CODIC: A Low-Cost Substrate for Enabling Custom In-DRAM Functionalities and Optimizations

Orosa, Lois; Wang, Yaohua; Sadrosadati, Mohammad; Kim, Jeremie S.; Patel, Minesh; Puddu, Ivan; Luo, Haocong; Razavi, Kaveh; Gómez-Luna, Juan; Hassan, Hasan; Mansouri-Ghiasi, Nika; Ghose, Saugata; Mutlu, Onur

doi:10.1109/isca52012.2021.00045

Cited by 13 publications

(3 citation statements)

References 106 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this way, a RowHammer defense mechanism or the memory controller can inherently keep under control an aggressor row's active time. This is an example of a system-DRAM cooperative scheme, similar to those recommended by prior work [71,72,98,99,108]. Improvement 6.…”

Section: Potential Defense Improvementsmentioning

confidence: 84%

“…First, manufacturing process variation causes differences in cell size and bitline/wordline impedance values, which introduces variation in cell reliability characteristics within and across DRAM chips [16,19,69,70,80,86,87,107,108,116]. We hypothesize that similar imperfections in the manufacturing process (e.g., variation in cell-to-cell and cell-to-wordline spacings) cause RowHammer vulnerability to vary between cells in different DRAM chips.…”

Section: Circuit-level Justificationmentioning

confidence: 99%

See 1 more Smart Citation

A Deeper Look into RowHammer’s Sensitivities: Experimental Analysis of Real DRAM Chips and Implications on Future Attacks and Defenses

Orosa

Yağlıkçı

Luo

et al. 2021

MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture

Self Cite

View full text Add to dashboard Cite

RowHammer is a circuit-level DRAM vulnerability where repeatedly accessing (i.e., hammering) a DRAM row can cause bit flips in physically nearby rows. The RowHammer vulnerability worsens as DRAM cell size and cell-to-cell spacing shrink. Recent studies demonstrate that modern DRAM chips, including chips previously marketed as RowHammer-safe, are even more vulnerable to RowHammer than older chips such that the required hammer count to cause a bit flip has reduced by more than 10X in the last decade. Therefore, it is essential to develop a better understanding and in-depth insights into the RowHammer vulnerability of modern DRAM chips to more effectively secure current and future systems.Our goal in this paper is to provide insights into fundamental properties of the RowHammer vulnerability that are not yet rigorously studied by prior works, but can potentially be 𝑖) exploited to develop more effective RowHammer attacks or 𝑖𝑖) leveraged to design more effective and efficient defense mechanisms. To this end, we present an experimental characterization using 248 DDR4 and 24 DDR3 modern DRAM chips from four major DRAM manufacturers demonstrating how the RowHammer effects vary with three fundamental properties: 1) DRAM chip temperature, 2) aggressor row active time, and 3) victim DRAM cell's physical location. Among our 16 new observations, we highlight that a RowHammer bit flip 1) is very likely to occur in a bounded range, specific to each DRAM cell (e.g., 5.4% of the vulnerable DRAM cells exhibit errors in the range 70 °C to 90 °C), 2) is more likely to occur if the aggressor row is active for longer time (e.g., RowHammer vulnerability increases by 36% if we keep a DRAM row active for 15 column accesses), and 3) is more likely to occur in certain physical regions of the DRAM module under attack (e.g., 5% of the rows are 2x more vulnerable than the remaining 95% of the rows). Our study has important practical implications on future RowHammer attacks and defenses. We describe and analyze the implications of our new findings by proposing three future RowHammer attack and six future RowHammer defense improvements.

show abstract

Section: Potential Defense Improvementsmentioning

confidence: 84%

Section: Circuit-level Justificationmentioning

confidence: 99%

A Deeper Look into RowHammer’s Sensitivities: Experimental Analysis of Real DRAM Chips and Implications on Future Attacks and Defenses

Orosa

Yağlıkçı

Luo

et al. 2021

MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture

Self Cite

View full text Add to dashboard Cite

show abstract

“…For example, DDR4 uses session keys to scramble data in a DRAM to prevent cold boot attack [43]. Another set of methods advocates overwriting memory contents using built-in hardware every time a DRAM chip powers on [33,37]. Researchers have evaded memory scrambling in more recent cold boot attacks [43] and self-resetting DRAM has not been implemented or deployed by commercial DRAM vendors.…”

Section: Cold Boot Attacksmentioning

confidence: 99%

SRAM has no chill: exploiting power domain separation to steal on-chip secrets

Mahmod

Hicks

2022

Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems

View full text Add to dashboard Cite

The abundance of embedded systems and smart devices increases the risk of physical memory disclosure attacks. One such classic noninvasive attack exploits dynamic RAM's temperature-dependent ability to retain information across power cyclesÐknown as a cold boot attack. When exposed to low temperatures, DRAM cells preserve their state for a short time without power, mimicking nonvolatile memories in that time frame. Attackers exploit this physical phenomenon to gain access to a system's secrets, leading to data theft from encrypted storage. To prevent cold boot attacks, programmers hide secrets on-chip in Static Random-Access Memory (SRAM); by construction, on-chip SRAM is isolated from external probing and has little intrinsic capacitance, making it robust against cold boot attacks.While it is the case that SRAM protects against traditional cold boot attacks, we show that there is another way to retain information in on-chip SRAM across power cycles and software changes. This paper presents Volt Boot, an attack that demonstrates a vulnerability of on-chip volatile memories due to the physical separation common to modern system-on-chip power distribution networks. Volt Boot leverages asymmetrical power states (e.g., on vs. off) to force SRAM state retention across power cycles, eliminating the need for traditional cold boot attack enablers, such as low-temperature or intrinsic data retention time. Using several modern ARM Cortex-A devices, we demonstrate the effectiveness of the attack in caches, registers, and iRAMs. Unlike other forms of SRAM data retention attacks, Volt Boot retrieves data with 100% accuracyÐwithout any complex post-processing. CCS CONCEPTS• Hardware → Static memory; • Security and privacy → Embedded systems security; Hardware attacks and countermeasures.

show abstract

Using Approximate DRAM for Enabling Energy-Efficient, High-Performance Deep Neural Network Inference

Orosa,

Koppula,

Kanellopoulos

et al. 2023

Embedded Machine Learning for Cyber-Physical, IoT, and Edge Computing

View full text Add to dashboard Cite

CODIC: A Low-Cost Substrate for Enabling Custom In-DRAM Functionalities and Optimizations

Cited by 13 publications

References 106 publications

A Deeper Look into RowHammer’s Sensitivities: Experimental Analysis of Real DRAM Chips and Implications on Future Attacks and Defenses

A Deeper Look into RowHammer’s Sensitivities: Experimental Analysis of Real DRAM Chips and Implications on Future Attacks and Defenses

SRAM has no chill: exploiting power domain separation to steal on-chip secrets

Using Approximate DRAM for Enabling Energy-Efficient, High-Performance Deep Neural Network Inference

Contact Info

Product

Resources

About