Framework for Fault Analysis and Test Generation in DRAMs

Al-Ars, Zaid; Hamdioui, Said; Mueller, Georg Otto; Goor, A.J. van de

doi:10.1109/date.2005.161

Cited by 11 publications

(20 citation statements)

References 2 publications

(2 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This partially enables the adjacent row of access-transistors for a short amount of time and facilitates the leakage of charge. Second, bridges are a well-known class of DRAM faults in which conductive channels are formed between unrelated wires and/or capacitors [3,4]. One study on embedded DRAM (eDRAM) found that toggling a wordline could accelerate the flow of charge between two bridged cells [29].…”

Section: Mechanics Of Disturbance Errorsmentioning

confidence: 99%

“…To mitigate Work done while at Carnegie Mellon University. disturbance errors, DRAM manufacturers have been employing a two-pronged approach: (i) improving inter-cell isolation through circuit-level techniques [22,32,49,61,73] and (ii) screening for disturbance errors during post-production testing [3,4,64]. We demonstrate that their efforts to contain disturbance errors have not always been successful, and that erroneous DRAM chips have been slipping into the field.1…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors

Kim¹,

Daly²,

Kim³

et al. 2014

2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA)

435

1,019

View full text Add to dashboard Cite

Abstract. Memory isolation is a key property of a reliable and secure computing system -an access to one memory address should not have unintended side effects on data stored in other addresses. However, as DRAM process technology scales down to smaller dimensions, it becomes more difficult to prevent DRAM cells from electrically interacting with each other. In this paper, we expose the vulnerability of commodity DRAM chips to disturbance errors. By reading from the same address in DRAM, we show that it is possible to corrupt data in nearby addresses. More specifically, activating the same row in DRAM corrupts data in nearby rows. We demonstrate this phenomenon on Intel and AMD systems using a malicious program that generates many DRAM accesses. We induce errors in most DRAM modules (110 out of 129) from three major DRAM manufacturers. From this we conclude that many deployed systems are likely to be at risk. We identify the root cause of disturbance errors as the repeated toggling of a DRAM row's wordline, which stresses inter-cell coupling effects that accelerate charge leakage from nearby rows. We provide an extensive characterization study of disturbance errors and their behavior using an FPGA-based testing platform. Among our key findings, we show that (i) it takes as few as 139K accesses to induce an error and (ii) up to one in every 1.7K cells is susceptible to errors. After examining various potential ways of addressing the problem, we propose a low-overhead solution to prevent the errors.

show abstract

Section: Mechanics Of Disturbance Errorsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors

Kim¹,

Daly²,

Kim³

et al. 2014

2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA)

435

1,019

View full text Add to dashboard Cite

show abstract

“…Another technique that is orthogonal to those we have discussed so far is to employ memory devices that use less-tested DRAM chips. The testing performed by vendors in order to achieve a certain quality of DRAM device can add a substantial amount of cost [8], though it can increase the average reliability of DRAM devices.…”

Section: Heterogeneous-reliability Memory Systemsmentioning

confidence: 99%

“…We derive the cost of ECC DRAM, non-ECC DRAM (NoECC), and paritybased DRAM using "Added capacity" from Table 1. We estimate the cost of less-tested DRAM based on the trends shown in [8,9] and examine a range of costs for lesstested DRAM because we are not aware of any recently documented costs from vendors. Crash recovery time is based on our observations during testing and we assume that data that is written in memory for regions protected by parity and recovery (Par+R) is copied to a backup on disk every five minutes.…”

Section: B Design Space Explorationmentioning

confidence: 99%

“…This cost arises from two components: (1) quality assurance testing performed by memory vendors to ensure devices sold to customers are of a high enough caliber and (2) additional memory capacity for error detection and correction. Device testing has been shown to account for an increasing fraction of the cost of memory for DRAM [8,9]. The cost of additional memory capacity, on the other hand, depends on the technique used to provide error detection and correction.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Characterizing Application Memory Error Vulnerability to Optimize Datacenter Cost via Heterogeneous-Reliability Memory

Luo

Govindan

Sharma

et al. 2014

2014 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks

137

150

View full text Add to dashboard Cite

Abstract-Memory devices represent a key component of datacenter total cost of ownership (TCO), and techniques used to reduce errors that occur on these devices increase this cost. Existing approaches to providing reliability for memory devices pessimistically treat all data as equally vulnerable to memory errors. Our key insight is that there exists a diverse spectrum of tolerance to memory errors in new data-intensive applications, and that traditional one-size-fits-all memory reliability techniques are inefficient in terms of cost. For example, we found that while traditional error protection increases memory system cost by 12.5%, some applications can achieve 99.00% availability on a single server with a large number of memory errors without any error protection. This presents an opportunity to greatly reduce server hardware cost by provisioning the right amount of memory reliability for different applications.Toward this end, in this paper, we make three main contributions to enable highly-reliable servers at low datacenter cost. First, we develop a new methodology to quantify the tolerance of applications to memory errors. Second, using our methodology, we perform a case study of three new dataintensive workloads (an interactive web search application, an in-memory key-value store, and a graph mining framework) to identify new insights into the nature of application memory error vulnerability. Third, based on our insights, we propose several new hardware/software heterogeneous-reliability memory system designs to lower datacenter cost while achieving high reliability and discuss their trade-offs. We show that our new techniques can reduce server hardware cost by 4.7% while achieving 99.90% single server availability.

show abstract

Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript

Gruss

Maurice

Mangard

2016

Lecture Notes in Computer Science

286

339

View full text Add to dashboard Cite

Abstract. A fundamental assumption in software security is that a memory location can only be modified by processes that may write to this memory location. However, a recent study has shown that parasitic effects in DRAM can change the content of a memory cell without accessing it, but by accessing other memory locations in a high frequency. This so-called Rowhammer bug occurs in most of today's memory modules and has fatal consequences for the security of all affected systems, e.g., privilege escalation attacks. All studies and attacks related to Rowhammer so far rely on the availability of a cache flush instruction in order to cause accesses to DRAM modules at a sufficiently high frequency. We overcome this limitation by defeating complex cache replacement policies. We show that caches can be forced into fast cache eviction to trigger the Rowhammer bug with only regular memory accesses. This allows to trigger the Rowhammer bug in highly restricted and even scripting environments. We demonstrate a fully automated attack that requires nothing but a website with JavaScript to trigger faults on remote hardware. Thereby we can gain unrestricted access to systems of website visitors. We show that the attack works on off-the-shelf systems. Existing countermeasures fail to protect against this new Rowhammer attack.

show abstract

Framework for Fault Analysis and Test Generation in DRAMs

Cited by 11 publications

References 2 publications

Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors

Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors

Characterizing Application Memory Error Vulnerability to Optimize Datacenter Cost via Heterogeneous-Reliability Memory

Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript

Contact Info

Product

Resources

About