Skip to content
Trigger the rowhammer bug on ARMv8
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
1_phy2dram_mapping
2_find_aggressors
3_rowhammer_test
4_experiments
5_modify_refresh_rate
.gitignore
README.md

README.md

rowhammer_armv8

The preliminary results are published in our paper "Triggering Rowhammer Hardware Faults on ARM: A Revisit".

This code works on board AML-S905X-CC(Le Potato). To use it on other boards, some minor modifications may be needed.

NOTE: As our focus is on how to trigger the rowhammer bug on ARMv8-A platforms, some of the technical challenges like obtaining the physical-to-DRAM address mapping and finding appropriate aggressor rows are solved directly by leveraging some privileged interfaces/methods. However, after pairs of aggressor rows are acquired, the hammering process is unprivileged.

How to run our experiments

Get mapping from physical address to DRAM

We implement this in a kernel module. To perform double-sided hammering, we are interested in the second lowest row bit. (We found the second lowest row bit is bit 16 of the physical address on AML-S905X-CC.)

cd 1_phy2dram_mapping 
make  
make test  

Install pagemap lib

This library can be used to read "/proc/<pid>/pagemap" file and find candidate aggressor pairs

cd 2_find_aggressors  
make  
make install  

Start rowhammer test

Run rowhammer program and output flippable bits

cd 3_rowhammer_test  
make  
make run  

Sending output as input of experiments

make send

Experiments

  • Experiment 1: Finding relationships between the number of iterations and the number of bit flips

  • Experiment 2: Measuring the execution time of different apporaches

  • Experiment 3: Comparing the effectiveness of different approaches

  • Experiment 4: Measuring the performance of multi-threaded hammering

    • You can also disable cache maintenance instructions

Modify refresh rate (optional)

  • Applicable on AML-S905X-CC(Le Potato) only

  • Can modify refresh interval of DRAM

  • Only used to quickly find potential aggressor rows

You can’t perform that action at this time.