Skip to content
Trigger the rowhammer bug on ARMv8
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.


The preliminary results are published in our paper "Triggering Rowhammer Hardware Faults on ARM: A Revisit".

This code works on board AML-S905X-CC(Le Potato). To use it on other boards, some minor modifications may be needed.

NOTE: As our focus is on how to trigger the rowhammer bug on ARMv8-A platforms, some of the technical challenges like obtaining the physical-to-DRAM address mapping and finding appropriate aggressor rows are solved directly by leveraging some privileged interfaces/methods. However, after pairs of aggressor rows are acquired, the hammering process is unprivileged.

How to run our experiments

Get mapping from physical address to DRAM

We implement this in a kernel module. To perform double-sided hammering, we are interested in the second lowest row bit. (We found the second lowest row bit is bit 16 of the physical address on AML-S905X-CC.)

cd 1_phy2dram_mapping 
make test  

Install pagemap lib

This library can be used to read "/proc/<pid>/pagemap" file and find candidate aggressor pairs

cd 2_find_aggressors  
make install  

Start rowhammer test

Run rowhammer program and output flippable bits

cd 3_rowhammer_test  
make run  

Sending output as input of experiments

make send


  • Experiment 1: Finding relationships between the number of iterations and the number of bit flips

  • Experiment 2: Measuring the execution time of different apporaches

  • Experiment 3: Comparing the effectiveness of different approaches

  • Experiment 4: Measuring the performance of multi-threaded hammering

    • You can also disable cache maintenance instructions

Modify refresh rate (optional)

  • Applicable on AML-S905X-CC(Le Potato) only

  • Can modify refresh interval of DRAM

  • Only used to quickly find potential aggressor rows

You can’t perform that action at this time.