Yes. The thing which is controlled per-process (per-thread, really) is the extent to which you can pass a tagged address to a kernel syscall and have it strip t

Yes. The thing which is controlled per-process (per-thread, really) is the extent to which you can pass a tagged address to a kernel syscall and have it strip the tag and operate on the 'real' address versus handing you a 'bad address' error. The default is 'syscalls (mostly) don't detag addresses'. https://www.kernel.org/doc/html/latest/arm64/tagged-address-abi.html https://www.kernel.org/doc/html/latest/arm64/tagged-address-... has the details. Because TBI is separate for userspace and the kernel you could make it per-process -- just context switch the TBI control bit. But there's no need.