Yoongu Kim
Skip Abstract Section
Abstract
Memory isolation is a key property of a reliable and secure computing system--an access to one memory address should not have unintended side effects on data stored in other addresses. However, as DRAM process technology scales down to smaller dimensions, it becomes more difficult to prevent DRAM cells from electrically interacting with each other. In this paper, we expose the vulnerability of commodity DRAM chips to disturbance errors. By reading from the same address in DRAM, we show that it is possible to corrupt data in nearby addresses. More specifically, activating the same row in DRAM corrupts data in nearby rows. We demonstrate this phenomenon on Intel and AMD systems using a malicious program that generates many DRAM accesses. We induce errors in most DRAM modules (110 out of 129) from three major DRAM manufacturers. From this we conclude that many deployed systems are likely to be at risk. We identify the root cause of disturbance errors as the repeated toggling of a DRAM row's wordline, which stresses inter-cell coupling effects that accelerate charge leakage from nearby rows. We provide an extensive characterization study of disturbance errors and their behavior using an FPGA-based testing platform. Among our key findings, we show that (i) it takes as few as 139K accesses to induce an error and (ii) up to one in every 1.7K cells is susceptible to errors. After examining various potential ways of addressing the problem, we propose a low-overhead solution to prevent the errors
- Memtest86+ v4.20. http://www.memtest.org.Google Scholar
- The GNU GRUB Manual. http://www.gnu.org/software/grub.Google Scholar
- Z. Al-Ars. DRAM Fault Analaysis and Test Generation. PhD thesis, TU Delft, 2005.Google Scholar
- Z. Al-Ars et al. DRAM-Specific Space of Memory Tests. In ITC, 2006.Google Scholar
- AMD. BKDG for AMD Family 15h Models 10h-1Fh Processors, 2013.Google Scholar
- K. Bains et al. Method, Apparatus and System for Providing a Memory Refresh. US Patent App. 13/625,741, Mar. 27 2014.Google Scholar
- K. Bains et al. Row Hammer Refresh Command. US Patent App. 13/539,415, Jan. 2 2014.Google Scholar
- K. Bains et al. Row Hammer Refresh Command. US Patent App. 14/068,677, Feb. 27 2014.Google Scholar
- K. Bains and J. Halbert. Distributed Row Hammer Tracking. US Patent App. 13/631,781, Apr. 3 2014.Google Scholar
- R. Bez et al. Introduction to Flash Memory. Proc. of the IEEE, 91(4), 2003.Google ScholarCross Ref
- B. H. Bloom. Space/Time Trade-offs in Hash Coding with Allowable Errors. Communications of the ACM, 13(7), 1970. Google ScholarDigital Library
- Y. Cai et al. Error Patterns in MLC NAND Flash Memory: Measurement, Characterization, and Analysis. In DATE, 2012. Google ScholarDigital Library
- Y. Cai et al. Program Interference in MLC NAND Flash Memory: Characterization, Modeling and Mitigation. In ICCD, 2013.Google Scholar
- S. Y. Cha. DRAM and Future Commodity Memories. In VLSI Technology Short Course, 2011.Google Scholar
- M.-T. Chao et al. Fault Models for Embedded-DRAM Macros. In DAC, 2009. Google ScholarDigital Library
- Q. Chen et al. Modeling and Testing of SRAM for New Failure Mechanisms Due to Process Variations in Nanoscale CMOS. In VLSI Test Symposium, 2005. Google ScholarDigital Library
- P.-F. Chia et al. New DRAM HCI Qualification Method Emphasizing on Repeated Memory Access. In Integrated Reliability Workshop, 2010.Google Scholar
- S. Cohen and Y. Matias. Spectral Bloom Filters. In SIGMOD, 2003. Google ScholarDigital Library
- J. Cooke. The Inconvenient Truths of NAND Flash Memory. In Flash Memory Summit, 2007.Google Scholar
- DRAMeXchange. TrendForce: 3Q13 Global DRAM Revenue Rises by 9%, Samsung Shows Most Noticeable Growth, Nov. 12, 2013.Google Scholar
- L. Fan et al. Summary Cache: A Scalable Wide-Area Web Cache Sharing Protocol. Transactions on Networking, 8(3), 2000. Google ScholarDigital Library
- J. A. Fifield and H. L. Kalter. Crosstalk-Shielded-Bit-Line DRAM. US Patent 5,010,524, Apr. 23, 1991.Google Scholar
- Z. Greenfield et al. Method, Apparatus and System for Determining a Count of Accesses to a Row of Memory. US Patent App. 13/626,479, Mar. 27 2014.Google Scholar
- Z. Greenfield et al. Row Hammer Condition Monitoring. US Patent App. 13/539,417, Jan. 2, 2014.Google Scholar
- L. M. Grupp et al. Characterizing Flash Memory: Anomalies, Observations, and Applications. In MICRO, 2009. Google ScholarDigital Library
- Z. Guo et al. Large-Scale SRAM Variability Characterization in 45 nm CMOS. JSSC, 44(11), 2009.Google Scholar
- D. Henderson and J. Mitchell. IBM POWER7 System RAS, Dec. 2012.Google Scholar
- M. Horiguchi and K. Itoh. Nanoscale Memory Repair. Springer, 2011. Google ScholarDigital Library
- R.-F. Huang et al. Alternate Hammering Test for Application-Specific DRAMs and an Industrial Case Study. In DAC, 2012. Google ScholarDigital Library
- Intel. Intel 64 and IA-32 Architectures Optimization Reference Manual, 2012.Google Scholar
- Intel. 4th Generation Intel Core Processor Family Desktop Datasheet, 2013.Google Scholar
- K. Itoh. Semiconductor Memory. US Patent 4,044,340, Apr. 23, 1977.Google Scholar
- JEDEC. Standard No. 21C. Annex K: Serial Presence Detect (SPD) for DDR3 SDRAM Modules, Aug. 2012.Google Scholar
- JEDEC. Standard No. 79--3F. DDR3 SDRAM Specification, July 2012.Google Scholar
- M. K. Jeong et al. Balancing DRAM Locality and Parallelism in Shared Memory CMP Systems. In HPCA, 2012. Google ScholarDigital Library
- W. Jiang et al. Cross-Track Noise Profile Measurement for Adjacent-Track Interference Study and Write-Current Optimization in Perpendicular Recording. Journal of Applied Physics, 93(10), 2003.Google ScholarCross Ref
- R. M. Karp et al. A Simple Algorithm for Finding Frequent Elements in Streams and Bags. Transactions on Database Systems, 28(1), 2003. Google ScholarDigital Library
- B. Keeth et al. DRAM Circuit Design. Fundamental and High-Speed Topics. Wiley-IEEE Press, 2007. Google ScholarDigital Library
- S. Khan et al. The Efficacy of Error Mitigation Techniques for DRAM Retention Failures: A Comparative Experimental Study. In SIGMETRICS, 2014. Google ScholarDigital Library
- D. Kim et al. Variation-Aware Static and Dynamic Writability Analysis for Voltage-Scaled Bit-Interleaved 8-T SRAMs. In ISLPED, 2011. Google ScholarDigital Library
- Y. Kim et al. A Case for Exploiting Subarray-Level Parallelism (SALP) in DRAM. In ISCA, 2012. Google ScholarDigital Library
- Y. Konishi et al. Analysis of Coupling Noise between Adjacent Bit Lines in Megabit DRAMs. JSSC, 24(1), 1989.Google Scholar
- D. Lee et al. Tiered-Latency DRAM: A Low Latency and Low Cost DRAM Architecture. In HPCA, 2013. Google ScholarDigital Library
- J. Liu et al. RAIDR: Retention-Aware Intelligent DRAM Refresh. In ISCA, 2012. Google ScholarDigital Library
- J. Liu et al. An Experimental Study of Data Retention Behavior in Modern DRAM Devices: Implications for Retention Time Profiling Mechanisms. In ISCA, 2013. Google ScholarDigital Library
- L. Liu et al. A Software Memory Partition Approach for Eliminating Bank-level Interference in Multicore Systems. In PACT, 2012. Google ScholarDigital Library
- J. A. Mandelman et al. Challenges and Future Directions for the Scaling of Dynamic Random-Access Memory (DRAM). IBM Journal of R&D, 46(2.3), 2002. Google ScholarDigital Library
- M. Micheletti. Tuning DDR4 for Power and Performance. In MemCon, 2013.Google Scholar
- D.-S. Min et al. Wordline Coupling Noise Reduction Techniques for Scaled DRAMs. In Symposium on VLSI Circuits, 1990.Google Scholar
- R. Morris. Counting Large Numbers of Events in Small Registers. Communications of the ACM, 21(10), 1978. Google ScholarDigital Library
- O. Mutlu. Memory Scaling: A Systems Architecture Perspective. In MemCon, 2013.Google Scholar
- P. J. Nair et al. ArchShield: Architectural Framework for Assisting DRAM Scaling by Tolerating High Error Rates. In ISCA, 2013. Google ScholarDigital Library
- C. Nibby et al. Remap Method and Apparatus for a Memory System Which Uses Partially Good Memory Devices. US Patent 4,527,251, July 2 1985.Google Scholar
- E. Pinheiro et al. Failure Trends in a Large Disk Drive Population. In FAST, 2007. Google ScholarDigital Library
- M. Redeker et al. An Investigation into Crosstalk Noise in DRAM Structures. In MTDT, 2002. Google ScholarDigital Library
- K. Roy et al. Leakage Current Mechanisms and Leakage Reduction Techniques in Deep-Submicrometer CMOS Circuits. Proc. of the IEEE, 91(2), 2003.Google ScholarCross Ref
- K. Saino et al. Impact of Gate-Induced Drain Leakage Current on the Tail Distribution of DRAM Data Retention Time. In IEDM, 2000.Google ScholarCross Ref
- J. H. Saltzer and M. F. Kaashoek. Principles of Computer Design: An Introduction. Chapter 8, p. 58. Morgan Kaufmann, 2009. Google ScholarDigital Library
- B. Schroeder and G. A. Gibson. Disk Failures in the Real World: What Does an MTTF of 1,000,000 Hours Mean to You? In FAST, 2007. Google ScholarDigital Library
- N. Suzuki et al. Coordinated Bank and Cache Coloring for Temporal Protection of Memory Accesses. In ICESS, 2013. Google ScholarDigital Library
- A. Tanabe et al. A 30-ns 64-Mb DRAM with Built-In Self-Test and Self-Repair Function. JSSC, 27(11), 1992.Google Scholar
- D. Tang et al. Assessment of the Effect of Memory Page Retirement on System RAS Against Hardware Faults. In DSN, 2006. Google ScholarDigital Library
- Y. Tang et al. Understanding Adjacent Track Erasure in Discrete Track Media. Transactions on Magnetics, 44(12), 2008.Google Scholar
- A. J. van de Goor and J. de Neef. Industrial Evaluation of DRAM Tests. In DATE, 1999. Google ScholarDigital Library
- A. J. van de Goor and I. Schanstra. Address and Data Scrambling: Causes and Impact on Memory Tests. In DELTA, 2002. Google ScholarDigital Library
- B. Van Durme and A. Lall. Probabilistic Counting with Randomized Storage. In IJCAI, 2009. Google ScholarDigital Library
- R. Venkatesan et al. Retention-Aware Placement in DRAM (RAPID): Software Methods for Quasi-Non-Volatile DRAM. In HPCA, 2006.Google ScholarCross Ref
- R. Wood et al. The Feasibility of Magnetic Recording at 10 Terabits Per Square Inch on Conventional Media. Transactions on Magnetics, 45(2), 2009.Google ScholarCross Ref
- Xilinx. Virtex-6 FPGA Integrated Block for PCI Express, Mar. 2011.Google Scholar
- Xilinx. ML605 Hardware User Guide, Oct. 2012.Google Scholar
- Xilinx. Virtex-6 FPGA Memory Interface Solutions, Mar. 2013.Google Scholar
- J. H. Yoon et al. Flash & DRAM Si Scaling Challenges, Emerging Non-Volatile Memory Technology Enablement. In Flash Memory Summit, 2013.Google Scholar
- T. Yoshihara et al. A Twisted Bit Line Technique for Multi-Mb DRAMs. In ISSCC, 1988.Google ScholarCross Ref
Recommendations
Flipping bits in memory without accessing them: an experimental study of DRAM disturbance errors
ISCA '14: Proceeding of the 41st annual international symposium on Computer architecutureMemory isolation is a key property of a reliable and secure computing system--an access to one memory address should not have unintended side effects on data stored in other addresses. However, as DRAM process technology scales down to smaller ...
Minimizing Update Bits of NVM-Based Main Memory Using Bit Flipping and Cyclic Shifting
HPCC-CSS-ICESS '15: Proceedings of the 2015 IEEE 17th International Conference on High Performance Computing and Communications, 2015 IEEE 7th International Symposium on Cyberspace Safety and Security, and 2015 IEEE 12th International Conf on Embedded Software and SystemsNon-Volatile Memory (NVM) has many advantages, such as non-volatility, high density, shock-resistivity, and low leakage power, and disadvantages, such as the relatively high write energy and limited write endurance. It also has the feature of writing ...
Write-once-memory-code phase change memory
DATE '14: Proceedings of the conference on Design, Automation & Test in EuropeThis paper describes a write-once-memory-code phase change memory (WOM-code PCM) architecture for next-generation non-volatile memory applications. Specifically, we address the long latency of the write operation in PCM --- attributed to PCM SET --- by ...
Comments