comsec-group / blacksmith Goto Github PK
View Code? Open in Web Editor NEWNext-gen Rowhammer fuzzer that uses non-uniform, frequency-based patterns (IEEE S&P '22).
License: MIT License
Next-gen Rowhammer fuzzer that uses non-uniform, frequency-based patterns (IEEE S&P '22).
License: MIT License
Hi,
I try to run Blacksmith on my machine with an i7-8700 CPU, Ubuntu 18 with Linux version 5.4.0-84-generic, and 1x16G Hynix/Hyundai HMA82GU6DJR8N-VK DRAM.
However, the program is stuck at the function DramAnalyzer::count_acts_per_trefi(). Based on my understanding, it's due to a hard-coded value 3.0 in
blacksmith/src/Memory/DramAnalyzer.cpp
Line 165 in 0d775c9
Hi
I installed blacksmith on a i3-8350k (Coffee-Lake-S) System. Unfortunately the test hangs after a while and the stdout.log shows some strange characters.
Does anyone have an idea what could be the reason of this?
BR
JKR
stdout_2022_02_04_hangs.log
Hi. I got it working on my gen3 I7 build, but I was wondering if this works on WSL2?
pstejska@PSTEJSKA03-PC:/blacksmith-public/build$ sudo ./blacksmith --dimm-id 2 --runtime-limit 21600 --ranks 1 --sweeping/blacksmith-public/build$ sudo ./blacksmith --dimm-id 1 --runtime-limit 21600 --ranks 1 --sweeping
Writing into logfile stdout.log
pstejska@PSTEJSKA03-PC:
[+] General information about this fuzzing run:
Start timestamp:: 1637689072
Hostname: PSTEJSKA03-PC
Commit SHA: NO_REPOSITORY
Run time limit: 21600 (6 hours 0 minutes 0 seconds)
[+] Printing run configuration (GlobalDefines.hpp):
DRAMA_ROUNDS: 1000
CACHELINE_SIZE: 64
HAMMER_ROUNDS: 1000000
THRESH: 495
NUM_TARGETS: 10
MAX_ROWS: 30
NUM_BANKS: 16
DIMM: 1
CHANNEL: 1
MEM_SIZE: 1073741824
PAGE_SIZE: 4096
[+] Initializing memory with pseudorandom sequence.
[-] Could not find conflicting address sets. Is the number of banks (16) defined correctly?
BlackSmith 0.0.2 has no support for ARM processors:
[81%] Building CXX object CMakeFiles/bs.dir/src/Fuzzer/AggressorAccessPattern.cpp.o
In file included from /home/parallels/blacksmith/include/Memory/DramAnalyzer.hpp:13,
from /home/parallels/blacksmith/include/Memory/Memory.hpp:13,
from /home/parallels/blacksmith/include/Forges/TraditionalHammerer.hpp:9,
from /home/parallels/blacksmith/src/Forges/TraditionalHammerer.cpp:1:
/home/parallels/blacksmith/include/Utilities/AsmPrimitives.hpp: In static member function ‘static void TraditionalHammerer::hammer_sync(std::vector<volatile char*>&, int, volatile char*, volatile char*)’:
/home/parallels/blacksmith/include/Utilities/AsmPrimitives.hpp:56:3: error: unknown register name ‘%rcx’ in ‘asm’
56 | asm volatile("rdtscp\n"
| ^~~
/home/parallels/blacksmith/include/Utilities/AsmPrimitives.hpp:56:3: error: unknown register name ‘%rcx’ in ‘asm’
56 | asm volatile("rdtscp\n"
| ^~~
/home/parallels/blacksmith/include/Utilities/AsmPrimitives.hpp:56:3: error: unknown register name ‘%rcx’ in ‘asm’
56 | asm volatile("rdtscp\n"
| ^~~
/home/parallels/blacksmith/include/Utilities/AsmPrimitives.hpp:56:3: error: unknown register name ‘%rcx’ in ‘asm’
56 | asm volatile("rdtscp\n"
| ^~~
make[2]: *** [CMakeFiles/bs.dir/build.make:104: CMakeFiles/bs.dir/src/Forges/TraditionalHammerer.cpp.o] Error 1
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [CMakeFiles/Makefile2:387: CMakeFiles/bs.dir/all] Error 2
make: *** [Makefile:136: all] Error 2
Was trying this on Ubuntu 21.10 but got the error in the title. Did I miss something?
Hi @pjattke ,
I've used the Blacksmith fuzzer to find patterns that produce a large number of bit flips on some DIMMs. However, on other DIMMs from the same manufacturer and having similar geometry (same number of ranks and banks), I have not managed to produce even a single bit flip even after repeated invocations of the fuzzer (I've roughly run the fuzzer 6 different times, each fuzzing for a duration of 6 hours). I assume it is unlikely for these DIMMs to be completely robust to the Rowhammer exploit and exploring the search space further should produce bit flips? Did you also come across something similar in your experiments? Do you have any practical advice (perhaps alter the THRESH value defined in GlobalDefines.hpp or run the fuzzer on a particular CPU) so I can produce bit flips on these DIMMs too?
Let me know if you would require further information and thanks again for your time!
cc @kaustav-goswami and @dxaen
Hello,
I wanted to try your fuzzer on various computers but I always end up with the mmap: Cannot allocate memory
error.
I thought this would come from my configuration so I tried to increase the number of available huge pages.
I currently have the following memory configuration regarding huge pages:
▶ cat /proc/meminfo|grep Huge
AnonHugePages: 0 kB
ShmemHugePages: 0 kB
FileHugePages: 0 kB
HugePages_Total: 535
HugePages_Free: 535
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 2048 kB
Hugetlb: 1095680 kB
On other devices I could even reach more than 1000 free huge pages, which I believe is enough for allocating 1GB of memory with huge pages. However the issue seems to come from somewhere else.
I tried the execution on two different devices with ArchLinux, Debian 11 and Ubuntu 18.04 LTS with no success.
Am I missing something ?
After setting the hugepage size to 1G and build the blacksmith successfully, the program ends with the output "Illegal Instructions" and there is no content in the stdout.log
I'm not able to get past this error even when recompiling with different NUM_BANKS value - I tried 4, 8, 16 and even 32. Always the same output. I'm not sure what other parameters to adjust as the error message doesn't suggest anything else.
My output is:
[+] General information about this fuzzing run:
Start timestamp:: 1637333603
Hostname: ubuntu
Commit SHA: c8e65b709a83665f9528efdedcf064abdb04859f
Run time limit: 21600 (6 hours 0 minutes 0 seconds)
[+] Printing run configuration (GlobalDefines.hpp):
DRAMA_ROUNDS: 1000
CACHELINE_SIZE: 64
HAMMER_ROUNDS: 1000000
THRESH: 495
NUM_TARGETS: 10
MAX_ROWS: 30
NUM_BANKS: 32
DIMM: 1
CHANNEL: 1
MEM_SIZE: 1073741824
PAGE_SIZE: 4096
[+] Initializing memory with pseudorandom sequence.
[-] Could not find conflicting address sets. Is the number of banks (32) defined correctly?
My kernel is 5.13.0-19-generic on ubuntu 21.10
Any help is appreciated.
Hi @pjattke,
I have some questions regarding the use of some time-based side channels in the blacksmith code.
If I understood correctly, the find_bank_conflicts()
method of DramAnalyzer
is using a timing side-channel to find addresses that map to each DRAM bank. However, since blacksmith also uses DRAMA to figure out the DRAM functions to map physical addresses to the DRAM geometry (channel, rank, bank, row, etc) what is the need for this side channel?
find_bank_conflicts()
checks if the time that is taken to access 2 addresses is above a threshold to determine if the 2 addresses belong to the same bank. How did you determine this threshold? My understanding is that the code is looking for Row buffer misses when accessing the 2 addresses (which would take longer implying that they belong to the same bank), but how did you set a value to the threshold? Is the threshold dependent on each individual DIMM or does it depend on the microarchitecture? Also, why is it that the same pair of addresses is checked twice? Is this done to account for jitter?
Lastly, the hammer_sync()
method of TraditionalHammerer
uses a timing side-channel to detect the start of a refresh interval to synchronize hammering within the interval. The timing side-channel uses 2 addresses in the same bank in order to do the sync. Is there any reason as to why the method uses 2 addresses? Can detecting the start of a refresh be detected just by accessing a single address?
Thanks for your time and wish you a happy new year.
cc @kaustav-goswami and @dxaen.
Did anyone try running blacksmith on CPUs other than Coffee Lake?
I was able to run it successfully on Kaby Lake, but it didn't work on Comet Lake. It errors out immediately saying it could not find conflicting address sets and asks if the number of banks has been defined correctly (which I checked is correct).
after running blacksmith with default param as mentioned in the description, it stopped immediately with the following erreur in the logfile :
`
[+] General information about this fuzzing run:
Start timestamp:: 1637072011
Hostname: 1cc27a1cdb50
Commit SHA: c8e65b7
Run time limit: 120 (0 hours 2 minutes 0 seconds)
[+] Printing run configuration (GlobalDefines.hpp):
DRAMA_ROUNDS: 1000
CACHELINE_SIZE: 64
HAMMER_ROUNDS: 1000000
THRESH: 495
NUM_TARGETS: 10
MAX_ROWS: 30
NUM_BANKS: 16
DIMM: 1
CHANNEL: 1
MEM_SIZE: 1073741824
PAGE_SIZE: 4096
[-] Instruction setpriority failed.
[+] Could not mount superpage from /mnt/huge/buff. Error:
`
after installing blacksmith successfully and setting up the hugepage to 1 GB I tested the following :
sudo ./blacksmith --dimm-id 1 --runtime-limit 120 --ranks 1
and i get this error message: mmap: Invalid argument
how can I check if my --dimm-id is valid or not? I think its the argument that creates this issue!
my OS : Linux ubuntu 5.11.0-27-generic 64-bit
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.