arm64 Tagged-Address ABI: Pointer consistency across kernel-user boundaries

Direct Answer

When CONFIG_ARM64_TAGGED_ADDR_ABI is enabled, the kernel accepts tagged pointers in system-call arguments by masking off the top byte during address validation (via untagged_addr()), but it does not preserve tags on pointers returned to user-space (e.g., mmap, mremap return zero-tagged addresses). If the config is disabled or the task has not enabled tagged addressing via prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE), passing a tagged pointer typically yields EFAULT. The documented ABI guarantees only acceptance of tagged inputs — not round-trip tag survival.

Confirmed Kernel Behavior

System-Call Arguments

• Config enabled + prctl enabled: Kernel strips the top byte internally via untagged_addr() before validating the address. The syscall succeeds as if the pointer were untagged.
• Config enabled + prctl disabled: Tagged pointers are rejected with EFAULT.
• Config disabled (pre-5.10 kernels): Tagged pointers always cause EFAULT regardless of prctl state.

Return Values & Kernel-Generated Pointers

• Pointers returned from the kernel (mmap, mremap, shmat, etc.) have the top byte cleared to zero. Libraries must not assume tags survive a kernel round-trip.
• Kernel-internal pointers placed in siginfo_t (e.g., si_ptr for SIGIO) are likewise untagged.

Signal Delivery & Ptrace

• User-space register state delivered to signal handlers (si_addr, faulting PC/SP in ucontext_t) preserves the original top-byte tags because the kernel copies raw registers.
• ptrace (PTRACE_GETREGSET/SETREGSET, PTRACE_PEEKUSER/POKEUSER) exposes and accepts raw tagged register values — tags are not stripped.

VA_BITS Variations

With CONFIG_ARM64_VA_BITS=52, the tag still occupies bits 56–63; the same untagged_addr() masking applies. Hardware TBI (TCR_EL1.TBI0/1) must be enabled per-task (the kernel does this when tagged-address control is active).

Practical Verification

1. Check kernel support:

   grep -E 'CONFIG_ARM64_TAGGED_ADDR_ABI|CONFIG_ARM64_VA_BITS' /boot/config-$(uname -r)

2. Test syscall acceptance (compile & run):

   #include <sys/mman.h>
   #include <stdint.h>
   #include <stdio.h>
   #include <sys/prctl.h>
   #include <linux/prctl.h>
   
   int main() {
       prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0);
       void *p = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
                      MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
       uintptr_t tagged = (uintptr_t)p | 0x4200000000000000ULL;
       void *ret = mmap((void*)tagged, 4096, PROT_READ|PROT_WRITE,
                        MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0);
       printf("mmap returned: %p (tag: 0x%02lx)\n", ret, ((uintptr_t)ret >> 56) & 0xFF);
       return 0;
   }

3. Inspect signal si_addr tag preservation:

   #include <signal.h>
   #include <stdio.h>
   #include <stdint.h>
   #include <sys/prctl.h>
   #include <linux/prctl.h>
   
   void handler(int sig, siginfo_t *si, void *uc) {
       printf("si_addr tag: 0x%02lx\n", ((uintptr_t)si->si_addr >> 56) & 0xFF);
       _exit(0);
   }
   
   int main() {
       prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0);
       struct sigaction sa = {.sa_sigaction = handler, .sa_flags = SA_SIGINFO};
       sigaction(SIGSEGV, &sa, NULL);
       uintptr_t tagged = 0x4200000000001000ULL;
       *(volatile char*)tagged = 0;  // fault with tagged address
       return 0;
   }

One Diagnostic Detail Needed

What is the exact kernel version (uname -r) and CONFIG_ARM64_VA_BITS value (48 or 52) on your target deployment? This determines whether the tagged-address ABI is present and which TBI register bits apply.