On Fri, Mar 12, 2021 at 03:24PM +0100, Andrey Konovalov wrote: > Update the "Implementation details" section for SW_TAGS KASAN: > > - Clarify the introduction sentence. > - Punctuation, readability, and other minor clean-ups. > > Signed-off-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx> Reviewed-by: Marco Elver <elver@xxxxxxxxxx> > --- > Documentation/dev-tools/kasan.rst | 39 +++++++++++++++---------------- > 1 file changed, 19 insertions(+), 20 deletions(-) > > diff --git a/Documentation/dev-tools/kasan.rst b/Documentation/dev-tools/kasan.rst > index 986410bf269f..5873d80cc1fd 100644 > --- a/Documentation/dev-tools/kasan.rst > +++ b/Documentation/dev-tools/kasan.rst > @@ -235,38 +235,37 @@ quarantine (see mm/kasan/quarantine.c for implementation). > Software tag-based KASAN > ~~~~~~~~~~~~~~~~~~~~~~~~ > > -Software tag-based KASAN requires software memory tagging support in the form > -of HWASan-like compiler instrumentation (see HWASan documentation for details). > - > -Software tag-based KASAN is currently only implemented for arm64 architecture. > +Software tag-based KASAN uses a software memory tagging approach to checking > +access validity. It is currently only implemented for the arm64 architecture. > > Software tag-based KASAN uses the Top Byte Ignore (TBI) feature of arm64 CPUs > -to store a pointer tag in the top byte of kernel pointers. Like generic KASAN > -it uses shadow memory to store memory tags associated with each 16-byte memory > -cell (therefore it dedicates 1/16th of the kernel memory for shadow memory). > +to store a pointer tag in the top byte of kernel pointers. It uses shadow memory > +to store memory tags associated with each 16-byte memory cell (therefore, it > +dedicates 1/16th of the kernel memory for shadow memory). > > -On each memory allocation software tag-based KASAN generates a random tag, tags > -the allocated memory with this tag, and embeds this tag into the returned > +On each memory allocation, software tag-based KASAN generates a random tag, tags > +the allocated memory with this tag, and embeds the same tag into the returned > pointer. > > Software tag-based KASAN uses compile-time instrumentation to insert checks > -before each memory access. These checks make sure that tag of the memory that > -is being accessed is equal to tag of the pointer that is used to access this > -memory. In case of a tag mismatch software tag-based KASAN prints a bug report. > +before each memory access. These checks make sure that the tag of the memory > +that is being accessed is equal to the tag of the pointer that is used to access > +this memory. In case of a tag mismatch, software tag-based KASAN prints a bug > +report. > > -Software tag-based KASAN also has two instrumentation modes (outline, that > -emits callbacks to check memory accesses; and inline, that performs the shadow > +Software tag-based KASAN also has two instrumentation modes (outline, which > +emits callbacks to check memory accesses; and inline, which performs the shadow > memory checks inline). With outline instrumentation mode, a bug report is > -simply printed from the function that performs the access check. With inline > -instrumentation a brk instruction is emitted by the compiler, and a dedicated > -brk handler is used to print bug reports. > +printed from the function that performs the access check. With inline > +instrumentation, a ``brk`` instruction is emitted by the compiler, and a > +dedicated ``brk`` handler is used to print bug reports. > > Software tag-based KASAN uses 0xFF as a match-all pointer tag (accesses through > -pointers with 0xFF pointer tag aren't checked). The value 0xFE is currently > +pointers with the 0xFF pointer tag are not checked). The value 0xFE is currently > reserved to tag freed memory regions. > > -Software tag-based KASAN currently only supports tagging of > -kmem_cache_alloc/kmalloc and page_alloc memory. > +Software tag-based KASAN currently only supports tagging of slab and page_alloc > +memory. > > Hardware tag-based KASAN > ~~~~~~~~~~~~~~~~~~~~~~~~ > -- > 2.31.0.rc2.261.g7f71774620-goog >
