# Rowhammer results thread

## zlg

I searched the forums before posting, but months ago some research was done on RAM chips and they found that sometimes bits can flip when addresses are accessed in quick succession. (more details on http://rowhammer.com )

Google recently published a program to test one's RAM against the Rowhammer vulnerability[1] and they started a Google Group for people to discuss it. [2] Since I don't have (and refuse to get) a Google account, I figured I and other like-minded people could post results for their hardware so others can be informed.

When posting results, you'll need to indicate which make and model of RAM, the timings, and clock speed. People in the mailing list decided this command would be best on GNU/Linux, but the output for mine didn't give make and model:

```
dmidecode | grep "Memory Device" -A19
```

You'll need to emerge sys-apps/dmidecode for this if you haven't already.

When running rowhammer-test, let it sit for about an hour (or 1000 iterations or more). The longer the better. The program will keep going until it encounters a flipped bit. I ran it for a little over 1000 iterations and found it still running, which indicates that my RAM was AOK. I'll post my results in the next post.

Mods: If this is the wrong place, please move it instead of deleting it! It's the best place I could think of to post it.

[1]: https://github.com/google/rowhammer-test

[2]: https://groups.google.com/group/rowhammer-discuss/Last edited by zlg on Thu Mar 12, 2015 12:29 am; edited 1 time in total

----------

## zlg

Results for `dmidecode | grep "Memory Device" -A19`:

```

Memory Device

   Array Handle: 0x0034

   Error Information Handle: Not Provided

   Total Width: 64 bits

   Data Width: 64 bits

   Size: 4096 MB

   Form Factor: DIMM

   Set: None

   Locator: DIMM0

   Bank Locator: BANK0

   Type: Other

   Type Detail: Synchronous

   Speed: 1333 MHz

   Manufacturer: Manufacturer0

   Serial Number: SerNum0

   Asset Tag: AssetTagNum0

   Part Number: PartNum0

Handle 0x0037, DMI type 20, 19 bytes

Memory Device Mapped Address

   Starting Address: 0x00000000000

   Ending Address: 0x000FFFFFFFF

   Range Size: 4 GB

   Physical Device Handle: 0x0036

   Memory Array Mapped Address Handle: 0x0035

   Partition Row Position: 1

Handle 0x0038, DMI type 17, 27 bytes

Memory Device

   Array Handle: 0x0034

   Error Information Handle: Not Provided

   Total Width: 64 bits

   Data Width: 64 bits

   Size: 4096 MB

   Form Factor: DIMM

   Set: None

   Locator: DIMM1

   Bank Locator: BANK1

   Type: Other

   Type Detail: Synchronous

   Speed: 1333 MHz

   Manufacturer: Manufacturer1

   Serial Number: SerNum1

   Asset Tag: AssetTagNum1

   Part Number: PartNum1

Handle 0x0039, DMI type 20, 19 bytes

Memory Device Mapped Address

   Starting Address: 0x00100000000

   Ending Address: 0x001FFFFFFFF

   Range Size: 4 GB

   Physical Device Handle: 0x0038

   Memory Array Mapped Address Handle: 0x0035

   Partition Row Position: 1

Handle 0x003A, DMI type 17, 27 bytes

Memory Device

   Array Handle: 0x0034

   Error Information Handle: Not Provided

   Total Width: 64 bits

   Data Width: 64 bits

   Size: 4096 MB

   Form Factor: DIMM

   Set: None

   Locator: DIMM2

   Bank Locator: BANK2

   Type: Other

   Type Detail: Synchronous

   Speed: 1333 MHz

   Manufacturer: Manufacturer2

   Serial Number: SerNum2

   Asset Tag: AssetTagNum2

   Part Number: PartNum2

Handle 0x003B, DMI type 20, 19 bytes

Memory Device Mapped Address

   Starting Address: 0x00200000000

   Ending Address: 0x002FFFFFFFF

   Range Size: 4 GB

   Physical Device Handle: 0x003A

   Memory Array Mapped Address Handle: 0x0035

   Partition Row Position: 1

Handle 0x003C, DMI type 17, 27 bytes

Memory Device

   Array Handle: 0x0034

   Error Information Handle: Not Provided

   Total Width: 64 bits

   Data Width: 64 bits

   Size: 4096 MB

   Form Factor: DIMM

   Set: None

   Locator: DIMM3

   Bank Locator: BANK3

   Type: Other

   Type Detail: Synchronous

   Speed: 1333 MHz

   Manufacturer: Manufacturer3

   Serial Number: SerNum3

   Asset Tag: AssetTagNum3

   Part Number: PartNum3

Handle 0x003D, DMI type 20, 19 bytes

Memory Device Mapped Address

   Starting Address: 0x00300000000

   Ending Address: 0x003FFFFFFFF

   Range Size: 4 GB

   Physical Device Handle: 0x003C

   Memory Array Mapped Address Handle: 0x0035

   Partition Row Position: 1

Handle 0x003E, DMI type 32, 20 bytes

System Boot Information

   Status: No errors detected

Handle 0x003F, DMI type 127, 4 bytes

End Of Table

```

I'm using four G.SKILL Sniper 4 GB sticks, DDR3 1333 (PC3 10666). The timings are stock (9-9-9-24) and Cas latency is 9.

I ran 1001 iterations of rowhammer-test (about an hour's worth) and no errors were found. I'm not sure if product page links are allowed on here, so I will forego linking to the Newegg page.

----------

## frostschutz

For me the test (which I ran in Initramfs) took at most 5 minutes to find a flipped bit (fffbfff). wow.  :Laughing: 

I'm not too concerned about it - as long as this kind of memory access does not happen normally and exploiting it is not too straightforward.

Regular memtest runs for hours without errors.

2x BLT8G3D1608DT1TX0 on a Haswell sytem...

----------

## NeddySeagoon

sporkbox,

There are only three or four manufactuers of RAM chips in the word.

RAM stick vendors buy parts made by these companies.

dmidecode, if in tells you anything, will tell who made your RAM sticks, not the silicon.

What we need to know is the silicon manufactuer, part number of the chips and maybe the date code on the chips.

You can only get this info by examining the chips, probably with an eye glass.

Bit flips in non ECC RAM may go undetected, unless they occur in instructions that the CPU is trying to execute.

Then results vary from an incorrect instruction being executed to an illegal instruction exception.

You will notice the latter as the process will be killed but the former is much more difficult to spot.

----------

