTLB hits by modifying its own (non-nested) page tables. For simplicity, KVM will make large pages non-executable in all shadow paging modes.}(hjfhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKshj9hhubeh}(h]mitigation-mechanismah ]h"]mitigation mechanismah$]h&]uh1hhhhhhhhKiubh)}(hhh](h)}(hHMitigation control on the kernel command line and KVM - module parameterh]hHMitigation control on the kernel command line and KVM - module parameter}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhj|hhhhhK{ubh)}(hXThe KVM hypervisor mitigation mechanism for marking huge pages as non-executable can be controlled with a module parameter "nx_huge_pages=". The kernel command line allows to control the iTLB multihit mitigations at boot time with the option "kvm.nx_huge_pages=".h]hXThe KVM hypervisor mitigation mechanism for marking huge pages as non-executable can be controlled with a module parameter “nx_huge_pages=”. The kernel command line allows to control the iTLB multihit mitigations at boot time with the option “kvm.nx_huge_pages=”.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK}hj|hhubh)}(h*The valid arguments for these options are:h]h*The valid arguments for these options are:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj|hhubh)}(hX========== ================================================================ force Mitigation is enabled. In this case, the mitigation implements non-executable huge pages in Linux kernel KVM module. All huge pages in the EPT are marked as non-executable. If a guest attempts to execute in one of those pages, the page is broken down into 4K pages, which are then marked executable. off Mitigation is disabled. auto Enable mitigation only if the platform is affected and the kernel was not booted with the "mitigations=off" command line parameter. This is the default option. ========== ================================================================ h]ju)}(hhh]jz)}(hhh](j)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1j~hjubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthKAuh1j~hjubj)}(hhh](j)}(hhh](j)}(hhh]h)}(hforceh]hforce}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hX+Mitigation is enabled. In this case, the mitigation implements non-executable huge pages in Linux kernel KVM module. All huge pages in the EPT are marked as non-executable. If a guest attempts to execute in one of those pages, the page is broken down into 4K pages, which are then marked executable.h]hX+Mitigation is enabled. In this case, the mitigation implements non-executable huge pages in Linux kernel KVM module. All huge pages in the EPT are marked as non-executable. If a guest attempts to execute in one of those pages, the page is broken down into 4K pages, which are then marked executable.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hoffh]hoff}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hMitigation is disabled.h]hMitigation is disabled.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hautoh]hauto}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj;ubah}(h]h ]h"]h$]h&]uh1jhj8ubj)}(hhh]h)}(hEnable mitigation only if the platform is affected and the kernel was not booted with the "mitigations=off" command line parameter. This is the default option.h]hEnable mitigation only if the platform is affected and the kernel was not booted with the “mitigations=off” command line parameter. This is the default option.}(hjUhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjRubah}(h]h ]h"]h$]h&]uh1jhj8ubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]colsKuh1jyhjubah}(h]h ]h"]h$]h&]uh1jthjubah}(h]h ]h"]h$]h&]uh1hhhhKhj|hhubeh}(h]Fmitigation-control-on-the-kernel-command-line-and-kvm-module-parameterah ]h"]Hmitigation control on the kernel command line and kvm - module parameterah$]h&]uh1hhhhhhhhK{ubh)}(hhh](h)}(hMitigation selection guideh]hMitigation selection guide}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(h1. No virtualization in useh]h1. No virtualization in use}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hYThe system is protected by the kernel unconditionally and no further action is required. h]h)}(hXThe system is protected by the kernel unconditionally and no further action is required.h]hXThe system is protected by the kernel unconditionally and no further action is required.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]no-virtualization-in-useah ]h"]1. no virtualization in useah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(h%2. Virtualization with trusted guestsh]h%2. Virtualization with trusted guests}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hIf the guest comes from a trusted source, you may assume that the guest will not attempt to maliciously exploit these errata and no further action is required. h]h)}(hIf the guest comes from a trusted source, you may assume that the guest will not attempt to maliciously exploit these errata and no further action is required.h]hIf the guest comes from a trusted source, you may assume that the guest will not attempt to maliciously exploit these errata and no further action is required.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]"virtualization-with-trusted-guestsah ]h"]%2. virtualization with trusted guestsah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(h'3. Virtualization with untrusted guestsh]h'3. Virtualization with untrusted guests}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hIf the guest comes from an untrusted source, the guest host kernel will need to apply iTLB multihit mitigation via the kernel command line or kvm module parameter.h]h)}(hIf the guest comes from an untrusted source, the guest host kernel will need to apply iTLB multihit mitigation via the kernel command line or kvm module parameter.h]hIf the guest comes from an untrusted source, the guest host kernel will need to apply iTLB multihit mitigation via the kernel command line or kvm module parameter.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]$virtualization-with-untrusted-guestsah ]h"]'3. virtualization with untrusted guestsah$]h&]uh1hhjhhhhhKubeh}(h]mitigation-selection-guideah ]h"]mitigation selection guideah$]h&]uh1hhhhhhhhKubeh}(h] itlb-multihitah ]h"] itlb multihitah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksjfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjferror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}refids}nameids}(jAj>jNjKjjj5j2j\jYjjj6j3jyjvjjj9j6jjjjj1j.u nametypes}(jAjNjj5j\jj6jyjj9jjj1uh}(j>hjKhjjQj2jjYj8jj_j3jjvj9jj|j6jjjjjj.ju footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages] transformerN include_log] decorationNhhub.