Re: [PATCH 0/3] KASAN: HW_TAGS: Disable tagging for stack and page-tables

[Muhammad Usama Anjum <usama.anjum@arm.com>]

On 20/03/2026 8:53 am, David Hildenbrand (Arm) wrote:
> On 3/19/26 12:49, Muhammad Usama Anjum wrote:
>> Stacks and page tables are always accessed with the match‑all tag,
>> so assigning a new random tag every time at allocation and setting
>> invalid tag at deallocation time, just adds overhead without improving
>> the detection.
>>
>> With __GFP_SKIP_KASAN the page keeps its poison tag and KASAN_TAG_KERNEL
>> (match-all tag) is stored in the page flags while keeping the poison tag
>> in the hardware. The benefit of it is that 256 tag setting instruction
>> per 4 kB page aren't needed at allocation and deallocation time.
>>
>> Thus match‑all pointers still work, while non‑match tags (other than
>> poison tag) still fault.
>>
>> __GFP_SKIP_KASAN only skips for KASAN_HW_TAGS mode, so coverage is
>> unchanged.
>>
>> Benchmark:
>> The benchmark has two modes. In thread mode, the child process forks
>> and creates N threads. In pgtable mode, the parent maps and faults a
>> specified memory size and then forks repeatedly with children exiting
>> immediately.
>>
>> Thread benchmark:
>> 2000 iterations, 2000 threads:	2.575 s → 2.229 s (~13.4% faster)
>>
>> The pgtable samples:
>> - 2048 MB, 2000 iters		19.08 s → 17.62 s (~7.6% faster)
> 
> As discussed offline, I think we should look into finding a better name
> for __GFP_SKIP_KASAN now that we are using it more broadly. It's confusing.
Agreed that its confusing and the name doesn't show its under-the-hood usage.

> 
> The semantics are:
> * Only applies to HW KASAN right now. Otherwise it's ignored. So it
>   doesn't give any guarantees.
> * Will currently leave memory tagged with some tag (poisoned), but
>   tag checks will be disabled by using the match-all pointer.
> 
> After pondering about that for a while, I realized that today, all
> memory is tagged by default, and __GFP_SKIP_KASAN is our mechanism to
> request memory that will not be tag-checked (close to if it would be not
> tagged).
KASAN uses the poisoning and un-poisoning terminologies. It depends upon
the type of KASAN enabled that how poisoning/unpoisoning is done. 

> 
> Is there a real difference to getting untagged memory, if supported by
> the architecture.
> 
> So I was wondering if
> 
> 	__GFP_UNTAGGED: if possible, return memory that is either
> 			untagged or that is tagged but has tag checks
> 			disabled when accessed through page_address().
> 			Using this flag can speed up page allocation
> 			and freeing, and can reduce runtime overhead
> 			by not performing page checking. For now,
> 			only considered with HW-tag based KASAN.
Its again confusing as __GFP_UNTAGGED will not return untagged memory
in case of KASAN_SW_TAGS. 

As __GFP_SKIP_KASAN skips only for HW_TAGS mode, the more appropriate name
may be:
	__GFP_SKIP_HW_POSION

No matter the final name, it may be worth the effort to rename / do better
handling of this in the code. Let's keep it a separate from this series.

> 
> Would be the right thing to do.
> 
> Assuming we could/would ever change the default from "all memory is
> tagged" to "all memory is untagged", we could similarly introduce:
> 
> 	__GFP_TAGGED:  if possible, return memory that is tagged and
> 		       and has tag checks enabled.
> 
> We could make it clearer that there are no guarantees. Like calling it
> __GFP_PREF_UNTAGGED / __GFP_PREF_TAGGED.
> 
> 
> (__GFP_TAGGED would obviously be something for the future)
>