If I'm reading the pseudo-assembler of the function names correctly, it looks like in the i386 code we're already masking the address being checked:
tgen_arithi(s, ARITH_AND + trexw, r1, TARGET_PAGE_MASK | (aligned ? s_mask : 0), 0);
where TARGET_PAGE_MASK is a simple all-1's mask in the appropriate upper bits.
Can we just poke some 0's into that mask in the tag locations? And, of course, do the same when creating the TLB entry.
Unless of course we're in the case of (TARGET_LONG_BITS > TCG_TARGET_REG_BITS) (that would be 64 bit on 32 bit right?) when addrhi gets tested separately. Then we'd have to do the shift as above.
MIPS logic appears similar on a quick read. In the sparc code I'm not seeing a pre-existing mask but it's getting late and my eyes are giving out. Those are the only tcg_out_tlb_load() versions I can find.
As to frequency I'm assuming that there are far fewer tagged pointers than untagged. But then again I haven't seen a good use case for tagged pointers. Would love to hear one.