Re: Tagged memory (was Re: Memory Upgrade)

[Randy Mangham <randy.mangham@xxxxxxxx>]

With regard to tags and whether or not the tag bit can be fiddled with thus
violating system security, I think Frank Soltis probably has the last and
authoritative word on the subject. I quote from Inside the AS/400, 2nd ed.
The capital letter emphasis is my addition.

"The tag instructions are used only by SLIC; they are not generated by the
translator for MI programs. This means that any store to memory that is
generated by an MI program used the standard instructions and ALWAYS TURNS
OFF the tag bits. When a pointer is created as part of a resolve operation,
SLIC builds the pointer in two 64-bit registers and uses the stq
instruction to turn the tag bits on in memory. Whenever an MI program
attempts to use a pointer, SLIC uses the lq instruction to load the
contents of the pointer into registers and then tests to see whether the
tag bits are still on. If the tag bits are found to be off, someone
modified the pointer and, therefore, it is invalid.

Tag bits in the AS/400 do NOT prevent the modification of pointers. Tag
bits are used to DETECT the modification when the pointer is used. This
approach is different from the one most memory-protection schemes use.
Typically, memory protection prevents the modification. This is also
important, and later we will see that the AS/400 has this type of
protection on a page basis. For pointers, however, the modification is
detected after the fact. This approach reduced the amount of hardware
needed in the early implementations of the system and still provided the
needed level of protection.

Pointers CANNOT be counterfeited. Tags ensure that a pointer was created by
the operating system (SLIC) and that it has not been modified by anyone
other than SLIC. Anyone else who creates a pointer, copies a pointer, or
modifies a pointer has NO WAY [emphasis added] to turn the tag bits on and
will end up with a useless 16-byte entity."

I hope that clears up any confusion. I'd highly recommend this book if you
want a reasonably easy to understand brief explanation of the PowerPC
processor and how tag bits work overall. The original PowerPC architecture
did not support tag bits so a special implementation of the chip was used
in the AS/400 until 1997 that supported a "tags active" mode. From 1997
forward, the PowerPC chips have supported "tags-active" and "tags-inactive"
modes and that has allowed the same processor chip to be used in both
AS/400-iSeries and RS/6000-pSeries machines.

Randy Mangham
Pacific Crest Consulting
San Diego CA