4 ms·

It is not feasible for DRAM (or the memory controller) to maintain a fully accurate simulation of DRAM. If it was easy they'd have done it.

by Retr0id 3mo ago

inigyou 3mo ago
Okay then refresh the whole thing and not just a single row whenever TRR is triggered. Or refresh the whole thing after a certain number of row activations. Or interleave activations with refreshes. Say, after every 5 activations, refresh the next row in the refresh cycle. I'm not a DRAM expert. They can figure it out. I promise if you refresh the whole chip after every row activation you won't have rowhammer. It'll be too slow though. Somewhere in between is the fastest point where there isn't rowhammer.
- deleted 3mo ago
  [deleted]
- reliabilityguy 3mo ago
  > Okay then refresh the whole thing and not just a single row whenever TRR is triggered. How would you refresh the whole DRAM? Refresh is simply reading the row and writing it back, it is sequential in nature. > Or interleave activations with refreshes. Say, after every 5 activations, refresh the next row in the refresh cycle. It makes zero sense. Refresh is disturbance in itself. You are entering a recursion here where the mere act of refreshing increases the counter values of victim rows making refresh even more frequent. At the end you have DRAM that you cannot read from or write to at all because it’s always refreshes itself. > I'm not a DRAM expert Yes
  - simoncion 3mo ago
    > At the end you have DRAM that you cannot read from or write to at all because it’s always refreshes itself. Be so kind as to run the math on this for me? There must be something that I'm missing, because it looks like you're describing a system in which a refresh causes so much disturbance that another refresh is immediately required. Such a system seems incapable of reliably storing a byte and reading it back. The colloquial term for such a system is "unreliable garbage".
    - reliabilityguy 3mo ago
      > you're describing a system in which a refresh causes so much disturbance that another refresh is immediately required. Well, if you need to refresh a bunch of rows after any other read, you will spend more time refreshing things rather doing useful work.
  - Dylan16807 3mo ago
    > It makes zero sense. Refresh is disturbance in itself. You are entering a recursion here where the mere act of refreshing increases the counter values of victim rows making refresh even more frequent. At the end you have DRAM that you cannot read from or write to at all because it’s always refreshes itself. That's not how infinite sequences work. If each refresh causes 1/n more refreshes, then your total time spend on extras is is 1/(n-1) of your original number. So even if you had an extreme 5:1 ratio, 100 accesses would cause 20 additional accesses which would cause 4 additional accesses which would cause 1 additional access. It would be fine.
bell-cot 3mo ago
It doesn't need to be a fully accurate simulation, any more than your car needs a fully accurate ICE simulation to decide "Change the engine oil". Just count accesses to each row, and refresh the adjacent row(s) when some limit is reached.
- inigyou 3mo ago
  Half-Double is an attack where you hammer the rows 2 spaces away so that the automatic refresh on the rows 1 space away is what actually hammers the target row.
  - bell-cot 3mo ago
    Yes? When a given row's counter hits the limit, you refresh every other row which your actually-competent testing has shown might maybe possibly be compromised by that activity. Same as a good car's computer doesn't make a bunch of rosy assumptions about whether the oil needs changing or not - the automotive engineers actually do their jobs, test the crap out of their engine designs, and base the oil-change criteria on the real-world test results. (JIC: "Adjacent" has a range of meanings in English. Those go from "the singular closest neighbor, within further constraints on type, orientation, etc." to "relatively close to by some metric". But I am not an EE, let alone a chip architect, to know the "real insider" lingo here.)
    - nomel 3mo ago
      The later I get into my career the more I'm convinced that the biggest engineering challenge is to convince others there's a problem to begin with. This is also why I think innovation generally only happens in smaller companies: less convincing.
    - inigyou 3mo ago
      Which is the whole chip, because if you only refresh any limited number of rows, the next row outside that range becomes a viable indirect target as shown by Half-Double. Alternatively you would also count the refresh as a hammer on its adjacent rows.
gpm 3mo ago
It doesn't need to be fully accurate, merely always conservative. It's a question of cost (how much performance does the conservative estimate waste) not feasibility.
simoncion 3mo ago
> If it was easy they'd have done it. Why? Something like 70->90% of the world's DRAM is produced by three companies that are very friendly to each other. It makes no business sense to fix problems that you know your peer companies will not fix... that's spending money that you absolutely do not have to. If the business/economic theory doesn't sway you, look way back to what happened to ISP speeds and pricing when Google Fiber so much as credibly threatened to start providing service in an area served by a mono/duo/triopoly. Or -more recently- how SpaceX demonstrated that the defense-contractor-owned space launch companies had spend decades wasting enormous amounts of taxpayer money by refusing to do any significant amount of research into bringing the cost to launch down substantially. ISPs and the space launch companies had no peers that would spend the resources required to provide a better and/or cheaper service to their customers, so it made absolutely no sense for any one of them to spend resources to break the truce and make them all far less money in the long run.
- inigyou 3mo ago
  Isn't this a memory controller concern, anyway?
  - simoncion 3mo ago
    I don't know. But I do strongly suspect that if rowhammer could be eliminated by a change in memory controller behavior, it would have been eliminated long ago.
    - inigyou 3mo ago
      The memory controller is in charge of basically everything, because this reduces the cost of the memory chips themselves. It controls refresh cycles and which row is open. If there are memory chips that add an additional self-refresh upon detecting rowhammer, it's a hack and a layering violation. There are memory chips with a separate, limited, built-in self-refresh capability which is used during sleep mode to allow the controller to power down.
adrian_b 3mo ago
This problem has never existed with bigger DRAM cells. At some point in time, a few generations of DRAM ago, they have reduced the dimensions so much and without discovering adequate mitigations for the problems introduced by this, that the DRAM reliability has become inadequate. The reason why they did this was to reduce the fabrication costs. It is likely that the pressure to reduce the fabrication costs has been caused more by the desire to increase the profit margins than by the intention to enable any price reductions, because even before the recent price increases there have been around 15 years with only negligible reductions in memory prices. By increasing the fabrication costs, it would be easy to eliminate the RowHammer problem, while still having memory prices several times lower than the current prices. However, the vendors do not want this. They want to find some kind of mitigation that would not cause any measurable increase in the fabrication costs. Until now they have failed to do this, but it is not clear how hard they have tried. It is very likely that their failure to find anything that works has been caused in a good part by the secrecy that is typical for nowadays. In the earlier times of the semiconductor industry, every manufacturing problem was described in public research papers, with complete details, and usually the right solution was found by someone else and then it spread quickly in all the industry, with much less concerns about "IP" than today. Only this openness has allowed the creation of the successful semiconductor industry and of the "Silicon Valley".
- Dylan16807 3mo ago
  > By increasing the fabrication costs, it would be easy to eliminate the RowHammer problem, while still having memory prices several times lower than the current prices. But current prices you mean during this huge spike? Sure, you could double fabrication costs while dropping prices a lot from today's state. But that's not impressive. That still costs more than I want. If you could reduce the price significantly from when it was sitting at $2-3 a GB, I'd be interested, but I'd need a bunch of evidence.
Dylan16807 3mo ago
You don't have to simulate it that hard. If you do TRR semi-aggressively and have it give a big boost to the neighboring rows' counter you can handle further away aggressor rows.

It is not feasible for DRAM (or the memory controller) to maintain a fully accurate simulation of DRAM. If it was easy they'd have done it.

by Retr0id 3mo ago

It is not feasible for DRAM (or the memory controller) to maintain a fully accurate simulation of DRAM. If it was easy they'd have done it.

inigyou 3mo ago

Okay then refresh the whole thing and not just a single row whenever TRR is triggered. Or refresh the whole thing after a certain number of row activations. Or interleave activations with refreshes. Say, after every 5 activations, refresh the next row in the refresh cycle. I'm not a DRAM expert. They can figure it out. I promise if you refresh the whole chip after every row activation you won't have rowhammer. It'll be too slow though. Somewhere in between is the fastest point where there isn't rowhammer.

deleted 3mo ago
[deleted]
reliabilityguy 3mo ago
> Okay then refresh the whole thing and not just a single row whenever TRR is triggered. How would you refresh the whole DRAM? Refresh is simply reading the row and writing it back, it is sequential in nature. > Or interleave activations with refreshes. Say, after every 5 activations, refresh the next row in the refresh cycle. It makes zero sense. Refresh is disturbance in itself. You are entering a recursion here where the mere act of refreshing increases the counter values of victim rows making refresh even more frequent. At the end you have DRAM that you cannot read from or write to at all because it’s always refreshes itself. > I'm not a DRAM expert Yes
- simoncion 3mo ago
  > At the end you have DRAM that you cannot read from or write to at all because it’s always refreshes itself. Be so kind as to run the math on this for me? There must be something that I'm missing, because it looks like you're describing a system in which a refresh causes so much disturbance that another refresh is immediately required. Such a system seems incapable of reliably storing a byte and reading it back. The colloquial term for such a system is "unreliable garbage".
  - reliabilityguy 3mo ago
    > you're describing a system in which a refresh causes so much disturbance that another refresh is immediately required. Well, if you need to refresh a bunch of rows after any other read, you will spend more time refreshing things rather doing useful work.
- Dylan16807 3mo ago
  > It makes zero sense. Refresh is disturbance in itself. You are entering a recursion here where the mere act of refreshing increases the counter values of victim rows making refresh even more frequent. At the end you have DRAM that you cannot read from or write to at all because it’s always refreshes itself. That's not how infinite sequences work. If each refresh causes 1/n more refreshes, then your total time spend on extras is is 1/(n-1) of your original number. So even if you had an extreme 5:1 ratio, 100 accesses would cause 20 additional accesses which would cause 4 additional accesses which would cause 1 additional access. It would be fine.

bell-cot 3mo ago

It doesn't need to be a fully accurate simulation, any more than your car needs a fully accurate ICE simulation to decide "Change the engine oil". Just count accesses to each row, and refresh the adjacent row(s) when some limit is reached.

inigyou 3mo ago
Half-Double is an attack where you hammer the rows 2 spaces away so that the automatic refresh on the rows 1 space away is what actually hammers the target row.
- bell-cot 3mo ago
  Yes? When a given row's counter hits the limit, you refresh every other row which your actually-competent testing has shown might maybe possibly be compromised by that activity. Same as a good car's computer doesn't make a bunch of rosy assumptions about whether the oil needs changing or not - the automotive engineers actually do their jobs, test the crap out of their engine designs, and base the oil-change criteria on the real-world test results. (JIC: "Adjacent" has a range of meanings in English. Those go from "the singular closest neighbor, within further constraints on type, orientation, etc." to "relatively close to by some metric". But I am not an EE, let alone a chip architect, to know the "real insider" lingo here.)
  - nomel 3mo ago
    The later I get into my career the more I'm convinced that the biggest engineering challenge is to convince others there's a problem to begin with. This is also why I think innovation generally only happens in smaller companies: less convincing.
  - inigyou 3mo ago
    Which is the whole chip, because if you only refresh any limited number of rows, the next row outside that range becomes a viable indirect target as shown by Half-Double. Alternatively you would also count the refresh as a hammer on its adjacent rows.

gpm 3mo ago

It doesn't need to be fully accurate, merely always conservative. It's a question of cost (how much performance does the conservative estimate waste) not feasibility.

simoncion 3mo ago

> If it was easy they'd have done it. Why? Something like 70->90% of the world's DRAM is produced by three companies that are very friendly to each other. It makes no business sense to fix problems that you know your peer companies will not fix... that's spending money that you absolutely do not have to. If the business/economic theory doesn't sway you, look way back to what happened to ISP speeds and pricing when Google Fiber so much as credibly threatened to start providing service in an area served by a mono/duo/triopoly. Or -more recently- how SpaceX demonstrated that the defense-contractor-owned space launch companies had spend decades wasting enormous amounts of taxpayer money by refusing to do any significant amount of research into bringing the cost to launch down substantially. ISPs and the space launch companies had no peers that would spend the resources required to provide a better and/or cheaper service to their customers, so it made absolutely no sense for any one of them to spend resources to break the truce and make them all far less money in the long run.

inigyou 3mo ago
Isn't this a memory controller concern, anyway?
- simoncion 3mo ago
  I don't know. But I do strongly suspect that if rowhammer could be eliminated by a change in memory controller behavior, it would have been eliminated long ago.
  - inigyou 3mo ago
    The memory controller is in charge of basically everything, because this reduces the cost of the memory chips themselves. It controls refresh cycles and which row is open. If there are memory chips that add an additional self-refresh upon detecting rowhammer, it's a hack and a layering violation. There are memory chips with a separate, limited, built-in self-refresh capability which is used during sleep mode to allow the controller to power down.

adrian_b 3mo ago

This problem has never existed with bigger DRAM cells. At some point in time, a few generations of DRAM ago, they have reduced the dimensions so much and without discovering adequate mitigations for the problems introduced by this, that the DRAM reliability has become inadequate. The reason why they did this was to reduce the fabrication costs. It is likely that the pressure to reduce the fabrication costs has been caused more by the desire to increase the profit margins than by the intention to enable any price reductions, because even before the recent price increases there have been around 15 years with only negligible reductions in memory prices. By increasing the fabrication costs, it would be easy to eliminate the RowHammer problem, while still having memory prices several times lower than the current prices. However, the vendors do not want this. They want to find some kind of mitigation that would not cause any measurable increase in the fabrication costs. Until now they have failed to do this, but it is not clear how hard they have tried. It is very likely that their failure to find anything that works has been caused in a good part by the secrecy that is typical for nowadays. In the earlier times of the semiconductor industry, every manufacturing problem was described in public research papers, with complete details, and usually the right solution was found by someone else and then it spread quickly in all the industry, with much less concerns about "IP" than today. Only this openness has allowed the creation of the successful semiconductor industry and of the "Silicon Valley".

Dylan16807 3mo ago
> By increasing the fabrication costs, it would be easy to eliminate the RowHammer problem, while still having memory prices several times lower than the current prices. But current prices you mean during this huge spike? Sure, you could double fabrication costs while dropping prices a lot from today's state. But that's not impressive. That still costs more than I want. If you could reduce the price significantly from when it was sitting at $2-3 a GB, I'd be interested, but I'd need a bunch of evidence.

Dylan16807 3mo ago

You don't have to simulate it that hard. If you do TRR semi-aggressively and have it give a big boost to the neighboring rows' counter you can handle further away aggressor rows.