From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754121AbbCIVU1 (ORCPT ); Mon, 9 Mar 2015 17:20:27 -0400 Received: from atrey.karlin.mff.cuni.cz ([195.113.26.193]:37933 "EHLO atrey.karlin.mff.cuni.cz" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753407AbbCIVUU (ORCPT ); Mon, 9 Mar 2015 17:20:20 -0400 Date: Mon, 9 Mar 2015 22:17:51 +0100 From: Pavel Machek To: Andy Lutomirski Cc: Mark Seaborn , kernel list , One Thousand Gnomes Subject: Re: DRAM unreliable under specific access patern Message-ID: <20150309211751.GA3991@amd> References: <20141224220818.GA17655@amd> <20150105192329.5f32c155@lxorguk.ukuu.org.uk> <20150106232025.GA32569@amd> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon 2015-03-09 09:30:50, Andy Lutomirski wrote: > On Mon, Mar 9, 2015 at 9:03 AM, Mark Seaborn wrote: > > On 6 January 2015 at 15:20, Pavel Machek wrote: > >> On Mon 2015-01-05 19:23:29, One Thousand Gnomes wrote: > >> > > In the meantime, I created test that actually uses physical memory, > >> > > 8MB apart, as described in some footnote. It is attached. It should > >> > > work, but it needs boot with specific config options and specific > >> > > kernel parameters. > >> > > >> > Why not just use hugepages. You know the alignment guarantees for 1GB > >> > pages and that means you don't even need to be root > >> > > >> > In fact - should we be disabling 1GB huge page support by default at this > >> > point, at least on non ECC boxes ? > >> > >> Actually, I could not get my test code to run; and as code from > >> > >> https://github.com/mseaborn/rowhammer-test > >> > >> reproduces issue for me, I stopped trying. I could not get it to > >> damage memory of other process than itself (but that should be > >> possible), I guess that's next thing to try. > > > > FYI, rowhammer-induced bit flips do turn out to be exploitable. Here > > are the results of my research on this: > > http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html > > > > IIRC non-temporal writes will force cachelines out to main memory > *and* invalidate them. (I wouldn't be shocked if Skylake changes > this, but I'm reasonably confident that it's true on all currently > available Intel chips.) > > Have you checked whether read; read; nt store; nt store works? > > (I can't test myself easily right now -- I think my laptop is too old > for this issue.) Well, if you had laptop with that issue, it would still be tricky to test this. It takes a while to reproduce... Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html