Hacker News new | ask | show | jobs
by mikewarot 11 hours ago
It's my long standing opinion[1] that we shouldn't accept any RAM that can be subject to random bit flips. Most of the mitigations are just security through obscurity.

[1] https://news.ycombinator.com/item?id=33860477

6 comments

My computer with a lot of ECC DDR5 sometimes catches several bitflips in a day. I know this because they are reported to dmesg and sometimes I look at dmesg.

Intel decided long ago that you would need to pay more to not be subject to random bitflips. So it's an AMD system.

My computer with a lot of ECC DDR5 sometimes catches several bitflips in a day.

Replace your RAM or find what's causing this disturbance in the environment. Sooner or later you'll get a pattern the ECC won't be able to correct.

Ironically if you didn't have ECC you would instantly RMA such RAM as defective because even a simple memtest would quickly discover the problem, and "several bitflips in a day" would cause very obvious crashes all the time.

I was shocked to learn that around 10% of Firefox crashes are caused by bit flips.

https://news.ycombinator.com/item?id=47252971

Most software is like this. Factorio had a weird one where some routers dropped UDP packets with zero checksum.
100% agree. This is a pure case of defective product. Memory not behaving like memory.

It's very telling that when Rowhammer first appeared, authors of popular memory testing utilities added tests for it, and then quickly hid and disabled them by default because "too much RAM would test defective". I have no idea how they were convinced to do so.

Single event upsets are forced on you by physics. There is no possible way to stop them all.
> It's my long standing opinion[1] that we shouldn't accept any RAM that can be subject to random bit flips.

Every system fails eventually.

Yes things fail, but currently random bit flips are not considered a failure.
Intel MEE addressed this (https://eprint.iacr.org/2016/204.pdf), by treating DRAM as entirely untrusted (assuming an attacker with arbitrary physical read/write capabilities), but then they discontinued it.

Regarding your linked comment:

> If we had properly tested and validated RAM, RowHammer wouldn't work, ever.

While it's exacerbated by physical defects and tight timings, it's really a fundamental problem with how DRAM works. It's frankly a miracle it works in the first place.

No. If it was designed really well, it would trigger extra refreshes as needed. It would know how much accessing a row disturbs nearby rows and how much disturbance a row can suffer before it needs a refresh to prevent data corruption. It would know how long a row can be held open for, too. There is no fundamental theorem that rowhammer must work. It was an engineering tradeoff.

I don't think we can blame DRAM designers for flying a teensy bit too close to the sun here, since this is no problem in normal operation and only appears under adversarial scenarios. We can blame them for not fixing it once it was discovered. And we can definitely blame Intel for making ECC RAM a market segmentation feature.

What you describe is the Target Row Refresh (TRR) mitigation, and it can be bypassed via "half-double" attack.
Where did I imply that they should use an incorrect underestimation of row disturbance? If they actually measured these things, they'd know how far away a disturbance can be created before it becomes so weak the normal refresh cycle fixes it.
It is not feasible for DRAM (or the memory controller) to maintain a fully accurate simulation of DRAM. If it was easy they'd have done it.
It doesn't need to be fully accurate, merely always conservative. It's a question of cost (how much performance does the conservative estimate waste) not feasibility.
Okay then refresh the whole thing and not just a single row whenever TRR is triggered.

Or refresh the whole thing after a certain number of row activations.

Or interleave activations with refreshes. Say, after every 5 activations, refresh the next row in the refresh cycle.

I'm not a DRAM expert. They can figure it out. I promise if you refresh the whole chip after every row activation you won't have rowhammer. It'll be too slow though. Somewhere in between is the fastest point where there isn't rowhammer.

> If it was easy they'd have done it.

Why? Something like 70->90% of the world's DRAM is produced by three companies that are very friendly to each other. It makes no business sense to fix problems that you know your peer companies will not fix... that's spending money that you absolutely do not have to.

If the business/economic theory doesn't sway you, look way back to what happened to ISP speeds and pricing when Google Fiber so much as credibly threatened to start providing service in an area served by a mono/duo/triopoly. Or -more recently- how SpaceX demonstrated that the defense-contractor-owned space launch companies had spend decades wasting enormous amounts of taxpayer money by refusing to do any significant amount of research into bringing the cost to launch down substantially. ISPs and the space launch companies had no peers that would spend the resources required to provide a better and/or cheaper service to their customers, so it made absolutely no sense for any one of them to spend resources to break the truce and make them all far less money in the long run.

It doesn't need to be a fully accurate simulation, any more than your car needs a fully accurate ICE simulation to decide "Change the engine oil".

Just count accesses to each row, and refresh the adjacent row(s) when some limit is reached.

Little known fun fact: the MEE's checksum updates... were one of the most successful Rowhammer patterns... :-p
Interesting - but presumably used to attack rows outside of SGX?
both, inside and outside