5 ms·

I first read bout this a few months ago. Coming from a hardware background I was particularly struck by how damned clever this is!

PhantomGremlin 10y ago
It's clever because you aren't a memory design or test engineer. This type of problem has been known and tested for since shortly after DRAM was invented. E.g. here's a 1977 databook from Mostek, at the time the premier DRAM manufacturer: https://archive.org/stream/bitsavers_mostekdataryProducts_17995288/1977_Mostek_Memory_Products_djvu.txt https://archive.org/stream/bitsavers_mostekdataryProducts_17... Look at these tests in particular: Adjacent Row Disturb Refresh Column Disturb Pattern Sensitivity Look at the details of the column disturb test: Column is written with an all ones data pattern an "0" is then written into row of the column 100 times followed by reading all other bits of the column and checking each bit for a logic "1" output. Row of the column is then rewritten to a "1" and the procedure is repeated for rows 1,2,3, ... 63 of the column under test. The entire procedure is then repeated for columns 1-63. That particular test step is only repeated 100 times, because it's a production test and short test time is critical. You can bet that in design verification the chip was characterized a lot more thoroughly. The downside of increasing memory sizes over the decades (now literally billions of bits in a single chip rather than thousands) is reduced design margins. So we get rowhammer. You can bet that rowhammer did not come as any surprise to key engineers at the DRAM manufacturers. They just didn't take it very seriously as a possible real world problem, because the access patterns required to cause it are atypical from those of "normal" operation.
- osivertsson 10y ago
  Thanks for the interesting historical reference! As you state, this type of problem is not new, and as noted at [1] e.g. Intel have taken this seriously on their Xeon lineup for a while. It's a shame (LP)DDR4 standards did not make Target Row Refresh mandatory. From the FAQ at [2]: I have a phone with LPDDR4 memory. Am I safe against Drammer attacks? Again, we don’t know. Chances are that your DRAM comes with the Target Row Refresh (TRR) mitigation, which makes it harder – but still not impossible, in theory – to induce bit flips. Moreover, TRR for LPDDR4 is optional, so your DRAM manufacturer may have decided to drop this technique and leave you vulnerable. [1] https://en.wikipedia.org/wiki/Row_hammer#Mitigation https://en.wikipedia.org/wiki/Row_hammer#Mitigation [2] https://www.vusec.net/projects/drammer/ https://www.vusec.net/projects/drammer/
  - rasz_pl 10y ago
    You could implement similar row access counters in the memory controller (inside cpu). Intel had 2 generations to get on it, they didnt ....
- userbinator 10y ago
  You can bet that rowhammer did not come as any surprise to key engineers at the DRAM manufacturers. They just didn't take it very seriously as a possible real world problem, because the access patterns required to cause it are atypical from those of "normal" operation. I bet there are also plenty of others wondering whether it's actually a known backdoor that's been used secretly for a long time, and this is just an independent discovery since everyone else who knew about it were told to keep quiet...
  - PhantomGremlin 10y ago
    Before Snowden, I might have dismissed your post as simple paranoia. But now, to steal a few words from 'jasoncchild', it just might be "damned clever". All of which means that right now there are probably guys posting in an HN discussion thread on NSA's private comment site. They're saying something like: it's only clever because he's not a spook ... we've been doing this for the last decade. :)
- jasoncchild 10y ago
  >It's clever because you aren't a memory design or test engineer. This type of problem has been known and tested for since shortly after DRAM was invented ...yeah...sometimes it happens that you are ignorant of the details of a topic...and learning more about it can feel magical...

PhantomGremlin 10y ago

It's clever because you aren't a memory design or test engineer. This type of problem has been known and tested for since shortly after DRAM was invented. E.g. here's a 1977 databook from Mostek, at the time the premier DRAM manufacturer: https://archive.org/stream/bitsavers_mostekdataryProducts_17995288/1977_Mostek_Memory_Products_djvu.txt https://archive.org/stream/bitsavers_mostekdataryProducts_17... Look at these tests in particular: Adjacent Row Disturb Refresh Column Disturb Pattern Sensitivity Look at the details of the column disturb test: Column is written with an all ones data pattern an "0" is then written into row of the column 100 times followed by reading all other bits of the column and checking each bit for a logic "1" output. Row of the column is then rewritten to a "1" and the procedure is repeated for rows 1,2,3, ... 63 of the column under test. The entire procedure is then repeated for columns 1-63. That particular test step is only repeated 100 times, because it's a production test and short test time is critical. You can bet that in design verification the chip was characterized a lot more thoroughly. The downside of increasing memory sizes over the decades (now literally billions of bits in a single chip rather than thousands) is reduced design margins. So we get rowhammer. You can bet that rowhammer did not come as any surprise to key engineers at the DRAM manufacturers. They just didn't take it very seriously as a possible real world problem, because the access patterns required to cause it are atypical from those of "normal" operation.

osivertsson 10y ago
Thanks for the interesting historical reference! As you state, this type of problem is not new, and as noted at [1] e.g. Intel have taken this seriously on their Xeon lineup for a while. It's a shame (LP)DDR4 standards did not make Target Row Refresh mandatory. From the FAQ at [2]: I have a phone with LPDDR4 memory. Am I safe against Drammer attacks? Again, we don’t know. Chances are that your DRAM comes with the Target Row Refresh (TRR) mitigation, which makes it harder – but still not impossible, in theory – to induce bit flips. Moreover, TRR for LPDDR4 is optional, so your DRAM manufacturer may have decided to drop this technique and leave you vulnerable. [1] https://en.wikipedia.org/wiki/Row_hammer#Mitigation https://en.wikipedia.org/wiki/Row_hammer#Mitigation [2] https://www.vusec.net/projects/drammer/ https://www.vusec.net/projects/drammer/
- rasz_pl 10y ago
  You could implement similar row access counters in the memory controller (inside cpu). Intel had 2 generations to get on it, they didnt ....
userbinator 10y ago
You can bet that rowhammer did not come as any surprise to key engineers at the DRAM manufacturers. They just didn't take it very seriously as a possible real world problem, because the access patterns required to cause it are atypical from those of "normal" operation. I bet there are also plenty of others wondering whether it's actually a known backdoor that's been used secretly for a long time, and this is just an independent discovery since everyone else who knew about it were told to keep quiet...
- PhantomGremlin 10y ago
  Before Snowden, I might have dismissed your post as simple paranoia. But now, to steal a few words from 'jasoncchild', it just might be "damned clever". All of which means that right now there are probably guys posting in an HN discussion thread on NSA's private comment site. They're saying something like: it's only clever because he's not a spook ... we've been doing this for the last decade. :)
jasoncchild 10y ago
>It's clever because you aren't a memory design or test engineer. This type of problem has been known and tested for since shortly after DRAM was invented ...yeah...sometimes it happens that you are ignorant of the details of a topic...and learning more about it can feel magical...