<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;"><span style="font-size: 13.3333px;">Hi Zoran,</span>
<div style="font-size: 13.3333px;"><br>
</div>
<div style="font-size: 13.3333px;">Thanks for the reference; you make a great point. My hope is that experiments with DRAM will stand as a case study in support of open source firmware that fingerprints HW during boot with the intention of identifying counterfeit/faulty
modules. Measuring the retention time of DRAM happens to be one technique, but I suspect there are other side-channels (e.g. power consumption, latencies) that expose self-identifying behaviors and that may extend to other HW modules of a system. In summary,
I am interested in security extensions to Coreboot which provide a user with more transparency to what is under the hood of their machine.</div>
<div style="font-size: 13.3333px;"><br>
</div>
<div style="font-size: 13.3333px;">I will certainly keep you all posted on the results! I am still struggling to properly turn off the auto-refresh of DRAM and measure the retention time in Coreboot. I would much appreciate any further guidance on how to do
this (or especially if anyone can refer me to the AMD AGESA Memory team; I have been unable to find contact info online).</div>
<div style="font-size: 13.3333px;"><br>
</div>
<div style="font-size: 13.3333px;">Thank you!</div>
<div style="font-size: 13.3333px;">Berj</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF104880" style="direction: ltr;"><font face="Tahoma" size="2" color="#000000"><b>From:</b> Zoran Stojsavljevic [zoran.stojsavljevic@gmail.com]<br>
<b>Sent:</b> Saturday, March 25, 2017 5:28 AM<br>
<b>To:</b> Berj K Chilingirian<br>
<b>Cc:</b> Peter Stuge; coreboot<br>
<b>Subject:</b> Re: [coreboot] Disabling Auto-Refresh of DRAM Using Coreboot<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr"><span style="font-size:12.8px">> For instance, the CPU may convey to the user during boot: “Your DRAM claims it is made by manufacturer A but</span>
<div><span style="font-size:12.8px">> it is acting like it is made by manufacturer B. Manufacturer B is known to be susceptible to these hardware trojans, defects, etc.”</span><br>
</div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">Interesting work. To invent SW/FW algorithm to survey DRAM in order to find out what are retention times, and based upon that to construct SPD flash info.</span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">The mortal problem with DDRs and refresh times waits just around the corner, since the technology of the gate, upon shrinking (present gate sizes around 22/20nm) the refreshing time drops. As the stochastics/volatility about
retention times rises. Very soon it'll hit Dead End (around 16/14nm).</span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">And... Hitting (with the current technology) The Dead End (complete denial of Moore's Law, which is imminent), do you think it is worth?</span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px"><a href="https://www.techinsights.com/uploadedFiles/Public_Website/Content_-_Primary/Marketing/2013/DRAM_Roadmap/Report/TechInsights-DRAM-ROADMAP-052013-LONG-version.pdf" target="_blank">Link to read.</a></span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">Well... It is a true experimental job, and I wish you good luck with it. :-)</span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">Please, keep us posted!</span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">Zoran</span></div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Mar 24, 2017 at 6:14 PM, Berj K Chilingirian <span dir="ltr">
<<a href="mailto:berjc@mit.edu" target="_blank">berjc@mit.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div style="word-wrap:break-word">Hi Zoran and Peter,
<div><br>
</div>
<div>I’m actually interested in the retention time of DRAM cells for fingerprinting purposes (i.e. not for any kind of performance tuning). It turns out that retention time information (such as the distribution of retention times across the cells of DRAM) can
be used to identify the manufacturer of that DRAM (see <a href="http://www.pdl.cmu.edu/PDL-FTP/NVM/dram-retention_isca13.pdf" target="_blank">here</a>, especially Figure 8, for details). The paper cited uses an FPGA implementation to measure the retention
time. In contrast, I’m interested in seeing whether this relationship holds under a traditional setup and how it may then be leveraged to build secure systems that make their hardware (e.g. DRAM) transparent to the user without relying on static information
like the SPD.</div>
<div><br>
</div>
<div>For instance, the CPU may convey to the user during boot: “Your DRAM claims it is made by manufacturer A but it is acting like it is made by manufacturer B. Manufacturer B is known to be susceptible to these hardware trojans, defects, etc.”</div>
<div><br>
</div>
<div>This is, of course, a very research oriented project with many strong assumptions, but I’m hoping that it will lead to some interesting results (it is part of my master’s thesis).</div>
<div><br>
</div>
<div>Thus, that is why I need to figure out a way to disable the auto-refresh of DRAM ;)</div>
<div><br>
</div>
<div>Best,</div>
<div>Berj</div>
<div>
<div class="h5">
<div>
<div>
<blockquote type="cite">
<div>On Mar 24, 2017, at 8:01 AM, Zoran Stojsavljevic <<a href="mailto:zoran.stojsavljevic@gmail.com" target="_blank">zoran.stojsavljevic@gmail.com</a><wbr>> wrote:</div>
<br class="m_-297862796382488512Apple-interchange-newline">
<div>
<div dir="ltr"><span style="font-size:12.8px">> Quantify data retention of unpowered memory.</span>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">Let us asses/investigate what is the technology of C (capacitor) in the
<a href="https://upload.wikimedia.org/wikipedia/commons/b/bd/DRAM_Cell_Structure_%28Model_of_Single_Circuit_Cell%29.PNG" target="_blank">
presented diagram</a> in my previous email!</span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-family:sans-serif; font-size:14px">The capacitor in the stacked capacitor scheme is constructed above the surface of the substrate. The capacitor is constructed from an
<b><i><u><font color="#ff0000">oxide-nitride-oxide (ONO) dielectric sandwiched in between two layers of polysilicon plates</font></u></i></b> (the top plate is shared by all DRAM cells in an IC), and its shape can be a rectangle, a cylinder, or some other more
complex shape. There are two basic variations of the stacked capacitor, based on its location relative to the bitline—capacitor-over-bitline (COB) and capacitor-under-bitline (CUB). In a former variation, the capacitor is underneath the bitline, which is usually
made of metal, and the bitline has a polysilicon contact that extends downwards to connect it to the access transistor's source terminal.</span><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px"><br>
</span>
<div><span style="font-size:12.8px">Well, let us search more (on the ONO - Oxide-Nitride-Oxide dielectric material):</span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px"><b><i><u><font color="#ff0000"> </font></u></i></b></span><span style="font-family:sans-serif; font-size:15px"><b><i><u><font color="#ff0000">The commonly used technology for non-volatile Flash memory application consists
of a stacked-gate transistor with dual gates. The Oxide-Nitride-Oxide (ONO) stacks constitute the inter-poly dielectric layer between those gates.</font></u></i></b><font color="#333333"> These top and bottom polycrystalline silicon plates are also known as
the control gate (CG) and the floating gate (FG) respectively. During read and write operation of a flash memory device, a high electrical bias needs to be applied through the control gate in order for electrons to be tunneled through the thin tunnel oxide
towards the floating gate which is surrounded by dielectric material.</font></span><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">Although the same material is used in DRAMs and FLASHes (as in one case for dielectric in Cs, in other channel material for the FETs with dual gates), the design of DRAMs and FLASHes are essentially very different, as I see.
It seems to me that in case of C, ONO is dielectric which holds the capacitor charge, and leaks it through dielectric, in the case of dual gate FETs we have here The Tunnel Effect, which captures some number of free electrons inside the ONO.</span><br>
</div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">Well... I am also curious (as you, Peter), what will be the retention time, but, as a difference to you, I think that after maximum of 7.8us x 2 some bits (maybe 5% of them, even less, but certainly more than 0.1%) will be
corrupted.</span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">Now, after the quick analysis/assessment I made, now I understand why all the DRAM companies are trying to pack future DDRs as FLASHes. Never came to me before to investigate this... But there is always the first time (courtesy
of Mr, Chilingirian, Massachusetts Institute of Technology). ;-)</span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">Zoran</span></div>
<div>_______</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Mar 24, 2017 at 12:19 PM, Peter Stuge <span dir="ltr">
<<a href="mailto:peter@stuge.se" target="_blank">peter@stuge.se</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<span class="m_-297862796382488512gmail-">Zoran Stojsavljevic wrote:<br>
> I am not sure what are you really trying to do,<br>
<br>
</span>Quantify data retention of unpowered memory.<br>
<span class="m_-297862796382488512gmail-"><br>
<br>
> and, mostly WHY you are trying to do what you are trying to do?!<br>
<br>
</span>To challenge the assumption that data is lost without power.<br>
<br>
It is an interesting area of research because that assumption - or<br>
simplification - is so widespread, although not at all correct.<br>
<span class="m_-297862796382488512gmail-HOEnZb"><font color="#888888"><br>
<br>
//Peter<br>
</font></span>
<div class="m_-297862796382488512gmail-HOEnZb">
<div class="m_-297862796382488512gmail-h5"><br>
--<br>
coreboot mailing list: <a href="mailto:coreboot@coreboot.org" target="_blank">coreboot@coreboot.org</a><br>
<a href="https://www.coreboot.org/mailman/listinfo/coreboot" rel="noreferrer" target="_blank">https://www.coreboot.org/mailm<wbr>an/listinfo/coreboot</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</body>
</html>