Re: [PATCH 0/3] KASAN: HW_TAGS: Disable tagging for stack and page-tables

[David Hildenbrand (Arm)]

On 3/19/26 12:49, Muhammad Usama Anjum wrote:
> Stacks and page tables are always accessed with the match‑all tag,
> so assigning a new random tag every time at allocation and setting
> invalid tag at deallocation time, just adds overhead without improving
> the detection.
> 
> With __GFP_SKIP_KASAN the page keeps its poison tag and KASAN_TAG_KERNEL
> (match-all tag) is stored in the page flags while keeping the poison tag
> in the hardware. The benefit of it is that 256 tag setting instruction
> per 4 kB page aren't needed at allocation and deallocation time.
> 
> Thus match‑all pointers still work, while non‑match tags (other than
> poison tag) still fault.
> 
> __GFP_SKIP_KASAN only skips for KASAN_HW_TAGS mode, so coverage is
> unchanged.
> 
> Benchmark:
> The benchmark has two modes. In thread mode, the child process forks
> and creates N threads. In pgtable mode, the parent maps and faults a
> specified memory size and then forks repeatedly with children exiting
> immediately.
> 
> Thread benchmark:
> 2000 iterations, 2000 threads:	2.575 s → 2.229 s (~13.4% faster)
> 
> The pgtable samples:
> - 2048 MB, 2000 iters		19.08 s → 17.62 s (~7.6% faster)

As discussed offline, I think we should look into finding a better name
for __GFP_SKIP_KASAN now that we are using it more broadly. It's confusing.

The semantics are:
* Only applies to HW KASAN right now. Otherwise it's ignored. So it
  doesn't give any guarantees.
* Will currently leave memory tagged with some tag (poisoned), but
  tag checks will be disabled by using the match-all pointer.

After pondering about that for a while, I realized that today, all
memory is tagged by default, and __GFP_SKIP_KASAN is our mechanism to
request memory that will not be tag-checked (close to if it would be not
tagged).

Is there a real difference to getting untagged memory, if supported by
the architecture.

So I was wondering if

	__GFP_UNTAGGED: if possible, return memory that is either
			untagged or that is tagged but has tag checks
			disabled when accessed through page_address().
			Using this flag can speed up page allocation
			and freeing, and can reduce runtime overhead
			by not performing page checking. For now,
			only considered with HW-tag based KASAN.

Would be the right thing to do.

Assuming we could/would ever change the default from "all memory is
tagged" to "all memory is untagged", we could similarly introduce:

	__GFP_TAGGED:  if possible, return memory that is tagged and
		       and has tag checks enabled.

We could make it clearer that there are no guarantees. Like calling it
__GFP_PREF_UNTAGGED / __GFP_PREF_TAGGED.


(__GFP_TAGGED would obviously be something for the future)

-- 
Cheers,

David