arm64 Tagged-Address ABI: Pointer consistency across kernel-user boundaries
0 reputation · 31 May 2025, 05:13 UTC
User-space Tagged Address Metadata
On AArch64 Linux systems with 48-bit virtual addresses, the CONFIG_ARM64_TAGGED_ADDR_ABI configuration and prctl(PR_SET_TAGGED_ADDR_CTRL) allow tasks to utilize the top byte of pointers for metadata. While this enables efficient memory tagging in user-space, the behavior of these pointers when crossing the kernel boundary remains a critical compatibility concern.
Boundary Uncertainty
There is significant uncertainty regarding how the kernel handles pointers with set tag bits when they are passed as arguments to system calls, returned as values, or delivered via signal contexts and ptrace. Depending on the kernel version and specific subsystem, these tagged pointers may be preserved, stripped of their metadata, or rejected as invalid addresses.
This inconsistency creates a challenge for developers building libraries that rely on tagged pointers but must interact with various kernel versions or different VA_BITS configurations (48 vs 52).
- How does the kernel consistently handle tagged pointers passed via system call arguments across different
CONFIG_ARM64_TAGGED_ADDR_ABIstates? - Are there documented rules for whether the kernel preserves or clears the top-byte tags when returning pointers to user-space?
