Literature Watch

Modern heterogeneous processors like NVIDIA's Grace Hopper tightly integrate CPUs and GPUs with shared coherent memory, relying on independent compilation of CPU and GPU code. We show that the standard compilation path for such heterogeneous CUDA programs is unsound: Independently compiled code can violate the guarantees of the scoped-C/C++ concurrency model. In diagnosing this failure, we uncover a deeper flaw in the PTX memory model itself. The compilation from scoped-C/C++ to PTX-which NVIDIA formally verified and considered ''an important prerequisite to the official release of the model''-is unsound; NVIDIA has confirmed our finding. The flaw stems from the model treating full fences specially, unlike other ordering primitives. We resolve both the heterogeneous and homogeneous flaws with a single, targeted change to the PTX SC ordering. Our modified model preserves non-multicopy-atomic behaviors, respects scope boundaries, and-as we confirm through empirical litmus testing on NVIDIA A100, H100, GH200, and GB10 GPUs-imposes no new requirements beyond what the hardware already enforces. All soundness proofs are mechanized in Agda. Although our model is specific to PTX and ARM-PTX, the lesson is general: Ordering between fences should not be treated specially but should instead be derived from existing primitive relations.

Authors: Dennis Sprokholt, Reese Levine, Susmit Sarkar, Andrés Goens, Vijay Nagarajan, Soham Chakraborty

The reliability of the global compute stack rests on an informal symbiosis between the Linux kernel and its compilers. To scale on weak memory architectures, the kernel relies on fine-grained dependency ordering, a zero-overhead synchronization mechanism preserved by data or control flow. However, a ''compiler gap'' has emerged: while the Linux Kernel Memory Model (LKMM) formalizes these dependencies, modern compilers optimize under C11, which does not recognize them. As optimizations grow more aggressive, this mismatch risks silently eliminating critical synchronization. We present a novel hybrid framework for automatically detecting broken LKMM dependencies at scale in the Linux kernel. It bridges formal semantics with system-level verification through: (1) a rigorous operational characterization of dependencies; (2) a path-sensitive compiler-based analysis integrated into LLVM to identify broken dependency chains; and (3) a model checking phase to prove actual violations. Our analysis of the v6.16 kernel, covering 25,000+ modules and 2 million dependency chains, gives us a high degree of confidence that the kernel remains semantically safe, even after nearly half of all syntactic dependencies are broken. This safety is not due to formal guarantees but rather ''defense-in-depth'': a combination of inline assembly, locks, and luck! This work provides the empirical foundation to resolve a decade-long debate and paves the way for concurrency-aware compilation.

Authors: Sebastian Reimers, Martin Fink, Marco Elver, Hernán Ponce de León, Dennis Sprokholt, Pramod Bhatotia

Wafer-scale integration enables unprecedented compute density on a single chip, affording nearly a million processing elements (PEs) in a mesh-connected topology. However, wafer-scale meshes must tolerate inevitable manufacturing defects. Existing industrial practice for wafer-scale relies on holding healthy PEs back. Repair mechanisms either substitute spares through redundant links or disable entire rows and columns, costing tens of thousands of PEs in production. Prior fault-tolerant (FT) routing schemes fall short at wafer-scale by requiring prohibitively large per-router state or many sets of virtual channels, or require disabling healthy PEs to enforce regular fault shapes. We observe that under realistic defect densities, although the chip contains nearly a million PEs, only several dozen are expected to be faulty, leaving the mesh almost entirely intact. This suggests that fault tolerance should not be imposed uniformly across the whole wafer, but instead only where faults actually disrupt regularity. Motivated by this insight, we present Defect-driven Locality-preserving Routing (DLR), a fault-tolerant routing scheme that decomposes the defective wafer mesh into regular, defect-free submeshes and applies standard low-cost routing within each submesh. Routing across submeshes (i.e., across fault boundaries) is done over a virtual spanning tree. This hierarchical structure preserves deadlock freedom with only two sets of virtual channels (VCs), just one more than the fault-free baseline. DLR achieves 100% utilization of healthy PEs, low per-router storage and hardware overhead, competitive path lengths, and low offline algorithmic complexity; none of the prior techniques manage to achieve all of these requirements.

Authors: Yi-Chieh Wang, Congjie He, Haocheng Xiao, Boris Grot, Luo Mai

Graphics Processing Units (GPUs) accelerate many modern computationally intensive workloads, and achieving high performance on them depends heavily on sophisticated GPU compiler optimizations. However, even small changes in GPU compiler optimization heuristics or code-generation decisions can silently introduce severe performance regressions without causing crashes or wrong outputs. These regressions are notoriously difficult to detect with existing approaches. Functional test suites and existing GPU compiler fuzzers primarily target correctness bugs, while benchmark suites lack the scale and diversity needed to systematically expose optimization failures. To address this, we present GPUDiff, an automated testing framework for finding performance bugs in GPU compilers. GPUDiff is grounded in the observation that GPU compiler optimizations are fundamentally shaped by the underlying GPU architecture. Guided by this principle, GPUDiff generates performance-centric program variants using architecture-informed mutations that stress three key dimensions of GPU execution: computation, memory hierarchy, and thread divergence. To address the testing oracle problem, GPUDiff uses differential testing, comparing each mutated program's performance across different compiler versions. Over three months, GPUDiff uncovered 20 issues in NVIDIA and AMD compilers. The median regression increases kernel execution time by 37%.

Authors: Wai Kin Wong, Dongwei Xiao, Ping Fan Ke, Fengwei Zhang, Shuai Wang

Modern RISC-V processors support a rich trap mechanism that handles exceptions and interrupts across multiple privilege levels. While the ISA specification defines the expected behavior of nested traps, real CPU implementations introduce many microarchitectural optimizations for trap entry, context saving, and trap return, which makes multi-trap handling particularly error-prone. However, existing CPU testing techniques rarely explore nested traps and therefore miss a large space of recovery-failure issues. This paper first presents a study of real-world multi-trap issues in six widely used open-source RISC-V CPUs, analyzing their symptoms, triggering conditions, and root causes. We find that deeply nested trap sequences, where exceptions or interrupts recur inside trap handlers, are essential for exposing these correctness issues, yet are difficult to generate due to the combinatorial interactions of trap-entry constraints, privilege rules, delegation settings, and CSR state transitions. Guided by this study, we design TrapFuzz. TrapFuzz first builds a Multi-Trap Sequence Model that encodes trap-entry, delegation, priority, and trap-return constraints to generate legal nested-trap sequences. It then uses trap-state volatility as feedback to guide execution toward deeper and more error-prone trap interactions. Finally, TrapFuzz employs an MTSM-derived recovery oracle that validates CSR consistency, privilege-flow legality, and forward progress. In total, TrapFuzz detected 21 new recovery-failure issues in eight real-world RISC-V CPUs.

Authors: Yuanliang Chen, Xudong Zhang, Zehong Yu, Zhen Yan, Fuchen Ma, Yu Jiang

Exponentially-declining launch costs have led to an explosion of inexpensive satellites launched to space, often equipped with off-the-shelf chips. These chips, however, lack hardware radiation protection, leaving them vulnerable to space radiation. We thus design Radshield, a software system protecting against the two most ubiquitous and costly radiation fault scenarios: (a) radiation-induced short-circuits that lead to permanent hardware failure; and (b) radiation-induced transient charges that result in single-bit silent data corruption (SDC). Radshield counters these failure scenarios with two components. First, it uses a short-circuit detector that can detect tiny increases in the device's current draw by estimating the normal current draw when resource utilization is low. Second, it duplicates the execution of spacecraft workloads in a CPU and memory-efficient manner, and catches SDCs even when they affect the CPU's pipeline or cache. In our experiments, we show Radshield is very effective at preventing both errors, and is 1.4-35.5× more power-efficient than the state-of-the-art protection mechanisms in detecting SDC. Radshield is deployed on missions in low-earth orbit and in deep space.

Authors: Haoda Wang, Steven Myint, Vandi Verma, Yonatan Winetraub, Junfeng Yang, Asaf Cidon

As DRAM scales to higher density and I/O speeds, ensuring data correctness becomes increasingly difficult. Industry has responded with a three-layer stack-on-die ECC (O-ECC), link ECC (L-ECC), and system ECC (S-ECC)-but these layers have evolved independently, often duplicating redundancy, leaving coverage gaps, and occasionally interfering. We propose Cerberus, a cross-layer ECC co-design that unifies protection across device, link, and system while preserving each layer's native role. At its core is an Encode-Once, Decode-Many (EODM) architecture: the controller performs a single encoding whose redundancy is reused by L-ECC for immediate write-path detection/retry, by O-ECC for in-device repair on reads, and by S-ECC for strong end-to-end recovery. Cerberus jointly designs complementary parity/syndrome structures, orders decoders and allocates the correction budget to prevent miscorrection amplification, and enables selective correction under tight redundancy constraints. Our evaluations show improved resilience to clustered and peripheral faults while reducing redundancy overhead, underscoring the importance of coordinated crosslayer protection for next-generation memory systems, such as custom HBMs.

Authors: Junhwan Kim, Seunghyun Kim, Yesin Ryu, Saeid Gorgin, Jungrae Kim

Rowhammer attacks pose a significant threat to modern DRAM, with potentially serious security consequences for a cloud vendor, such as data corruption or infrastructure outages. Existing defenses fail to satisfy key industry requirements, including minimal overhead in the absence of attacks, predictable performance when under attack, system liveness, low hardware cost, adaptability to diverse hardware configurations, and tunable security guarantees. This paper introduces Sigries, a hybrid Rowhammer defense implemented by Microsoft in the Azure Cobalt 200 SoC, combining the Misra-Gries algorithm for efficient row tracking with a fallback row-sampling mode for robustness under all attack scenarios. Sigries's design meets all our performance goals and offers configurable security guarantees allowing a cloud vendor to assess the security risks to its fleet. Our trace-driven evaluation shows that Sigries maintains minimal DRAM bandwidth overhead while keeping performance overhead consistently low. This work represents the first detailed description of a fully implemented, industry-grade Rowhammer defense and provides insights to inform research prototypes about real-world requirements.

Authors: Stefan Saroiu, Sujay Yadalam, Alec Wolman, Will Remaklus, Daniel Berger, Isaac H. Luna, Ishwar Agarwal, Jacob R. Lorch

As DRAM scaling exacerbates RowHammer, DDR5 introduces per-row activation counting (PRAC) to track aggressor activity. However, PRAC indiscriminately increments counters on every activation-including benign refreshes-while relying solely on explicit RFM operations for resets. Consequently, counters saturate even in an idle bank, triggering cascading mitigations and degrading performance. This vulnerability arises from a fundamental mismatch: PRAC tracks the aggressor but aims to protect the victim. We present Per-Victim-row hAmmered Counting (PVAC), a victim-based counting mechanism that aligns the counter semantics with the physical disturbance mechanism of RowHammer. PVAC increments the counters of victim rows, resets the activated row, and naturally bounds counter values under normal refresh. To enable efficient victim-based updates, PVAC employs a dedicated counter subarray (CSA) that performs all counter resets and increments concurrently with normal accesses, without timing overhead. We further devise an energy-efficient CSA layout that minimizes refresh-induced counter accesses. Through victim-based counting, PVAC supports higher hammering tolerance than PRAC while maintaining the same worst-case safety guarantee. Across benign workloads and adversarial attack patterns, PVAC avoids spurious Alerts, eliminates PRAC timing penalties, and achieves higher performance and lower energy consumption than prior PRAC-based defenses.

Authors: Jumin Kim, Seungmin Baek, Hwayong Nam, Minbok Wi, Nam Sung Kim, Jung Ho Ahn

Hardware bugs threaten the correctness and security of modern CPUs. Relying on a deterministic correct baseline, pre-silicon fuzzing has proven to be an effective strategy for discovering deviations from correct behavior (i.e., bugs) in single-core CPUs. Modern CPUs, however, often feature multiple cores with complex interconnects that implement communication channels such as inter-processor interrupts or shared memory. Is it possible to effectively fuzz multicore CPUs despite their inherent non-deterministic operations? We make a key observation that multi-hart interactions may result in non-deterministic data flows, control flows, or combinations thereof. An efficient fuzzing campaign needs to manage this non-determinism without limiting the exploration of the possible state space that may lead to bugs. Our new multi-hart RISC-V fuzzer, called HartBreaker, achieves this with a judicious use of three determinism anchors: control- and data-flow anchors enable non-deterministic control- and dataflow interactions between harts while ensuring a correct execution of multi-hart test programs, achieving high testing throughput and simplified bug detection. Synchronization anchors bound the non-deterministic window across harts, enabling HartBreaker to detect bugs that do not contaminate the control flow. We test HartBreaker on five multi-hart designs, namely Rocket, BOOM, Toooba, NaxRiscv and XiangShan. HartBreaker discovers five new concurrency bugs in these designs.

Processing-using-DRAM (PuD) is a promising computation paradigm to alleviate the frequent data movement between main memory and processing units. The PuD paradigm provides a substrate for highly parallel computation by using each DRAM column as a computation engine via simultaneous multiple-row activation (SiMRA). Unfortunately, DRAM density scaling might hinder PuD's benefits. This is because denser cell arrays bring rows and columns closer, making even regular DRAM operations susceptible to noise and interference from neighboring cells. PuD repurposes DRAM from a storage device into a parallel computing substrate, yet no prior work investigates whether interference from rows or columns that are not intended to participate in the computation can compromise PuD robustness. In this work, we reveal an interference phenomenon affecting PuD computations, which we call PuDGhost, where a PuD operation in a given column produces erroneous results due to interference from 1) data stored in non-activated DRAM rows and 2) data stored in other columns that perform computations concurrently under the same SiMRA operation. PuDGhost violates the ideal picture of PuD computations, where each column's computation should depend solely on its own operand data. Thus, PuDGhost threatens the robustness of future PuD systems. We present the first extensive characterization of PuDGhost using 96 real DDR4 DRAM chips from 12 modules, systematically quantifying the impact of these two interference sources under various conditions (i.e., data patterns, temperature, and spatial properties). Among our 15 new empirical observations, we highlight two major results: 1) data in physically adjacent non-activated rows affects SiMRA outputs by up to 10% for random inputs, and 2) data in columns that perform computations concurrently affects SiMRA outputs by up to 48% for random inputs. Guided by these findings, we propose countermeasures against PuDGhost across multiple layers of the PuD computing stack (i.e., microarchitectural, architectural, and system levels). Specifically, we propose and evaluate on real DDR4 DRAM chips: 1) robust column screening that reduces the risk of mistakenly using unreliable columns in the presence of PuDGhost, and 2) a compute row layout that mitigates PuDGhost via dedicated rows between compute rows. Our solutions greatly improve PuD computation accuracy. We hope that our findings provide a foundation for developing solutions to enable future PuD systems that are robust.

Authors: Daichi Tokuda, İsmail Emir Yüksel, Tatsuya Kubo, Ataberk Olgun, Haocong Luo, Nisa Bostanci, Jikun Wang, A. Giray Yağlıkçı, Shinya Takamaeda-Yamazaki, Onur Mutlu

Modern DRAM chips are vulnerable to read disturbance phenomena such as RowHammer and RowPress, which induce bitflips in DRAM rows after accessing nearby rows a certain number of times (i.e., the read disturbance threshold). ColumnDisturb is a new and fundamentally different DRAM read disturbance phenomenon. Specifically, ColumnDisturb (i) disturbs DRAM columns instead of rows, and (ii) increases the number of affected DRAM cells from those that reside in only a few neighboring rows to all cells across three consecutive DRAM subarrays. We propose ColumnKeeper, the first set of ColumnDisturb mitigations that has two variants: ColumnKeeper-D (CK-D), a deterministic mitigation mechanism, and ColumnKeeper-P (CKP), a probabilistic one. The key idea of CK-D is to take advantage of DRAM's open-bitline architecture to provide deterministic security guarantees against ColumnDisturb with low performance and energy overheads. To achieve this, CK-D employs two counters per subarray to track the number of activations affecting the odd and even columns of the subarray, respectively. When either counter reaches a predetermined threshold, CK-D refreshes one row in the corresponding subarray. The key idea of CK-P is to refresh one row in three consecutive subarrays upon a row activation in the middle subarray. This occurs with a predetermined probability and provides configurable security guarantees at low area overhead. To identify which row to refresh in each subarray, both mechanisms maintain a table with one entry per subarray that always points to the next row to refresh within the subarray. Each time either mechanism refreshes a row, it increments the corresponding entry, thereby ensuring that all rows in the subarray are refreshed in a round-robin manner. Our comprehensive evaluation shows that both mechanisms prevent ColumnDisturb bitflips at low performance, energy, and area overheads. At the current experimentally-demonstrated ColumnDisturb threshold (1M), CK-D and CK-P incur very low average single-core performance overheads of 0.15% and 0.36%, respectively, compared to a system with no ColumnDisturb mitigation. For near-future thresholds (128K), these overheads rise to a still low average of 1.70% and 2.73%, respectively. Our experimental analysis shows that mitigating ColumnDisturb with low performance overheads at low thresholds (e.g., 16K) is still possible by either adopting smaller subarray sizes or enabling subarray-level parallelism. CK-D and CK-P can be implemented with low area overheads of $0.1 ~\text{mm}^{2}$ and $0.03 ~\text{mm}^{2}$, respectively. ColumnKeeper is freely available at github.com/CMU-SAFARI/ColumnKeeper.

Authors: Andreas Kosmas Kakolyris, F. Nisa Bostancı, Ataberk Olgun, İsmail Emir Yüksel, Harsh Songara, Konstantinos Marios Sgouras, Umut Başer, Konstantinos Kanellopoulos, A. Giray Yağlıkçı, Onur Mutlu

We provide the first experimental demonstration of DejaVu, a phenomenon where the data previously written to DRAM cells affects DRAM's vulnerability to read disturbance. Our experimental characterization using 112 commercial-off-the-shelf DDR4 DRAM chips from all three major manufacturers shows that, compared to the baseline where we initialize the victim row by writing to it only once, 1) initializing the victim row by overwriting the victim row with the opposite data (compared to what was previously written) reduces $A C_{\min}$ (the minimum aggressor row activation count to induce at least one bitflip; a lower $A C_{\min}$ means higher vulnerability to read disturbance), and 2) initializing the victim row by writing the same data twice increases $A C_{\min}$. We provide two hypotheses to explain DejaVu. First, we hypothesize that overwriting the victim row with the opposite data values causes the under-restoration of charge in the DRAM cells. Second, we hypothesize that the process of overwriting the victim row changes the charge trap states in the active region, affecting the read-disturbance-induced cell leakage current. We conduct controlled experimental characterization to provide insight into these two hypotheses. To further investigate DejaVu's potential impact on the current passing capability of the DRAM cell access transistors, we characterize the reliability of Processing-Using-DRAM (PUD) operations with DRAM rows initialized with DejaVu patterns. Our experimental characterization of 32-row MAJ-3 operation shows that by overwriting the DRAM rows used in the operation, the number of bitlines that fail to reliably perform MAJ-3 reduces by 32.7% on average compared to the baseline where the rows are written only once. We hypothesize that DejaVu's effects make the distribution of the current passing capabilities of the access transistors of DRAM cells more uniform compared to the baseline. Based on our observations, we describe two major implications of DejaVu. We provide an example of how DRAM testing and characterization methodologies should take DejaVu into consideration to 1) accurately characterize the read disturbance vulnerability of DRAM rows under fixed data patterns, and 2) rigorously study the effect of different data patterns on read disturbance by avoiding unintended interference from DejaVu. We also evaluate the additional performance overhead of read disturbance mitigation techniques when their read disturbance thresholds need to be lowered to be secure against DejaVu and show that they induce higher performance overheads (e.g., 6.3% performance overhead when reducing the read disturbance threshold by 20% as a guardband to mitigate DejaVu).

Authors: Haocong Luo, İsmail Emir Yüksel, Ataberk Olgun, Nisa Bostanci, Orhun Ecemiş, Abdullah Giray Yaglikci, Onur Mutlu

We introduce a Processing-in-Memory (PIM) architecture with tailored error checking and correcting (ECC) mechanisms to address reliability challenges from scaling errors and physical faults. PIMs can significantly improve computing efficiency by integrating computing devices directly within memory chips, but their reliability has not been explored in detail. It is important to ensure reliability against variable retention time (VRT) scaling errors and multi-bit errors in modern DRAM. Our proposed reliable bank-PIM architecture not only accurately detects multi-bit errors and corrects at the rank-level but also avoids the high performance impact of repetitive rank-level corrections. We develop a Codeword Flip method that is specifically designed to mask errors caused by VRT weak cells. This strategy effectively reduces the risk of silent data corruption (SDC) and has a negligible performance impact. With an odd-even bank pipelining approach, which achieves PIM unit utilization of 90%, our ECC mechanism could decrease the likelihood of SDC to 400× lower than traditional bank-PIM configuration over a five-year operational period. Moreover, it shows the potential 4× performance enhancement over rankPIM in certain micro-benchmarks and end-to-end performance improvements in LLM applications.

As DRAM scales in density and adopts 3D integration, raw fault rates increase and multi-bit errors are no longer rare. Such errors can severely impact Deep Neural Networks (DNNs): although DNNs tolerate small numerical perturbations, random bit flips can create extreme outliers that propagate and sharply degrade accuracy. Large Language Models (LLMs) are particularly vulnerable because attention, residual, and normalization layers can amplify and preserve a single corrupted activation across many layers, destabilizing inference. This paper introduces RangeGuard, a metadata-centric errorcorrecting framework that provides strong reliability and high efficiency based on bounded approximate correction. Instead of protecting raw bits, RangeGuard encodes compact Range Identifiers (RIDs) that capture the numerical range of each value. These compact metadata enable efficient use of limited redundancy and concentrate protection on range changes-which indicate harmful semantic deviations-while ignoring benign intra-range variations. Upon detecting a range change, RangeGuard restores the correct range and substitutes a representative value, ensuring that error magnitudes are bounded within the range. Based on RIDs, RangeGuard can tolerate 64+ bits of error using only 16 bits of parity available in GPU memories without a noticeable accuracy loss. By introducing semantic range protection, RangeGuard enables reliable DNN execution even under frequent memory errors and tight redundancy budgets.

The Rowhammer attack is an exploit that induces bit-flips in DRAMs. In the last decade, Rowhammer has been demonstrated on DDRs and LPDDRs used by CPUs, and recently it has been demonstrated on GDDRs used by GPUs. In a heterogeneous system with CPUs and GPUs, GPUs are dependent on the hDRAM (host's DRAM, i.e., CPU's DRAM) as all the data and the code executed on the GPU are first loaded into the hDRAM. We exploit the dependency of GPUs on hDRAM to develop a novel attack called Propagated Rowhammer (PRowhammer), which utilizes CPU-based Rowhammer bit-flips in hDRAM to corrupt GPU code before execution, thereby propagating the bit-flips to the GPU. We exploit two key observations that are, OS page deduplication of GPU shared libraries in hDRAM and inducing bit-flips transform GPU instructions into semantically altered yet valid instructions. Despite challenges such as the massive size of GPU shared libraries (hundreds of megabytes), the closed-source nature of the code, and the use of a proprietary compression algorithm for the SASS (GPU assembly) code, we develop automated techniques to identify exploitable bit-flip locations in hDRAM. We demonstrate PRowhammer on hDRAMs, such as DDRs (DDR3 and DDR4), with NVIDIA's discrete GPUs that utilize the CUDA software stack. We demonstrate the effectiveness of PRowhammer against state-of-the-art machine learning (ML) models in realistic black-box settings, where the adversary operates on a CPU and lacks access to the ML model's weights and architecture. With PRowhammer, a single bit-flip in the well-known shared library cuBLASLt degrades image classification accuracy across 16 test cases (ResNet-18, ResNet-34, ResNet-50 and VGG-16 on MNIST, FMNIST, CIFAR-10, and ImageNet) to random guessing, and in the worst-case scenario, it drops to 0%. We also demonstrate the effectiveness of PRowhammer on Large Language Models (LLMs) such as Llama-2, Mistral, and Falcon, where a single bit-flip in the GGML library reduces the generation quality, resulting in a BERTScore of 25%, which produces gibberish output. Overall, PRowhammer exposes an entirely new class of GPU vulnerabilities stemming from CPU-GPU architectural coupling, demanding holistic security approaches for heterogeneous computing systems.

HBM (High-Bandwidth Memory) has progressively strengthened its reliability by employing more advanced ECC (Error Correction Code) techniques, such as Reed-Solomon (RS) codes, to meet the increasing reliability challenges raised from continued technology scaling. Over time, the protection paradigm has shifted from a system-centric approach (i.e., system ECC), where the processor primarily manages error correction, to a memory-centric approach (i.e., on-die ECC), where HBM handles errors independently. Although this shift generally reduces the ECC burden on the processor side, it constrains the flexibility to implement stronger protection schemes, particularly when the processor is capable of supporting more advanced ECC. To address this problem, we propose HBM-CASO, a new protection mode designed to accommodate advanced system ECC. It strategically reorganizes the on-die ECC resources to generate a stronger on-die codeword as a supplement to the system ECC. Furthermore, due to limited on-die computing resources, HBM cannot directly verify the advanced system ECC. HBM-CASO therefore introduces a delayed verification strategy, which accumulates on-die parity across a batch of writes, rather than verifying each write individually, and validates the entire batch as a whole. Our extensive evaluation results demonstrate that HBM-CASO has effectively enhanced error correction capability, allowing the system to correct a broader range of error patterns with minimal performance and bandwidth overhead.

Authors: Ruizhi Zhu, Yanan Guo, Huize Li, Weidong Cao, Qian Lou, Xin Xin

DRAM scaling has exacerbated the RowHammer vulnerability. To counter this, JEDEC recently introduced Per Row Activation Counting (PRAC) with the Alert Back-Off protocol as an optional DDR5 feature. While promising, PRAC requires per-row counter cells that incur area overhead, and updating them on every activation lengthens DRAM timing parameters, degrading performance. Probabilistic mitigations such as MINT offer a lower-cost alternative by randomly selecting and mitigating rows within periodic mitigation windows. MINT is effective at higher thresholds $(\geq 1000)$, but at lower thresholds, it must raise its mitigation rate to overcome the nonselection problem, where heavily hammered rows can repeatedly escape sampling. This fixed-rate scaling reduces effective memory bandwidth even when no attack is present. To overcome this limitation, we propose PrISM, an intersection-based probabilistic mitigation that correlates sampled rows across windows using a Sampled History Queue (SHQ). PrISM samples a few activation slots per window, stores sampledbut-unmitigated rows in the SHQ, and requests an additional mitigation through the existing Alert Back-Off protocol when a sampled row reappears in this history. This allows PrISM to increase mitigation only when persistent row activity is observed, without globally increasing the fixed mitigation rate. At the threshold of 500, PrISM incurs a negligible 0.2% average slowdown compared to 14% for PRAC, with no DRAM array changes or per-row counters and only 625B of SRAM per bank, one to two orders of magnitude less than prior secure counter-based in-DRAM defenses. Compared to MINT, PrISM provides better scalability at low thresholds, reducing average slowdown from 10.7% to 1.5% at a threshold of 250, a 7.1× reduction. PrISM is open-sourced at https://github.com/STAR-Laboratory/prism.

Memory access errors remain one of the most pervasive bugs in GPU programming. Existing GPU sanitizers such as compute-sanitizer detect memory access errors by instrumenting every memory instruction in low-level IRs or binaries, which imposes high overhead and provides minimal memory access error diagnostic context for fixing problems. We present Triton-Sanitizer, the first device-agnostic memory sanitizer designed for Triton, a domain-specific language for developing portable, efficient GPU kernels for deep learning workloads. Triton-Sanitizer leverages Triton's tile-oriented semantics to construct symbolic expressions for memory addresses and masks, verifies them with an SMT solver, and selectively falls back to eager simulation for indirect accesses. This hybrid analysis enables precise detection of memory access errors without false positives while avoiding the cost of per-access instrumentation. Beyond detection, Triton-Sanitizer generates rich diagnostic reports that attribute violations to the tensors nearest to the violated addresses, track the complete call path, and expose the symbolic operations responsible for incorrect addresses. Evaluated on seven widely used open-source repositories of Triton kernels, Triton-Sanitizer uncovered 24 previously unknown memory access errors, of which 8 have already been fixed and upstreamed by us. Compared to compute-sanitizer, Triton-Sanitizer achieves speedups ranging from 1.07× to 14.66×, with an average improvement of 1.62×, demonstrating its ability to enhance performance, precision, and usability in memory access error detection.

Authors: Hao Wu, Qidong Zhao, Songqing Chen, Yang Chen, Yueming Hao, Tony CW Liu, Sijia Chen, Adnan Aziz, Keren Zhou

While NAND flash memory has continuously increased its storage density over decades, this progress has exacerbated the read-disturbance problem. In this work, we identify two fundamental limitations of existing read-disturbance management techniques that trigger read reclaim (RR) at the block granularity: (i) they overlook the heterogeneous reliability impact of read disturbance across individual wordlines (WLs), leading to unnecessary RR in many cases; and (ii) they address read disturbance only after disturbance-induced errors have already accumulated, which forces substantial RR-induced copy overheads in read-disturbance-prone modern NAND flash memory. To address these limitations, we propose STRAW (STRess-Aware Wordline-based read-disturbance management), a new technique that minimizes RR overheads through two key ideas: (i) stress-aware WL-based read reclaim, which monitors the accumulated read-disturbance effect on each WL and reclaims only heavily disturbed WLs, and (ii) stress-reduced read, which mitigates disturbance on valid WLs during each read operation by scaling pass-through voltages based on WL validity. Our experimental results using a modern SSD emulator show that STRAW reduces RR-induced page-copy overhead by 88.6% on average compared with the state-of-the-art technique.

Authors: Myoungjun Chun, Jaeyong Lee, Inhyuk Choi, Jisung Park, Myungsuk Kim, Jihong Kim

Silent Data Corruption (SDC) poses a reliability threat in modern datacenters. These insidious errors evade detections and propagate incorrect results throughout the system. Companies including Google, Meta, and Alibaba have reported SDC incidents affecting their production. In this paper, we present the first comprehensive instruction- and application-level analysis of vector instruction SDCs in hyper-scale datacenters using a two-stage approach. We perform over 78 trillion test rounds in more than 14 billion CPU seconds. Our observations reveal undocumented SDC patterns that provide insights into possible underlying causes and inspire new mitigation strategies. Based on these findings, we propose a low-overhead SDC detection mechanism leveraging in-application algorithm-based fault tolerance. Our method achieves 88% to 100% SDC machine detection rate with a time overhead of only 1.35% even for modestly sized inputs.

Authors: Yixuan Mei, Shreya Varshini, Harish Dixit, Sriram Sankar, K. V. Rashmi

Shrinking process technologies have made DRAM increasingly vulnerable to disturbance attacks, such as RowHammer, which can compromise data integrity or induce a Denial-of-Service (DoS) state. Existing solutions focus on preventing errors through activation monitoring and extra refreshes, but they often incur substantial performance overhead and can unintentionally exacerbate DoS risks. This paper introduces RowArmor, a novel defense mechanism that addresses both data corruption and DoS attacks. RowArmor adopts a reactive approach, correcting disturbance errors as they occur via address scrambling and enhanced error correcting codes. This strategy avoids the high costs of preventive methods while addressing diverse attack patterns, including RowPress. Our evaluation demonstrates that RowArmor effectively defends against data corruption and DoS attacks with a negligible performance overhead of up to 0.7%.

Authors: Minbok Wi, Yoonyul Yoo, Yoojin Kim, Jaeho Shin, Jumin Kim, Yesin Ryu, Saeid Gorgin, Jung Ho Ahn, Jungrae Kim

As neural networks (NNs) are increasingly used to provide edge intelligence, there is a growing need to make the edge devices that run them robust to faults. Edge devices must mitigate the resulting hardware failures while maintaining strict constraints on power, energy, latency, throughput, memory size, and computational resources. Edge NNs require fundamental changes in model architecture, e.g., quantization and fewer, smaller layers. PrioriFI is a more informed fault injection (FI) algorithm that evaluates edge NN robustness by ranking NN bits based on their fault sensitivity. PrioriFI prioritizes finding highly fault-sensitive bits, that is, the bits most critical to an NN's correctness, first. To accomplish this, PrioriFI uses the Hessian for the initial parameter ranking. Then, during an FI campaign, PrioriFI uses the information gained from past FIs as a heuristic so that future FIs target the bits likely to be the next most sensitive. With PrioriFI, designers can quickly evaluate different NNs and better co-design fault-tolerant edge NN systems.

Large language model (LLM) training is prone to anomalies due to its long duration and large scale, which can lead to significant performance degradation or even training crashes. Due to the synchronization nature of LLM training, anomalies exhibit the cascading effect, making their diagnosis challenging. Existing approaches rely on collecting communication operator information via code instrumentation, which yields only coarse-grained monitoring data and requires modifications to training code or communication libraries. We propose Pulse, a fine-grained, non-intrusive, and easy-to-deploy monitoring system. Our key idea is to enable fine-grained monitoring via traffic measurement. Pulse conducts microsecond-level RDMA traffic measurement on NICs, and transforms flow-level measurements into communication operator measurements, thereby enabling fine-grained and non-intrusive monitoring. We deploy Pulse on a testbed with 64 H200 GPUs and evaluate its anomaly localization capability under common failure scenarios. Pulse achieves machine-level localization in 10 out of 12 scenarios, while existing methods succeed in only 4 and even misdiagnose 2 of the remaining scenarios. Additionally, Pulse achieves over 90% precision and 100% recall, supports up to 2000 concurrent RDMA flow measurements per NIC, and imposes negligible overhead on training performance, making it a practical solution for real-world LLM training environments.

Authors: Yibo Xiao, Hao Zheng, Haifeng Sun, Qingkai Meng, Jiong Duan, Xiaohe Hu, Rong Gu, Guihai Chen, Chen Tian

Embodied Artificial Intelligence (AI) has recently attracted significant attention as it bridges AI with the physical world. Modern embodied AI systems often combine a Large Language Model (LLM)-based planner for high-level task planning and a reinforcement learning (RL)-based controller for low-level action generation, enabling embodied agents to tackle complex tasks in real-world environments. However, deploying embodied agents remains challenging due to their high computation requirements, especially for battery-powered local devices. Although techniques like lowering operating voltage can improve energy efficiency, they can introduce bit errors and result in task failures. In this work, we propose CREATE, a general design principle that leverages heterogeneous resilience at different layers for synergistic energy-reliability co-optimization. For the first time, we conduct a comprehensive error injection study on modern embodied AI systems and observe an inherent but heterogeneous fault tolerance. Building upon these insights, we develop an anomaly detection and clearance mechanism at the circuit level to eliminate outlier errors. At the model level, we propose a weight-rotation-enhanced planning algorithm to improve the fault tolerance of the LLM-based planner. Furthermore, we introduce an application-level technique, autonomy-adaptive voltage scaling, to dynamically adjust the operating voltage of the controllers. The voltage scaling circuit is co-designed to enable online voltage adjustment. Extensive experiments demonstrate that without compromising task quality, CREATE achieves 40.6% computational energy savings on average over nominal-voltage baselines and 35.0% over prior-art techniques. This further leads to 29.5% to 37.3% chip-level energy savings and approximately a 15% to 30% improvement in battery life.

Authors: Tong Xie, Yijiahao Qi, Jinqi Wen, Zishen Wan, Yanchi Dong, Zihao Wang, Shaofei Cai, Yitao Liang, Tianyu Jia, Yuan Wang, Runsheng Wang, Meng Li

With exacerbated DRAM read disturbance, transparent in-DRAM defenses require space (to track the aggressor rows) and time (to perform more mitigations). To reduce storage overhead, recent works have developed probabilistic row-sampling techniques with several entries. To address the time issue, these techniques employ Refresh Management (RFM) commands introduced in DDR5. However, probabilistic defenses with RFM face two critical challenges: (i) fixed-probability sampling under dynamic activation patterns can cause row-sampling misses, allowing attacks to evade mitigation, and (ii) RFM causes timing variations that can be exploited for side and covert channels to leak sensitive information. The goal of this paper is to design a low-cost and secure in-DRAM defense that overcomes these challenges.

Authors: Runjin Wu, Meng Zhang, You Zhou, Changsheng Xie, Fei Wu

Silent Data Corruptions (SDCs) pose a significant and often hidden threat to the reliability of large-scale computing infrastructure, as they can silently compromise data integrity without immediate detection. Detecting such behaviors at hyperscale is often challenging due to their intermittent nature and the vast diversity of hardware and workloads in a large-scale fleet. This work addresses these challenges by introducing PinDrop, a characterization methodology that leverages continuous, high-frequency testing infrastructure across millions of servers to gather information about SDCs at scale. By leveraging extensive test-suites tailored to mimic real-world applications and exercise a wide range of CPU features, we provide the most comprehensive characterization of SDC failures to date, analyzing over 500 million test executions across millions of devices. Our findings reveal that 0.035% of tested machines suffer from at least one SDC failure during their lifetime. Examining years of data (rather than just a testing snapshot in time), we observe SDCs emerging long after initial deployment and persisting over time. Detailed analysis shows that an average of 0.0024% of tested machines begin failing in each quarter they are tested beyond an initial burn-in period, confirming a fundamental need for continuous testing. Our findings also provide further insights into SDC behaviors at-scale, including failure breakdowns across architectures, test families, specific core IDs, and output-level behaviors.

Authors: Peter W. Deutsch, Harish D. Dixit, Gautham Vunnam, Carl Moran, Eleanor Ozer, Sriram Sankar

Typical in-DRAM Rowhammer mitigation operates by identifying aggressor rows and refreshing a limited number of victim rows on either side of the aggressor row. The number of victim rows is specified by the Blast Radius. JEDEC recently introduced state-of-the-art Rowhammer defense, which includes Per-Row-Activation-Counting (PRAC) to identify aggressor rows and Alert-Back-Off (ABO) to allow the DRAM chip to obtain time to refresh two victim rows on either side of the aggressor row. The implicit assumption in PRAC is that charge loss beyond the two victim rows is negligibly small and does not represent a threat to the security of PRAC. In this paper, we develop Ripple Attack that can amplify even a small amount of leakage in distant rows to cause charge loss equivalent to$\mathbf{3 x} \boldsymbol{-} \mathbf{7 8 x}$the activations tolerated by PRAC for the given threshold. The goal of our paper is to develop an in-DRAM mitigation that tolerates Rowhammer without relying on a pre-defined Blast Radius. We observe that as subarrays are spatially isolated from each other, activity in one subarray does not cause charge leakage in rows of another subarray. To develop Blast-RadiusFree Rowhammer mitigation, we propose SALT (Subarray-Level Tracking and Mitigation). SALT tracks activation counts per subarray, and when the count exceeds a specified value, it triggers ABO to obtain time for refreshing a portion of the subarray. SALT bounds the maximum number of activations to the subarray before all rows are guaranteed to be refreshed, thus providing Blast-Radius-Free Rowhammer mitigation. To reduce the slowdown from ABO, SALT-C coordinates the demand refresh operations such that ABO is not required if the activations to the subarray are below what can be handled by the demand refresh, thus reducing ABO by 48x. SALT-C not only provides stronger security guarantees than PRAC due to Blast-RadiusFreedom, but also has 38x lower storage overhead than PRAC, and incurs lower slowdown (0.3 % vs 1.7 %) than PRAC.

Large language model (LLM) inference workloads have emerged as a critical reliability challenge for cloud GPU systems. Unlike traditional workloads, the highly structured execution of LLMs creates large power oscillations. These oscillations become a vulnerability when their frequency aligns with the resonant modes of a GPU's power delivery network (PDN), leading to excessive voltage droops and unreliable operation. In this work, we present the first comprehensive profiling of LLM-induced power oscillations, revealing that many workloads generate oscillatory patterns in the MHz range-critically aligning with typical GPU PDN resonant frequencies and leading to excessive voltage droops. To systematically investigate this phenomenon, we developed a novel stressmark framework that generates workloads with controllable, high-frequency power oscillations and voltage droops. Our evaluation shows that operating at a resonant frequency induces voltage droops up to$2 \times$larger than conventional workloads, exceeding critical noise margins. Critically, we find that real LLM workloads operating even near these frequencies generate significant voltage droops greater than 100 mV. Based on these findings, we propose a kernel staggering technique that mitigates this threat by shifting power oscillation frequencies away from resonance frequency, successfully reducing voltage droops and reducing reliability concerns. This work provides the first systematic understanding of LLM-PDN resonance and offers a practical solution to improve GPU reliability in AI cloud environments.

Authors: Zhixing Jiang, Justin Garrigus, Allison Seigler, Ethan Syed, Yan-Lun Huang, Mehdi Sadi, Tawfik Rahal-Arabi, Lizy Kurian John

In-DRAM Rowhammer mitigation requires three resources: space (to track aggressor rows), time (to perform mitigation), and energy (to refresh victim rows). An ideal in-DRAM mitigation must minimize all three overheads. Recent randomized trackers, such as MINT, can perform tracking with negligible storage overheads. However, they perform mitigation proactively and frequently, which incurs significant performance and energy overheads at low thresholds. Recently, JEDEC introduced Per-Row Activation Counters (PRAC) and ALERT Back Off (ABO) protocol to obtain the time for mitigation reactively, as needed. While PRAC+ABO minimizes the time and energy overheads of mitigation, PRAC incurs significant changes to the DRAM array and significant performance overhead (6.5% on average) due to increased memory timings to update the PRAC counters. Our goal is to develop an efficient in-DRAM mitigation that has low storage, performance, and energy overheads. Our paper proposes MIRZA, the first low-cost reactive in-DRAM mitigation. MIRZA relies on MINT to track aggressor rows. However, instead of proactively doing mitigation at regular intervals (via REF or RFM), MIRZA uses ABO to reactively obtain the time required for mitigation. To avoid frequent ABO, MIRZA employs Coarse-Grained Filtering to disable mitigations if the activation count is below a certain Filtering Threshold. To tolerate a threshold of 1K, MIRZA requires a storage overhead of only 196 bytes of SRAM per bank. Compared to MINT, MIRZA reduces the mitigation overheads by 28.5×. Compared to PRAC, MIRZA has 45× lower area overheads and negligible slowdown (0.36% average slowdown vs. 6.5% for PRAC).

Authors: Hritvik Taneja, Ali Hajiabadi, Michele Marazzi, Kaveh Razavi, Moinuddin Qureshi

Memory errors pose an escalating threat to datacenter reliability as DRAM technology scales to smaller nodes and servers process ever-larger datasets. While Error Correction Code (ECC) provides a first-line defense, uncorrectable errors still cause catastrophic server failures with significant economic impact. Memory mirroring offers complementary protection against these errors, but existing memory mirroring solutions require reserving specific memory regions exclusively for mirroring, which incurs significant capacity overhead and thus limits wide adoption. A recent proposal suggests leveraging free memory space for mirroring, but it leaves a critical research question unanswered: which data to mirror when free memory is limited. Thus, we propose MemSOS, a selective memory mirroring system that dynamically chooses which pages to mirror based on their impact on system reliability. Specifically, MemSOS selects pages to mirror based on their criticality and recency. Criticality is evaluated by examining the page type, while recency serves as a proxy for the likelihood of future access. Our evaluation demonstrates that MemSOS reduces system Failures In Time (FIT) by up to 19,000× compared to a state-of-the-art partial mirroring scheme, while maintaining less than 3 % performance overhead. In many cases, MemSOS achieves reliability levels comparable to full mirroring, underscoring its effectiveness in maximizing system availability under limited free memory space.

Authors: Junghoon Kim, Jongheon Jeong, Seokwon Moon, Seong Hoon Seo, Yeonhong Park, Jinkyu Jeong, Nam Sung Kim, Jae W. Lee

Compute Express Link (CXL) fundamentally shifts the memory abstraction boundary, moving memory management functions from the host CPU to external controllers. While this decoupling allows hyperscalers to integrate diverse media, such as cost-effective, recycled DDR4 modules, it transforms the memory controller into a complex system with new integration challenges. First, we uncover that integrating CXL and memory controller IPs via the industry-standard AXI interconnect creates critical bottlenecks. We demonstrate that variable access latency and out-of-order responses, essential for CXL, can quickly saturate the limited AXI tag space, limiting bandwidth and even causing system hangs in commercial platforms. However, this decoupled architecture also creates a unique opportunity: the CXL controller can exploit its support for variable-latency responses and near-memory processing to implement transparent reliability and security mechanisms. We propose ReScue, a suite of hardware solutions implemented and validated on an Intel Agilex platform. ReScue-R leverages CXL's variable access latency and out-of-order responses to transparently retrieve remapping addresses stored within faulty blocks. By utilizing a Bloom filter to predict faults and minimize overhead, it achieves fault tolerance$9.6 \times 10^{4}$times higher than standard SECDED ECC with only 0.2% performance degradation. ReScue-S addresses security; after demonstrating the first successful Row Hammer (RH) bit flips and physical-address reconstruction on a CXL system, we show that ReScue-S can shape response latencies to prevent timing-based side-channel attacks with only 1.1% performance degradation. Finally, we propose a solution to the discovered AXI-induced system hangs to ensure stable CXL operation.

Authors: Chihun Song, Austin Antony Cruz, Michael Jaemin Kim, Minbok Wi, Gaohan Ye, Kyungsan Kim, Sangyeol Lee, Jung Ho Ahn, Nam Sung Kim

Digital computing-in-memory (CIM) is a promising computing paradigm for the neural network (NN) acceleration. However, during the actual deployment process of digital CIM chips, we find that existing digital CIM designs face severe computing reliability issues, which are crucial for real product development but remain underexplored. Therefore, this work pioneers a systematic computing reliability analysis for digital CIM across off-memory and in-memory levels. We find that both the off-memory floating-point (FP) exponent alignment and the in-memory random cell bit-flip errors impair digital CIM's computing reliability, causing significant truncation and bit-flip accuracy loss. Critically, existing reliability solutions are incompatible with the unique multi-row accumulation structure of digital CIM, which either severely damage digital CIM's performance or result in prohibitive overhead. To address above challenges, we propose HR-DCIM: a highreliability FP digital CIM architecture featuring unified lowcost iterative error correction. Specifically, for the off-memory reliability, we propose an exponent-mantissa joint-alignment mechanism to repurpose inherent invalid bits of aligned mantissas as compensation bits to reduce alignment truncation loss, without damaging digital CIM's performance. Then, for the in-memory reliability, we propose a remainder aliasing-based unified multiply-accumulation (MAC) error correction mechanism to correct possible MAC errors caused by various cell error cases with low-cost iteration. Experimental results show that the proposed techniques enable digital CIM to maintain high performance and efficiency across various operating voltage conditions without significant accuracy loss.

Authors: Zhen He, Yiqi Wang, Zhiheng Yue, Zihan Wu, Huiming Han, Shaojun Wei, Yang Hu, Fengbin Tu, Shouyi Yin

Memory failures in large-scale production environments pose critical threats to system reliability and service availability. While existing studies have conducted in-depth analyses of the temporal and spatial correlations of memory errors, differences in characteristics across architectures remain largely unexplored. To uncover these overlooked correlations, this paper conducts an extensive analysis of over 130,000 DDR4 DIMMs collected from large-scale heterogeneous production clusters over a nine-month period. Through systematic spatial and temporal analysis across two Intel x86 architectures and four major DRAM vendors, we uncover five new findings and propose a novel twostage training strategy. This strategy addresses sample quality issues by applying temporal weighting to positive samples and adaptive reweighting to negative samples. It also incorporates comprehensive multi-dimensional feature engineering, covering static, spatial, temporal, and micro-level characteristics. Finally, it integrates dual-driven sampling strategies and adaptive prediction timing to balance prediction accuracy and operational efficiency. Extensive evaluation shows that our CatBoost-based model achieves F1-scores of 49.9% on Intel x86v5 and 57.6% on Intel x86v6, substantially outperforming existing methods. This cross-architecture validation demonstrates the robustness and generalization of our approach across different hardware platforms. To the best of our knowledge, our work presents the first large-scale cross-architecture analysis of memory error patterns and provides new insights for production-scale memory failure prediction systems.

Authors: Chenglin Wang, Shouxin Wang, Zhirong Shen, Lu Tang, Shuyue Zhou, Ronglong Wu, Min Zhou, Jialiang Yu, Yiming Zhang

Recent memory advancements, such as DDR5, HBM3, and emerging memory-centric accelerators, primarily focus on increasing bandwidth capacity, yet often omit the significance of effective bandwidth utilization, i.e., bandwidth efficiency. Motivated by the suboptimal channel allocation in DDR5, where parity accounts for 25% bandwidth overhead, we propose ASPA, an efficiency-oriented solution that reallocates parity bandwidth to boost regular data transfer. The objective of ASPA is to enhance bandwidth efficiency without compromising reliability while maintaining low hardware overhead. In particular, we leverage existing CRC (Cyclic Redundancy Check) units in DRAM chips to opportunistically generate second-tier parity for the existing ECC (Error Correction Code) parity. For bulk-sized memory accesses, only the small second-tier parity is transmitted. This reduces the parity bandwidth consumption, allowing data chips to reuse the freed parity bandwidth for data transfer. Our observation indicates that the protection capability is sufficient when the second-tier parity (with a 64-bit size) is used exclusively for error detection. Furthermore, by exploiting underutilized resources in high-performance memory systems, ASPA is implemented with negligible hardware overhead.

Authors: Fan Li, Qiufeng Li, Yanan Guo, Weidong Cao, Xin Xin

Large-scale distributed processing is extensively employed for large model inference and training, such as Deep Learning Recommendation Models (DLRMs) and Mixture-of-Experts (MoE) models. However, the All-to-All collective, with its complex point-to-point communication patterns and blocking nature, has become a major performance bottleneck in distributed DLRM and MoE accelerations. Moreover, the prolonged distributed processing often encounters link failures, which severely impact system efficiency, reliability, and cost. Unlike switched-based topologies, which support any-to-any connections like Clos networks, All-to-All communication on torus networks can interfere with one another by sharing routing paths, creating critical performance limitations. To address these challenges, we propose single-dimensional algorithm and multi-dimensional scheduling for all-to-all optimizations with fault tolerance on torus. In fault-free scenarios, we propose HalfRing algorithm and DimRotation scheduling. HalfRing utilizes bidirectional links to construct shortest communication path on a ring, while DimRotation allocates communication sequences of each data chunk across multiple dimensions to achieve full bandwidth utilization. In faulty scenarios, we introduce FoldedRing algorithm and MATE scheduling. FoldedRing facilitates fault-tolerant communication on a ring, while MATE accelerates communication on the faulty ring by leveraging available links from other dimensions. Our results show that, compared to the ring algorithm with pipeline scheduling, HalfRing, DimRotation and their combination can achieve average performance speedups of 1.56 × , 1.45 × , and 2.28 × , respectively. For All-to-All with a single link failure, MATE can achieve a 1.37 × speedup compared to ring-based fault-free conditions. When compared with state-of-the-art routing methods in TPUv4 clusters, our approach achieves 1.57 × and 1.61 × speedups for fault-free and fault-tolerant scenarios, respectively.

Authors: Le Qin, Junwei Cui, Weilin Cai, Meng Niu, Yan Yang, Jiayi Huang

Rowhammer is a critical vulnerability in dynamic random access memory (DRAM) that continues to pose a significant threat to various systems. However, we find that conventional load-based attacks are becoming highly ineffective on the most recent architectures such as Intel Alder and Raptor Lake. In this paper, we present $ρ$Hammer, a new Rowhammer framework that systematically overcomes three core challenges impeding attacks on these new architectures. First, we design an efficient and generic DRAM address mapping reverse-engineering method that uses selective pairwise measurements and structured deduction, enabling recovery of complex mappings within seconds on the latest memory controllers. Second, to break through the activation rate bottleneck of load-based hammering, we introduce a novel prefetch-based hammering paradigm that leverages the asynchronous nature of x86 prefetch instructions and is further enhanced by multi-bank parallelism to maximize throughput. Third, recognizing that speculative execution causes more severe disorder issues for prefetching, which cannot be simply mitigated by memory barriers, we develop a counter-speculation hammering technique using control-flow obfuscation and optimized NOP-based pseudo-barriers to maintain prefetch order with minimal overhead. Evaluations across four latest Intel architectures demonstrate $ρ$Hammer's breakthrough effectiveness: it induces up to 200K+ additional bit flips within 2-hour attack pattern fuzzing processes and has a 112x higher flip rate than the load-based hammering baselines on Comet and Rocket Lake. Also, we are the first to revive Rowhammer attacks on the latest Raptor Lake architecture, where baselines completely fail, achieving stable flip rates of 2,291/min and fast end-to-end exploitation.

Authors: Weijie Chen, Shan Tang, Yulin Tang, Xiapu Luo, Yinqian Zhang, Weizhong Qiang

Although NAND flash memory has achieved significant capacity improvements through advanced 3D stacking and multi-level cell technologies, these advances have intensified the read-disturb problem. Modern SSDs require efficient solutions to minimize the overhead of managing read-disturb errors. In this paper, we propose DEAR (Dynamic Error-Aware Refresh), a novel approach that dynamically monitors flash memory error status at runtime. Unlike conventional methods that trigger read refresh (RR) procedures based on fixed read-count thresholds per block, DEAR selectively invokes RR at the WL granularity, based on actual error conditions. DEAR leverages an accurate and efficient runtime error estimator (SEE), significantly reducing unnecessary RR invocations. System-level evaluations with ten real-world workloads show that DEAR reduces RR invocations by 64.2% on average compared to existing methods, with negligible overhead. Furthermore, DEAR reduces the 99.9th percentile read latency by 44.9% and extends SSD lifetime by 36.7% compared to state-of-the-art techniques.

Authors: Jaeyong Lee, Beomjun Kim, Myoungjun Chun, Myungsuk Kim, Jihong Kim

Rowhammer is a hardware security vulnerability at the heart of every DRAM-based memory system. Despite its discovery a decade ago, comprehensive defenses in current systems remain elusive, while the probability of successful attacks grows with DRAM density. Hardware-based defenses have proven ineffective due to substantial cost, delays in commercial adoption, and repeated circumventions by attackers, while more flexible software-based solutions incur major performance and memory capacity overheads or offer only limited protection. Citadel is a new memory allocator design that prevents Rowhammer-initiated security exploits by addressing the vulnerability’s root cause: physical adjacency of DRAM rows. It introduces flexible security domains and isolates them in physically disjoint memory regions, guaranteeing security by design. On a server system, Citadel supports thousands of security domains at a modest 7.2% average memory overhead and no performance loss, while remaining readily deployable across legacy, contemporary, and future platforms. In contrast, recent domain isolation schemes fail to support many workload scenarios due to excessive overhead and incur 4–6 × higher overhead for supported scenarios.

As DRAM technology scales down, maintaining prior levels of reliability becomes increasingly challenging due to heightened susceptibility to faults. This growing concern underscores the need for effective in-field fault monitoring and management. Addressing this challenge, this work first introduces a refined DRAM fault classification, derived from the correlation between DRAM addresses and their underlying architectural hierarchies of faulty DRAMs. Building on this classification, we propose a comprehensive memory fault management strategy adequate to each DRAM fault. We further formalize and implement a structured remediation framework, enabling fault-specific mitigation. Utilizing this methodology, we conduct a large-scale field study on DDR4 x4 and DDR5 10x4 RDIMMs, uncovering that over 98% of DDR4 x4 RDIMM faults are tightly coupled with intra-bank architectural characteristics. In particular, we identify that early detection and localized management of faults within 2×2 MATs1—encompassing the vast majority of clustered row faults—are crucial to achieving resilient memory subsystems. We also observe intrinsic correlations among faulty Row Addresses (RAs), indicating unavoidable structural address patterns in most DRAMs. Additionally, our method demonstrates strong diagnostic accuracy in detecting unbounded faults2 even in DDR5 10x4 RDIMMs equipped with in-DRAM ECC. The insights gained from this study not only enhance DRAM fault diagnosis and mitigation but also inform the development of RAS features for future memory systems with limited error correction capabilities.

Authors: Hoiju Chung, Euisang Oh, Seungmin Baek, Hyeongshin Yoon, Jaesung Yoo, Sanghwan Lee, Yongjun Lee, Arhatha Bramhanand, Brett Dodds, Yang Zhou, Nam Sung Kim

We experimentally demonstrate a new widespread read disturbance phenomenon, ColumnDisturb, in real commodity DRAM chips.By repeatedly opening or keeping a DRAM row (aggressor row) open, we show that it is possible to disturb DRAM cells through a DRAM column (i.e., bitline) and induce bitflips in DRAM cells sharing the same columns as the aggressor row (across multiple DRAM subarrays).With ColumnDisturb, the activation of a single row concurrently disturbs DRAM cells across as many as three DRAM subarrays (e.g., up to 3072 DRAM rows in tested DDR4 DRAM chips) as opposed to RowHammer & RowPress, which affect only a few neighboring rows of the aggressor row in a single subarray.We rigorously and comprehensively characterize ColumnDisturb and its characteristics under various operational conditions (i.e., temperature, data pattern, DRAM timing parameters, average voltage level of the bitline, memory access pattern, and spatial variation) using 216 DDR4 and 4 HBM2 chips from three major DRAM manufacturers.Among our 27 key experimental observations, we highlight two major results and their implications.First, ColumnDisturb affects chips from all three major DRAM manufacturers and worsens as DRAM technology scales down to smaller node sizes (e.g., the minimum time to induce the first Col-umnDisturb bitflip reduces by up to 5.06x and 2.96x on average across all tested modules).We observe that, even in existing DRAM chips, ColumnDisturb induces bitflips within a nominal DDR4 refresh window (e.g., in 63.6 ms) in multiple cells from one module.We predict that, as DRAM technology node size reduces, ColumnDisturb would worsen in future DRAM chips, likely causing many more bitflips in the nominal refresh window.Second, beyond the nominal refresh window, ColumnDisturb induces bitflips in many (up to 198x) more DRAM rows than retention failures.Therefore, Column-Disturb has strong implications for existing retention-aware refresh mechanisms that aim to improve system performance and energy efficiency by leveraging the heterogeneity in DRAM cell retention

Authors: Ismail Emir Yuksel, Ataberk Olgun, Nisa Bostanci, Haocong Luo, Abdullah Giray Yaglikci, Onur Mutlu

Modern cloud servers achieve significant performance improvements by exploiting data processing units (DPUs) to offload virtualization overhead.Unlike traditional monolithic hypervisors, this offloading approach splits VM state and distributes hypervisor functions across the DPU and the Host, transforming the cloud server from a single system into a sophisticated orchestration of multiple self-managed processing units.However, the failure rate of these systems has significantly increased, as errors from either the DPU or the Host can crash the entire machine.All these changes necessitate a comprehensive revamp of current VM fault tolerance and isolation mechanisms.This paper explores a novel approach to VM fault tolerance by treating the split hypervisors on the DPU SoC and the Host as redundant peers.We propose a fault-escaping scheme that enables VMs to escape from a failing SoC or Host.With hybrid synchronization, the entire VM state becomes fully accessible on either the SoC or the Host with minimum synchronization overhead (in kilobytes).Instead of recovering the failed hypervisor, this scheme migrates the verified VM state, allowing the VM to escape from the failure

Authors: Chao Zhang, Tao Xu, Junming Liu, Pai Liu, Zhilang Xu, Kang Yan, Shuo Shi, Jintao Li, Jinhu Li, Chen Liang, Wenhui Shu, FeiFei Fan, Yibin Shen, Hang Yang, Jianming Song, Xudong Zheng, Jiesheng Wu, Jian Li

This paper focuses on Memory-Controller (MC) side Rowhammer mitigation.MC-side mitigation consists of two parts: First, a tracker to identify the aggressor rows.Second, a command to let the MC inform the DRAM chip to perform victim-refresh for the specified aggressor row.To facilitate this, prior works assumed a per-bank Nearby Row Refresh (NRR) command.However, JEDEC standards did not support NRR.Instead, JEDEC introduced Directed Refresh Management (DRFM), which can simultaneously perform mitigations for one row each in 8 (DRFMsb) or 32 (DRFMab) banks.As DRFM stalls 8-32 banks, it incurs high overheads.For example, at a threshold of 2K, PARA incurs a slowdown of 3.9% with NRR, 12.7% with DRFMsb, and 49% with DRFMab.Although counter-based trackers can avoid these slowdowns, they require significant storage.The goal of our paper is to reduce the performance and storage overheads of MC-based mitigations by using properties of DRFM.Our paper proposes DREAM, DRFM-Aware Rowhammer Mitigation.We propose two variants of DREAM.Our first design, DREAM-R, reduces the performance overhead of randomized trackers by increasing the time between sampling the row and issuing a DRFM.The delay allows other banks the time to sample their own rows, thereby increasing the number of rows mitigated under a single DRFM.DREAM-R reduces the average performance overhead of PARA from 12.7% (DRFMsb) to 4.24% and MINT from 15.9% (DRFMsb) to 2.1%.We bound the impact of delayed DRFM on the tolerated Rowhammer threshold.Our second design DREAM-C, reduces the storage for counter-based trackers by leveraging the fact that DRFM can concurrently mitigate several rows.DREAM-C forms a gang containing 32-256 rows, randomly selected equally from all the 32 banks, and allocates a single counter for the entire gang.DREAM-C reduces the storage required at a threshold of 500 to only 1KB/bank, which is 8x lower than Graphene while avoiding the complexity of CAM lookups and incurring negligible slowdown.We also show that DREAM compares favorably to PRAC. CCS Concepts• Security and privacy → Security in hardware.

Processing-using-DRAM (PuD) is a promising paradigm for alleviating the data movement bottleneck using a DRAM array's massive internal parallelism and bandwidth to execute very wide dataparallel operations.Performing a PuD operation involves activating multiple DRAM rows in quick succession or simultaneously, i.e., multiple-row activation.Multiple-row activation is fundamentally different from conventional memory access patterns that activate one DRAM row at a time.However, repeatedly activating even one DRAM row (e.g., RowHammer) can induce bitflips in unaccessed DRAM rows because modern DRAM is subject to read disturbance, a worsening safety, security, and reliability issue.Unfortunately, no prior work investigates the effects of multiple-row activation, as commonly used by PuD operations, on DRAM read disturbance.In this paper, we present the first characterization study of read disturbance effects of multiple-row activation-based PuD (which we call PuDHammer) using 316 real DDR4 DRAM chips from four major DRAM manufacturers.Our detailed characterization results covering various operational conditions and parameters (i.e., temperature, data patterns, access patterns, timing parameters, and spatial variation) show that 1) PuDHammer significantly exacerbates the read disturbance vulnerability, causing up to 158.58× reduction in the minimum hammer count required to induce the first bitflip (𝐻𝐶 𝑓 𝑖𝑟𝑠𝑡 ), compared to RowHammer, 2) PuDHammer is affected by various operational conditions and parameters, 3) combining RowHammer with PuDHammer is more effective than using

Authors: Ismail Emir Yuksel, Akash Sood, Ataberk Olgun, Oğuzhan Canpolat, Haocong Luo, Nisa Bostanci, Mohammad Sadrosadati, Giray Yaglikci, Onur Mutlu

Per Row Activation Counting (PRAC) has emerged as a robust framework for mitigating RowHammer (RH) vulnerabilities in modern DRAM systems.However, we uncover a critical vulnerability: a timing channel introduced by the Alert Back-Off (ABO) protocol and Refresh Management (RFM) commands.We present PRACLeak, a novel attack that exploits these timing differences to leak sensitive information, such as secret keys from vulnerable AES implementations, by monitoring memory access latencies.To counter this, we propose Timing-Safe PRAC (TPRAC), a defense that eliminates PRAC-induced timing channels without compromising RH mitigation efficacy.TPRAC uses Timing-Based RFMs, issued periodically and independent of memory activity.It requires only a single-entry in-DRAM mitigation queue per DRAM bank and is compatible with existing DRAM standards.Our evaluations demonstrate that TPRAC closes timing channels while incurring only 3.4% performance overhead at the RH threshold of 1024. CCS Concepts• Security and privacy → Security in hardware.

Rowhammer has worsened over the last decade.Existing in-DRAM solutions, such as TRR, were broken with simple patterns.In response, the recent DDR5 JEDEC standards modify the DRAM array to enable Per-Row Activation Counters (PRAC) for tracking aggressor rows.They also extend the DRAM timings to support the operations required to update the PRAC counters.Unfortunately, the increased memory timings cause significant performance overheads (on average 10%) even for benign applications and even at current Rowhammer thresholds.The goal of this paper is to minimize the slowdown of PRAC while retaining the security benefits of PRAC.This paper proposes Mitigating Rowhammer with Probabilistic Activation Counts (MoPAC), which reduces the slowdown of updating the PRAC counters by performing the updates probabilistically, thereby incurring the latency overhead of counter updates for only a small subset of activations.To ensure security in the presence of probabilistic counters, MOPAC adjusts the threshold at which the row undergoes mitigation.We propose two variants of MoPAC: MoPAC-C (Memory-Controller Side) and MoPAC-D (DRAM Side).MoPAC-C relies on having two types of precharge commands: one that incurs normal latency and does not do counter updates, and the other that incurs higher latency and performs counter updates.MoPAC-C probabilistically chooses when the longer precharge must be used to perform update of the PRAC counter.MoPAC-D is a completely in-DRAM solution that probabilistically selects which activations will be selected for performing counter updates and obtains the time required for counter-updates using ALERT or REF.Our evaluations show that, for a Rowhammer threshold of 500 (10× lower than current thresholds), MoPAC-C and MoPAC-D incur an average slowdown of only 1.7% and 0.7%, much less than the 10% incurred by PRAC.MoPAC removes one of the major obstacles to the commercial adoption of PRAC.

Silent Data Corruptions (SDCs) pose a significant challenge in large-scale infrastructures, affecting data center applications unpredictably and reducing service reliability. Primarily caused by silicon defects, traditional hardware testing methods are insufficient to prevent SDC propagation. SDCs are influenced by various factors, including data randomization, workload characteristics, environmental conditions, and aging, necessitating top-down approaches from the application layer. In this paper, we introduce Hardware Sentinel, a novel framework that detects SDCs through typical software failure indicators such as segmentation faults, core dumps, application crashes, and logs. We have validated our framework in a large-scale data center fleet, across diverse application, kernel, and hardware configurations, achieving a high success rate of SDC detection. Hardware Sentinel has uncovered novel instances of SDCs, surpassing the detection capabilities of published testing techniques. Our analysis of over 6 years' worth of application and system failure data within a large-scale infrastructure has successfully identified hundreds of defective CPUs that triggered SDCs. Notably, the Hardware Sentinel flow increases effective coverage over existing hardware-testing methods like Fleetscanner (out-of-production testing) by 1.74x and Ripple (in-production testing) by 1.92x. We share the top kernel exceptions with the highest correlation to silent data corruption failures. We present results spanning 7 CPU generations from multiple semiconductor manufacturers, 13 large-scale workloads, and 27 data center regions, providing insights into the trade-offs involved in detection and fleet deployment.

Authors: Rhea Dutta, Harish Dattatraya Dixit, Rik Van Riel, Gautham Vunnam, Sriram Sankar

Rowhammer has worsened over the last decade. Existing in-DRAM solutions, such as TRR, were broken with simple patterns. In response, the DDR5 specifications have been extended to support Per-Row Activation Counting (PRAC), with counters inlined with each row, and ALERT-Back-Off (ABO) to stop the memory controller if the DRAM needs more time to mitigate. Although PRAC+ABO represents a strong advance in Rowhammer protection, they are just a framework, and the actual security is dependent on the implementation. In this paper, we first show that a prior work, Panopticon (which formed the basis for PRAC+ABO), is insecure, as our Jailbreak pattern can cause 1150 activations on an attack row for Panopticon configured for a threshold of 128. We then propose MOAT, a provably secure design, which uses two internal thresholds: ETH, an Eligibility Threshold for mitigating a row, and ATH, an ALERT Threshold for initiating an ABO. As JEDEC specifications permit a few activations between consecutive ALERTs, we also study how an attacker can exploit such activations to inflict more activations than ATH on an attack row and thus increase the tolerated Rowhammer threshold. Our analysis shows that MOAT configured with ATH=64 can safely tolerate a Rowhammer threshold of 99. Finally, we also study performance attacks and denial-of-service due to ALERTs. Our evaluations, with SPEC and GAP workloads, show that MOAT with ATH=64 incurs an average slowdown of 0.27% and 7 bytes of SRAM per bank.

Training large-scale machine learning (ML) models is expensive and time-intensive, consuming many hardware accelerators for days or weeks. As the scale of hardware deployments and training time continue to grow, the probability of failures also increases. The desire to use cheaper cloud resources, such as spot VMs, to lower costs also dramatically increases the frequency of failures. The standard approach to deal with failures is to periodically pause training and checkpoint model parameters to persistent storage. Unfortunately, today's checkpointing mechanisms introduce high overhead when applied at high frequencies, yet frequent checkpointing is necessary to avoid long recovery times.

Cloud resilience is crucial for cloud operators and the myriad of applications that rely on the cloud. Today, we lack a mechanism that enables cloud operators to perform graceful degradation of applications while satisfying the application's availability requirements. In this paper, we put forward a vision for automated cloud resilience management with cooperative graceful degradation between applications and cloud operators. First, we investigate techniques for graceful degradation and identify an opportunity for cooperative graceful degradation in public clouds. Second, leveraging criticality tags on containers, we propose diagonal scaling---turning off non-critical containers during capacity crunch scenarios---to maximize the availability of critical services. Third, we design Phoenix, an automated cloud resilience management system that maximizes critical service availability of applications while also considering operator objectives, thereby improving the overall resilience of the infrastructure during failures. We experimentally show that the Phoenix controller running atop Kubernetes can improve critical service availability by up to 2× during large-scale failures. Phoenix can handle failures in a cluster of 100,000 nodes within 10 seconds. We also develop AdaptLab, an open-source resilience benchmarking framework that can emulate realistic cloud environments with real-world application dependency graphs.