Implementation method for DRAM (Dynamic Random Access Memory) row hammering

Abstract

The invention provides a DRAM (Dynamic Random Access Memory) row hammering implementation method, which can quickly and simply trigger hammering errors on a real and actual computer platform. The method comprises the following steps: (1) selecting a memory block; (2) determining a clock number lower limit tm required for reading two random memory addresses with large probabilities in the same memory module but different memory lines for N times; (3) selecting two random memory addresses in the memory block, circularly reading the two random memory addresses for N times, and if the clock number t for circularly reading the two random memory addresses for N times is greater than tm, carrying out a row hammering test; and (4) by querying a mapping table from the virtual address to the physical address, converting the address value pair recording the line hammering error into the physical address.

Description

Technical Field

[0001] The invention relates to a method for realizing DRAM row hammering. Background Art

[0002] DRAM is the current mainstream memory storage. Each DRAM storage unit contains a transistor and a capacitor. A large number of storage units form a two-dimensional storage array, called a memory module Bank. The memory module Bank is a physical structure, and each memory module Bank contains a large number of horizontal memory rows. When reading and writing data, after the memory row Row where the target data is located is activated, the storage unit is turned on, and the data stored therein is read and loaded into the memory row buffer Row Buffer. Data reading and writing is completed in the memory row buffer. If the target data to be accessed next time is not in the current memory row buffer, the data in the current row buffer is written back to the original memory row of the memory module, and the new memory row in the memory module is activated and read and loaded into the memory row buffer.

[0003] As the size of DRAM memory cells decreases, adjacent memory cells are prone to interference, resulting in data bit errors. When a memory row in a memory module is activated at a high frequency due to reading and writing, due to the coupling effect, it will disturb the memory cells of the upper and lower adjacent memory rows, causing the values ​​in individual memory cells to flip, resulting in data errors, which are called row hammer errors.

[0004] The principle of row hammering is simple, but it is quite difficult to trigger and capture it on an actual system. Due to the opacity of various underlying architectures, it is difficult to clearly define the mapping relationship between physical addresses and memory rows, and it is difficult to clearly define the adjacent relationship between memory rows. To test the reliability of DRAM and test various row hammering mitigation errors, the first thing is to be able to quickly and easily trigger row hammering errors on a real, practical computer platform. Summary of the invention

[0005] The purpose of the present invention is to overcome the above-mentioned deficiencies in the prior art and to provide a DRAM row hammering implementation method that can quickly and easily trigger a row hammering error on a real and practical computer platform.

[0006] The technical solution adopted by the present invention to solve the above problem is: a DRAM row hammering implementation method based on x86 architecture, characterized in that it includes the following steps: (1) Selecting a memory block; (II) Determine the lower limit of the number of clocks t required to read two random memory addresses with a high probability of being located in the same memory module but in different memory rows N times m ; (III) Select two random memory addresses addr1 and addr2 in the memory block selected in step (I), and read the two random memory addresses N times in a loop. If the number of clocks t of reading the two random memory addresses in N times of loops is greater than t m , then carry out hammer test; (IV) The specific steps of hammer test include: Perform row hammering on two random memory addresses. After completion, scan the selected memory block to check whether data value flip occurs. If so, record the memory address bfa where the data value flips, and record the address value pair (addr1, addr2, bfa). (V) By querying the mapping table from virtual address to physical address, the address value pair (addr1, addr2, bfa) recording the row hammer error is converted into a physical address (paddr1, paddr2, pbfa), where pbfa is the physical address of the memory where the row hammer error is prone to occur, and paddr1 or paddr2 is the physical address of its adjacent memory row.

[0007] In step (1) of the present invention, the selected memory block size is 1G.

[0008] In step (1) of the present invention, all data values ​​of the selected memory blocks are initialized to 1.

[0009] In step (ii) of the present invention, the cache is refreshed immediately after each reading, so that the data backup of the two random memory addresses in the cache is invalid, ensuring that each iteration of the loop reloads the read data from the memory.

[0010] Step (iii) of the present invention includes the following process: (1) Use the random function rand() to generate a random memory address; (2) Use the RDTSC instruction to obtain the current clock number; (3) After using the rand function to obtain two random memory addresses addr1 and addr2, these two addresses are read N times in a loop; You only need to run the RDTSC instruction to count the number of clocks before and after the above loop operation to get the starting clock number and the ending clock number. Then, you can get the number of clocks t consumed by the above N loop operations by subtracting the starting clock number from the ending clock number. (4) Repeat the above operations of selecting two random memory addresses, reading data N times, and counting clock counts; obtain M clock sampling samples t1, t2, t3...t M; Two random memory addresses located in the same memory module but in different memory rows, due to memory row access conflicts, the number of clocks spent is much greater than two random memory addresses not located in the same memory module; Find the maximum value t of M samples max , and the clock lower limit value t m Set to t max -γ; γ is an empirical parameter, which is set according to the actual situation.

[0011] In step (iv) of the present invention, row hammering is performed on the two selected random memory addresses, that is, data is read from the two selected random memory addresses addr1 and addr2 in a loop K times; after each reading, the cache is refreshed using the cflush instruction immediately, so that the data backup of the above two random memory addresses in the cache is invalid, ensuring that the next iteration is reloaded and read from the memory.

[0012] When the data value is flipped in the present invention, the data value is flipped from 1 to 0.

[0013] The specific steps of step (five) of the present invention include: (1) Get the page size page_size of the current operating system, open the address mapping table / proc / self / pagemap file of the Linux operating system, get the current page table information, and locate and read the page entry corresponding to the current virtual address ptr; (2) Extract the page frame number and convert it into a physical address; (3) Use the above steps to convert the three virtual addresses (addr1, addr2, bfa) into the corresponding physical addresses (paddr1, paddr2, pbfa).

[0014] In step (iii) of the present invention, if t is not greater than t m , then reselect two new random memory addresses and repeat this step.

[0015] In step (iv) of the present invention, if there is no flipping, return to step (iii).

[0016] Compared with the prior art, the present invention has the following advantages and effects: 1. The present method can quickly and easily trigger a row hammer error on a real and actual computer platform; 2. The present method can be quickly used, and the user does not need to have an accurate understanding of the underlying operating system and the hardware system. As long as there is enough testing time, the address of the data bit in the DRAM that is prone to row hammer errors can be discovered, thereby completing the test of DRAM reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the main process of an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The present invention will be further described in detail below with reference to the accompanying drawings and by way of embodiments.

[0019] The DRAM row hammering implementation method of the embodiment of the present invention is based on the x86 architecture and includes the following steps: (I) Select a 1G fixed-size memory block and initialize all data values ​​in it to 1. A memory block can be composed of multiple memory module banks and cross-banks.

[0020] Take Linux system as an example. Use mmap system call to apply for a 1G memory block: g_mem=(char*)mmap(Null, mem_size, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE, -1, 0) The parameter mem_size=1<<30, that is, the mem_size size is 2(30)=1G, the parameters PROT_READ and PROT_WRITE ensure that the requested memory block is readable and writable, and the parameters MAP_ANON|MAP_PRIVATE ensure that the memory is used alone and is not associated with other files.

[0021] Initialize the requested 1G memory block with a 64-bit unsigned integer as the step size: uint64_t* end=(uint64_t*)(g_mem+mem_size); uint64_t* ptr; for(prt=(uint64_t*)g_mem; ptr <end; ptr++){ *ptr = ~(uint64_t)0; } The ~(uint64_t)0 here means negating the 64-byte unsigned data, and the result is 0xFF..FF (16 Fs), that is, all 64 bytes are 1.

[0022] (II) Determine the lower limit of the number of clocks required to read 1000 times two random memory addresses that are likely to be in the same memory module bank but in different memory rows m .

[0023] (iii) Select two random memory addresses addr1 and addr2 in the 1G memory block selected in step (i), and read the two random memory addresses in turn in 1000 cycles, and immediately refresh the cache after each read, so that the data backup of the above two random memory addresses in the cache is invalid, ensuring that each iteration of the loop reloads the data from the memory; use the instruction RDTSC to count the number of clocks t consumed by 1000 cycles of reading; If t>t m , it means that the two random memory addresses are likely to be located in the same memory module but in different memory rows, and a row hammer test is performed; otherwise, two new random memory addresses are selected and this step is repeated.

[0024] The specific process includes the following: (1) Use the random function rand() to generate a random memory address. To ensure that the random number falls within the 1G memory block, perform the following operations: uint64_t offset = (rand()<<12)%mem_size; uint64_t* addr = (uint64_t*)(g_mem + offset); The result of rand() is shifted left by 12 bits so that the smaller random number can be expanded to a larger range. The modulo mem_size operation and the g_mem addition operation ensure that the generated random memory address falls within the requested 1G memory address range.

[0025] (2) Use the RDTSC instruction to obtain the current clock number. The high and low 32 bits of the clock are stored in two registers respectively. The values ​​of the two registers can be combined into 64-bit data to obtain the final result: uint_32t low, high; uint_64t current_time; / / Execute RDTSC and read timestamp; asm volatile("rdtsc" : "=a" (low), "=d" (high)); / / Combine the lower 32 bits and the upper 32 bits into 64 bits; start_time = ((uint64_t)high<<32) | low; The above parameters low and high store the low and high 32 bits of the RDTSC result value respectively, and then are combined into the final result value through shifting and assigned to current_time.

[0026] (3) After using the rand function to obtain two random memory addresses addr1 and addr2, the two addresses are read 1000 times in a loop, and the cflush instruction is used to refresh the cache in each iteration: / / Execute 1000 loop read operations and refresh the cache; for (int i = 0; i<1000; i++) { / / Read addr1 and addr2 sequentially; asm volatile("" : : "r"(*addr1), "r"(*addr2) : "memory"); / / Refresh addr1 and addr2 in the cache; asm volatile("clflush (%0)" : : "r" (addr1) : "memory"); asm volatile("clflush (%0)" : : "r" (addr2) : "memory"); }.

[0027] You only need to run the RDTSC instruction to count the number of clocks before and after the above loop operation to obtain the starting clock number start_time and the ending clock number end_time, and then subtract start_time from end_time to get the number of clocks t consumed by the above 1000 loop operations.

[0028] Repeat the above steps of selecting two random memory addresses, looping 1000 times to read data and count clocks; obtain 100 clock sampling samples t1, t2, t3...t 100 ; Two random memory addresses in the same memory module Bank but different memory rows, due to memory row access conflicts, the number of clocks spent is much greater than two random memory addresses not in the same memory module Bank; Find the maximum value t of 100 samples max , and the clock lower limit value t m Set to t max -γ; γ is an empirical parameter, which is set according to the actual situation.

[0029] (IV) The specific steps of hammer test include: Perform row hammering on the two selected random memory addresses, that is, read the data from the two selected random memory addresses addr1 and addr2 in a loop 800*1000 times in sequence; immediately use the cflush instruction to refresh the cache after each read, so that the data backup of the above two random memory addresses in the cache is invalid, ensuring that the next iteration is reloaded from the memory. The sample code is as follows: / / Perform 800*1000 row hammer read operations and refresh the cache for (int i = 0; i<1000; i++) { / / Read addr1 and addr2 sequentially asm volatile("" : : "r"(*addr1), "r"(*addr2) : "memory"); / / Refresh addr1 and addr2 in the cache asm volatile("clflush (%0)" : : "r" (addr1) : "memory"); asm volatile("clflush (%0)" : : "r" (addr2) : "memory"); }.

[0030] When the loop iteration ends, the entire 1G memory block is scanned and read in units of 8 bytes to check whether the data value is equal to 0xFF..FF (16 Fs). If there is an inequality, it means that the data value of the corresponding address has flipped from '1' to '0'. The sample code is as follows: uint64_t *end = (uint64_t *) (g_mem + mem_size); uint64_t *ptr, *bfa; for (ptr = (uint64_t *) g_mem; ptr <end; ptr++) { uint64_t got = *ptr; uint64_t expected = ~(uint64_t) 0; if (got != expected) { bfa=ptr; return bfa; } } return null.

[0031] By comparing the data value (got) in the current memory to see if it is equal to 0xFF..FF (16 Fs), determine whether there is a rollover. If there is a rollover, record the memory address bfa where the data value is flipped, and record the address value pair (addr1, addr2, bfa). If there is no rollover, return to step (three).

[0032] (V) By querying the mapping table from virtual address to physical address, the address value pair (addr1, addr2, bfa) recording the row hammer error is converted into a physical address (paddr1, paddr2, pbfa), where pbfa is the physical address of the memory where the row hammer error is prone to occur, and paddr1 or paddr2 is the physical address of its adjacent memory row.

[0033] The specific steps include: (1) Get the page size page_size of the current operating system, open the address mapping table / proc / self / pagemap file of the Linux operating system, get the current page table information, locate and read the page entry corresponding to the current virtual address ptr. The sample code is as follows: / / Calculate the offset of the page frame number (PFN) in the pagemap file off_t offset = (virtual_addr / PAGE_SIZE) * sizeof(uint64_t); lseek(fd, offset, SEEK_SET); / / Set the file offset position # Read entries; uint64_t entry; int bytes_read = read(fd,&entry, sizeof(entry)); (2) Extract the page frame number and convert it into a physical address based on the page frame number. The sample code is as follows: / / Get the page frame number (Physical Frame Number, PFN) uint64_t pfn = entry&((1ULL<<54) - 1); / / Convert PFN to physical address; uint64_t physical_addr = (pfn * PAGE_SIZE) + (virtual_addr % PAGE_SIZE); (3) Use the above steps to convert the three virtual addresses (addr1, addr2, bfa) into the corresponding physical addresses (paddr1, paddr2, pbfa).

[0034] In addition, it should be noted that the shapes and names of the parts and components of the specific embodiments described in this specification may be different, and the above content described in this specification is only an example of the structure of the present invention. All equivalent changes or simple changes made based on the structure, features and principles described in the patent concept of the present invention are included in the protection scope of the patent of the present invention. Technicians in the technical field of the present invention can make various modifications or supplements to the specific embodiments described or replace them in a similar manner, as long as they do not deviate from the structure of the present invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. A method for implementing DRAM row hammering, characterized in that: The steps include: (1) Selecting a memory block; (II) Determine the lower limit of the number of clocks t required to read two random memory addresses with a high probability of being located in the same memory module but in different memory rows N times m ; (III) Select two random memory addresses addr1 and addr2 in the memory block selected in step (I), and read the two random memory addresses N times in a loop. If the number of clocks t of reading the two random memory addresses in N times of loops is greater than t m , then carry out hammer test; (IV) The specific steps of hammer test include: Perform row hammering on two random memory addresses, and then scan the selected memory blocks to see if there is any data value flip; If yes, record the memory address bfa where the data value is flipped, and record the address value pair (addr1, addr2, bfa); (V) By querying the mapping table from virtual address to physical address, the address value pair (addr1, addr2, bfa) recording the row hammer error is converted into a physical address (paddr1, paddr2, pbfa), where pbfa is the physical address of the memory where the row hammer error is prone to occur, and paddr1 or paddr2 is the physical address of its adjacent memory row.

2. A DRAM row hammering implementation method according to claim 1, characterized in that: In step (1), the selected memory block size is 1G.

3. A DRAM row hammering implementation method according to claim 1, characterized in that: In step (1), all data values ​​of the selected memory block are initialized to 1.

4. A DRAM row hammering implementation method according to claim 1, characterized in that: In step (ii), the cache is refreshed immediately after each read, so that the data backup of the two random memory addresses in the cache is invalid, ensuring that each iteration of the loop reloads the read data from the memory.

5. A DRAM row hammering implementation method according to claim 1, characterized in that: Step (iii) includes the following process: (1) Use the random function rand() to generate a random memory address; (2) Use the RDTSC instruction to obtain the current clock number; (3) After using the rand function to obtain two random memory addresses addr1 and addr2, these two addresses are read N times in a loop; You only need to run the RDTSC instruction to count the number of clocks before and after the above loop operation to get the starting clock number and the ending clock number. Then, you can get the number of clocks t consumed by the above N loop operations by subtracting the starting clock number from the ending clock number. (4) Repeat the above operations of selecting two random memory addresses, reading data N times, and counting clock counts; obtain M clock sampling samples t1, t2, t3...t M ; Two random memory addresses located in the same memory module but in different memory rows, due to memory row access conflicts, the number of clocks spent is much greater than two random memory addresses not located in the same memory module; Find the maximum value t of M samples max , and the clock lower limit value t m Set to t max -γ; γ is an empirical parameter, which is set according to the actual situation.

6. A DRAM row hammering implementation method according to claim 1, characterized in that: In step (iv), the two selected random memory addresses are row hammered, that is, the data of the two selected random memory addresses addr1 and addr2 are read in a loop K times; after each reading, the cache is refreshed immediately using the cflush instruction, so that the data backup of the above two random memory addresses in the cache is invalid, ensuring that the next iteration is reloaded and read from the memory.

7. A DRAM row hammering implementation method according to claim 3, characterized in that: When a data value flip occurs, the data value flips from 1 to 0.

8. A DRAM row hammering implementation method according to claim 1, characterized in that: The specific steps of step (five) include: (1) Get the page size page_size of the current operating system, open the address mapping table / proc / self / pagemap file of the Linux operating system, get the current page table information, and locate and read the page entry corresponding to the current virtual address ptr; (2) Extract the page frame number and convert it into a physical address; (3) Use the above steps to convert the three virtual addresses (addr1, addr2, bfa) into the corresponding physical addresses (paddr1, paddr2, pbfa).

9. A DRAM row hammering implementation method according to claim 1, characterized in that: In step (iii), if t is not greater than t m , then reselect two new random memory addresses and repeat this step.

10. A DRAM row hammering implementation method according to claim 1, characterized in that: In step (iv), if there is no flip, return to step (iii).

Images