Commit a6c18d4e authored by Andrey Konovalov's avatar Andrey Konovalov Committed by Linus Torvalds

kasan: docs: update SW_TAGS implementation details section

Update the "Implementation details" section for SW_TAGS KASAN:

 - Clarify the introduction sentence.

 - Punctuation, readability, and other minor clean-ups.

Link: https://lkml.kernel.org/r/69b9b2e49d8cf789358fa24558be3fc0ce4ee32c.1615559068.git.andreyknvl@google.comSigned-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Reviewed-by: default avatarMarco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent b8191d7d
...@@ -244,38 +244,37 @@ quarantine (see mm/kasan/quarantine.c for implementation). ...@@ -244,38 +244,37 @@ quarantine (see mm/kasan/quarantine.c for implementation).
Software tag-based KASAN Software tag-based KASAN
~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~
Software tag-based KASAN requires software memory tagging support in the form Software tag-based KASAN uses a software memory tagging approach to checking
of HWASan-like compiler instrumentation (see HWASan documentation for details). access validity. It is currently only implemented for the arm64 architecture.
Software tag-based KASAN is currently only implemented for arm64 architecture.
Software tag-based KASAN uses the Top Byte Ignore (TBI) feature of arm64 CPUs Software tag-based KASAN uses the Top Byte Ignore (TBI) feature of arm64 CPUs
to store a pointer tag in the top byte of kernel pointers. Like generic KASAN to store a pointer tag in the top byte of kernel pointers. It uses shadow memory
it uses shadow memory to store memory tags associated with each 16-byte memory to store memory tags associated with each 16-byte memory cell (therefore, it
cell (therefore it dedicates 1/16th of the kernel memory for shadow memory). dedicates 1/16th of the kernel memory for shadow memory).
On each memory allocation software tag-based KASAN generates a random tag, tags On each memory allocation, software tag-based KASAN generates a random tag, tags
the allocated memory with this tag, and embeds this tag into the returned the allocated memory with this tag, and embeds the same tag into the returned
pointer. pointer.
Software tag-based KASAN uses compile-time instrumentation to insert checks Software tag-based KASAN uses compile-time instrumentation to insert checks
before each memory access. These checks make sure that tag of the memory that before each memory access. These checks make sure that the tag of the memory
is being accessed is equal to tag of the pointer that is used to access this that is being accessed is equal to the tag of the pointer that is used to access
memory. In case of a tag mismatch software tag-based KASAN prints a bug report. this memory. In case of a tag mismatch, software tag-based KASAN prints a bug
report.
Software tag-based KASAN also has two instrumentation modes (outline, that Software tag-based KASAN also has two instrumentation modes (outline, which
emits callbacks to check memory accesses; and inline, that performs the shadow emits callbacks to check memory accesses; and inline, which performs the shadow
memory checks inline). With outline instrumentation mode, a bug report is memory checks inline). With outline instrumentation mode, a bug report is
simply printed from the function that performs the access check. With inline printed from the function that performs the access check. With inline
instrumentation a brk instruction is emitted by the compiler, and a dedicated instrumentation, a ``brk`` instruction is emitted by the compiler, and a
brk handler is used to print bug reports. dedicated ``brk`` handler is used to print bug reports.
Software tag-based KASAN uses 0xFF as a match-all pointer tag (accesses through Software tag-based KASAN uses 0xFF as a match-all pointer tag (accesses through
pointers with 0xFF pointer tag aren't checked). The value 0xFE is currently pointers with the 0xFF pointer tag are not checked). The value 0xFE is currently
reserved to tag freed memory regions. reserved to tag freed memory regions.
Software tag-based KASAN currently only supports tagging of Software tag-based KASAN currently only supports tagging of slab and page_alloc
kmem_cache_alloc/kmalloc and page_alloc memory. memory.
Hardware tag-based KASAN Hardware tag-based KASAN
~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment