Messages in this thread | | | From | Andy Lutomirski <> | Date | Mon, 9 Mar 2015 09:30:50 -0700 | Subject | Re: DRAM unreliable under specific access patern |
| |
On Mon, Mar 9, 2015 at 9:03 AM, Mark Seaborn <mseaborn@chromium.org> wrote: > On 6 January 2015 at 15:20, Pavel Machek <pavel@ucw.cz> wrote: >> On Mon 2015-01-05 19:23:29, One Thousand Gnomes wrote: >> > > In the meantime, I created test that actually uses physical memory, >> > > 8MB apart, as described in some footnote. It is attached. It should >> > > work, but it needs boot with specific config options and specific >> > > kernel parameters. >> > >> > Why not just use hugepages. You know the alignment guarantees for 1GB >> > pages and that means you don't even need to be root >> > >> > In fact - should we be disabling 1GB huge page support by default at this >> > point, at least on non ECC boxes ? >> >> Actually, I could not get my test code to run; and as code from >> >> https://github.com/mseaborn/rowhammer-test >> >> reproduces issue for me, I stopped trying. I could not get it to >> damage memory of other process than itself (but that should be >> possible), I guess that's next thing to try. > > FYI, rowhammer-induced bit flips do turn out to be exploitable. Here > are the results of my research on this: > http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html >
IIRC non-temporal writes will force cachelines out to main memory *and* invalidate them. (I wouldn't be shocked if Skylake changes this, but I'm reasonably confident that it's true on all currently available Intel chips.)
Have you checked whether read; read; nt store; nt store works?
(I can't test myself easily right now -- I think my laptop is too old for this issue.)
--Andy
| |