Documentation/dev-tools/kasan.rst

13 2. Software Tag-Based KASAN
14 3. Hardware Tag-Based KASAN
20 Software Tag-Based KASAN or SW_TAGS KASAN, enabled with CONFIG_KASAN_SW_TAGS,
25 Hardware Tag-Based KASAN or HW_TAGS KASAN, enabled with CONFIG_KASAN_HW_TAGS,
34 The Generic and the Software Tag-Based modes are commonly referred to as the
35 software modes. The Software Tag-Based and the Hardware Tag-Based modes are
36 referred to as the tag-based modes.
45 and loongarch, and the tag-based KASAN modes are supported only on arm64.
52 support for that. The Hardware Tag-Based mode relies on hardware to perform
59 Software Tag-Based KASAN requires GCC 11+
62 Hardware Tag-Based KASAN requires GCC 10+ or Clang 12+.
70 Software Tag-Based KASAN supports slab, page_alloc, vmalloc, and stack memory.
72 Hardware Tag-Based KASAN supports slab, page_alloc, and non-executable vmalloc
76 Hardware Tag-Based KASAN only supports SLUB.
86 ``CONFIG_KASAN_SW_TAGS`` (to enable Software Tag-Based KASAN), and
87 ``CONFIG_KASAN_HW_TAGS`` (to enable Hardware Tag-Based KASAN).
114   Hardware Tag-Based KASAN, ``kasan.fault=panic_on_write`` always panics on
117 Software and Hardware Tag-Based KASAN modes (see the section about various
125 Hardware Tag-Based KASAN mode is intended for use in production as a security
152   Note that enabling this parameter makes Hardware Tag-Based KASAN skip checks
265 For tag-based KASAN modes, this last report section shows the memory tags around
269 are best-effort: KASAN prints the most probable bug type based on the limited
315 Software Tag-Based KASAN
318 Software Tag-Based KASAN uses a software memory tagging approach to checking
321 Software Tag-Based KASAN uses the Top Byte Ignore (TBI) feature of arm64 CPUs
326 On each memory allocation, Software Tag-Based KASAN generates a random tag, tags
330 Software Tag-Based KASAN uses compile-time instrumentation to insert checks
333 this memory. In case of a tag mismatch, Software Tag-Based KASAN prints a bug
336 Software Tag-Based KASAN also has two instrumentation modes (outline, which
343 Software Tag-Based KASAN uses 0xFF as a match-all pointer tag (accesses through
347 Hardware Tag-Based KASAN
350 Hardware Tag-Based KASAN is similar to the software mode in concept but uses
354 Hardware Tag-Based KASAN is currently only implemented for arm64 architecture
355 and based on both arm64 Memory Tagging Extension (MTE) introduced in ARMv8.5
364 Hardware Tag-Based KASAN uses 0xFF as a match-all pointer tag (accesses through
368 If the hardware does not support MTE (pre ARMv8.5), Hardware Tag-Based KASAN
375 Hardware Tag-Based KASAN only reports the first found bug. After that, MTE tag
474 Tag-Based KASAN, which does not use compiler instrumentation.
481 For tag-based KASAN modes, to disable access checking, use