Address Mapping Research Articles

Address Pattern Recognition Flash Translation Layer for Quadruple-level cell NAND-based Smart Devices

The price of the solid-state drives has become a major factor in the development of flash memory technology. Major semiconductor companies are developing quadruple-level cell NAND-based SSDs for smart devices. Unfortunately, SSDs composed of quadruple-level cell (QLC) flash memory may suffer from low performance. In addition, few studies on internal page buffering mechanisms have been conducted. As a solution to these problems, an address pattern recognition flash translation layer (APR-FTL) is proposed in this study. APRA-FTL gathers the data in a page unit and separates random data from sequential data. Furthermore, APRA-FTL proposes address mapping algorithm which is compatible to the page buffering algorithm. Experimental results show that APRA-FTL generates a lower number of write and erase operations compared to previous FTL algorithms.

Enhanced cache attack on AES applicable on ARM-based devices with new operating systems

There are several key challenges in performing cache-based attacks on ARM-based devices. Lipp et al. introduced various techniques to tackle these challenges and applied successfully different cache-based attacks on ARM-based mobile devices. In the cache-based attacks proposed by Lipp et al. it is assumed that the attacker has access to the mapping of virtual addresses to physical addresses through/proc/self/pagemap which is an important limiting factor in Linux and newer versions of Android operating systems. To access this mapping, the attacker must know the root of the operating system. In this paper, we introduce an Evict+Reload attack on the T-table-based implementation of AES which applies to ARM-based devices in which root access is required to use the mapping of virtual addresses to physical addresses. The attack consists of two phases. The profiling is a preprocessing phase to profile all the timing characteristics when AES is executed with a known key. In this phase, the attacker can identify specific bits of the physical addresses of the AES T-table elements without having root access. In the exploitation phase, full key bytes are retrieved by a conventional Evict+Reload attack. To verify the theoretical model of our technique, we implemented the described attack on AES.

DAMARU: A Denial-of-Service Attack on Randomized Last-Level Caches

Cross-core conflict-based timing attacks like Prime+Probe at the shared last-level cache (LLC) are practical and can cause information leakage. Cache address randomization is one of the techniques that claim to mitigate these attacks. CEASER, CEASER-S, and ScatterCache are the three recent randomized caches that use encryption engines to randomize the memory address mapping. CEASER and CEASER-S, along with encryption engines, remap the cache blocks periodically to break the static mapping of memory blocks into the LLC blocks. Encryption engine and remapping provide security to the randomized caches. However, access to encryption engines and the remapping of cache blocks are on the critical path of LLC accesses. We target encryption engine and remapping of randomized cache to mount a denial of service (DoS) attack named DAMARU. In DAMARU, the attacker frequently sends memory requests to the LLC that causes an increase in the victim's LLC access waiting time for the encryption engine. DAMARU is the first DoS attack on randomized caches where an attacker can cause a DoS even without thrashing the LLC. DAMARU provides a performance slowdown of up to 3.19X and 6X for 8-core and 16-core simulated systems, respectively. In terms of performance slowdown, the effectiveness of our DAMARU attack decreases with an increase in the number of encryption engines.

Memory Access Optimization of a Neural Network Accelerator Based on Memory Controller

Special accelerator architecture has achieved great success in processor architecture, and it is trending in computer architecture development. However, as the memory access pattern of an accelerator is relatively complicated, the memory access performance is relatively poor, limiting the overall performance improvement of hardware accelerators. Moreover, memory controllers for hardware accelerators have been scarcely researched. We consider that a special accelerator memory controller is essential for improving the memory access performance. To this end, we propose a dynamic random access memory (DRAM) memory controller called NNAMC for neural network accelerators, which monitors the memory access stream of an accelerator and transfers it to the optimal address mapping scheme bank based on the memory access characteristics. NNAMC includes a stream access prediction unit (SAPU) that analyzes the type of data stream accessed by the accelerator via hardware, and designs the address mapping for different banks using a bank partitioning model (BPM). The image mapping method and hardware architecture were analyzed in a practical neural network accelerator. In the experiment, NNAMC achieved significantly lower access latency of the hardware accelerator than the competing address mapping schemes, increased the row buffer hit ratio by 13.68% on average (up to 26.17%), reduced the system access latency by 26.3% on average (up to 37.68%), and lowered the hardware cost. In addition, we also confirmed that NNAMC efficiently adapted to different network parameters.

HDFTL: An On-Demand Flash Translation Layer Algorithm for Hybrid Solid State Drives

NAND flash-based solid-state drives (SSDs) have been widely used in consumer electronic products such as smartphones, digital video recorders, and laptops. The flash translation layer (FTL) is crucial to the performance of SSDs. In this article, an on-demand FTL, briefly as HDFTL, is proposed for hybrid SSDs built with SLC+MLC flash memory. HDFTL divides the SLC into data blocks and translation blocks and uses all MLC as data blocks. All mapping items are stored in the translation block of the SLC, and partial mapping items are loaded into the cached mapping table of the FTL as needed. The contributions of HDFTL are as follows: (1) Unify the address mapping method of SLC and MLC areas to simplify the FTL design of hybrid SSDs; (2) Split the cached mapping table into a hot-write mapping table and a normal mapping table and use time locality to solve hot-write identification problem in hybrid SSDs; (3) According to the relative wear rate of SLC and MLC areas, adaptively adjust the size of the hot-write mapping table and the normal mapping table. Experimental results show that the performance of HDFTL is better than that of the existing FTLs for hybrid SSDs.

BitMine: An End-to-End Tool for Detecting Rowhammer Vulnerability

Rowhammer is a destructive software-induced DRAM fault, which an attacker can leverage to break system security. Both individual customers and enterprise users (e.g., cloud providers) might refrain from using a computing system if it is vulnerable to rowhammer vulnerability. In this paper, we provide the first end-to-end tool, coined BitMine, that systematically assesses a DRAM chip’s vulnerability to rowhammer bit flips. BitMine is an extension of DRAMDig. As DRAM address mappings are proprietary techniques and critical in inducing rowhammer bit flips, DRAMDig, our prior work, leverages domain knowledge to efficiently and deterministically reverse-engineer DRAM address mappings on Intel machines. By incorporating DRAMDig, BitMine configures three key parameters, i.e., hammer methods , hammer patterns , data patterns , on the effectiveness of finding rowhammer bit flips. BitMine by default implements 13 hammer methods, 4 hammer patterns and 16 data patterns and is extensible to support more. We evaluate DRAMDig and BitMine against multiple machine models that combine different DRAM chips and Intel microarchitectures. Our experiment results show that DRAMDig efficiently uncovers a deterministic DRAM address mapping for each machine model, and every implemented parameter in BitMine has its distinct effectiveness in triggering bit flips for different machine models.

Memory-Aware Denial-of-Service Attacks on Shared Cache in Multicore Real-Time Systems

In this paper, we identify that memory performance plays a crucial role in the feasibility and effectiveness for performing denial-of-service attacks on shared cache. Based on this insight, we introduce new cache DoS attacks, which can be mounted from the user-space and can cause extreme worst-case execution time (WCET) impacts to cross-core victimseven if the shared cache is partitionedby taking advantage of the platforms memory address mapping information and HugePage support. We deploy these enhanced attacks on two popular embedded out-of-order multicore platforms using both synthetic and real-world benchmarks. The proposed DoS attacks achieve up to 111X WCET increases on the tested platforms.

Mitigating Cross-Core Cache Attacks via Suspicious Traffic Detection

Continuous Attacks are common cross-core cache side-channel attack scenarios that we observed, where adversaries frequently probe-target cache lines in a short time. Under Continuous Attacks, the attacked lines go through multiple load-evict processes between different cache (or memory) hierarchies, exhibiting Ping-Pong patterns. Identifying and obscuring these abnormal patterns effectively interfere with the attacker's probe and mitigate such attacks. Our recent proposal, Ping-Pong regulator (PPR), captures multiple Ping-Pong patterns by counting the reaccesses per cache line and blocks them with different obscuring actions (preload or lock). Although PPR mitigates Continuous Attacks, the added regulator directory (RDir) is vulnerable because it cannot record all cache lines simultaneously. Sophisticated attackers can evict the records of the attacked line from the RDir to avoid triggering defensive actions, thereby bypassing PPR. To improve robustness, we further propose PPR+, which dynamically changes the mapping of physical addresses to RDir locations by encryption and periodically changing keys. This randomness makes it difficult for attackers to evict target entries out of the RDir within a limited time. We show that PPR+ tolerates more than 100 years of attacks, induces negligible performance impacts (improves 0.13%), requires acceptable storage overhead (3.15%), and does not need any software support.

Virtual IP-based Secure Gatekeeper System for Internet of Things.

The advantage of using the Network Address Translation device is that the internal IP address, which makes the IP address space of Internet of Things (IoT) devices expanded, is invisible from the outside and safe from external attacks. However, the use of these private IPv4 addresses poses traversal problems, especially for the mobile IoTs to operate peer-to-peer applications. An alternative solution is to use IPv6 technologies for future IoT devices. However, IPv6 package, including IPSec, is too complex to apply to the IoT device because it is a technology developed for the user terminal with enough computing power. This paper proposes a gatekeeper to enable the real IP addresses of IoTs inside the same subnetwork to be not explicitly addressable and visible from outside of the gatekeeper. Each IoT device publishes its virtual IP address via the Registrar Server or Domain Name System (DNS) with which the gatekeeper shares the address mapping information. While the gatekeeper maintains the mapping information for the local IoT devices, the registration server or DNS has global address mapping information so that any peer can reach the mapping information. All incoming and outgoing packets must pass through the gatekeeper responsible for the address conversion and security checks for them from the entrance. This paper aims to apply our gatekeeper system to a platform of self-driving cars that allows surrounding IoT cameras and autonomous vehicles to communicate with each other securely, safely, and rapidly. So, this paper finally analyzes improvement effects on latency to show that our gatekeeper system guarantees the latency goal of 20 ms under the environment of 5G links.

CATTmew: Defeating Software-Only Physical Kernel Isolation

All the state-of-the-art rowhammer attacks can break the MMU-enforced inter-domain isolation because the physical memory owned by each domain is adjacent to each other. To mitigate these attacks, physical domain isolation, introduced by CATT, physically separates each domain by dividing the physical memory into multiple partitions and keeping each partition occupied by only one domain. CATT implemented physical kernel isolation as the first generic and practical software-only defense to protect kernel from being rowhammered as kernel is one of the most appealing targets. In this paper, we develop a novel exploit that could effectively defeat the physical kernel isolation and gain both root and kernel privileges. Our exploit can work without exhausting the page cache or the system memory, or relying on the information of the virtual-to-physical address mapping. The exploit is motivated by our key observation that the modern OSes have double-owned kernel buffers (e.g., video buffers and SCSI Generic buffers) owned concurrently by the kernel and user domains. The existence of such buffers invalidates the physical kernel isolation and makes the rowhammer-based attack possible again. Existing conspicuous rowhammer attacks achieving the root/kernel privilege escalation exhaust the page cache or even the whole system memory. Instead, we propose a new technique, named memory ambush. It is able to place the hammerable double-owned kernel buffers physically adjacent to the target objects (e.g., page tables) with only a small amount of memory. As a result, our exploit is stealthier and has fewer memory footprints. We also replace the inefficient rowhammer algorithm that blindly picks up addresses to hammer with an efficient one. Our algorithm selects suitable addresses based on an existing timing channel.

Design and implementation of MAP offloading technology based on P4 switch

According to the <italic>China IPv</italic>6 <italic>Development Report,</italic> with the exception of some large internet companies, private small and medium enterprises (SMEs) are very slow to transform into IPv6, and more and more SMEs are migrating their business to the cloud. For cloud service providers, high-throughput IPv4/IPv6 conversion should be completed. In 2014, Nick MCKEOWN proposed programmable protocol-independent packet processors (P4). Implementation of mapping of address and port with encapsulation (MAP-E) offloading technology on P4 switches, that is, offloading the IPv4/IPv6 conversion task to P4 switches, improves the flow forwarding rate and reduces the pressure on the core server. At the same time, the P4 language supports custom switch processing logic, so that there is no need to purchase new equipment when the protocol version is updated and iterated, which reduces future IPv4/IPv6 upgrade and operating costs.

MEG

Emerging three-dimensional (3D) memory technologies, such as the Hybrid Memory Cube (HMC) and High Bandwidth Memory (HBM), provide high-bandwidth and massive memory-level parallelism. With the growing heterogeneity and complexity of computer systems (CPU cores and accelerators, etc.), efficiently integrating emerging memories into existing systems poses new challenges and requires detailed evaluation in a realistic computing environment. In this article, we propose MEG, an open source, configurable, cycle-exact, and RISC-V-based full-system emulation infrastructure using FPGA and HBM. MEG provides a highly modular hardware design and includes a bootable Linux image for a realistic software flow, so that users can perform cross-layer software-hardware co-optimization in a full-system environment. To improve the observability and debuggability of the system, MEG also provides a flexible performance monitoring scheme to guide the performance optimization. The proposed MEG infrastructure can potentially benefit broad communities across computer architecture, system software, and application software. Leveraging MEG, we present two cross-layer system optimizations as illustrative cases to demonstrate the usability of MEG. In the first case study, we present a reconfigurable memory controller to improve the address mapping of standard memory controller. This reconfigurable memory controller along with its OS support allows us to optimize the address mapping scheme to fully exploit the massive parallelism provided by the emerging three-dimensional (3D) memories. In the second case study, we present a lightweight IOMMU design to tackle the unique challenges brought by 3D memory in providing virtual memory support for near-memory accelerators. We provide a prototype implementation of MEG on a Xilinx VU37P FPGA and demonstrate its capability, fidelity, and flexibility on real-world benchmark applications. We hope MEG fills a gap in the space of publicly available FPGA-based full-system emulation infrastructures, specifically targeting memory systems, and inspires further collaborative software/hardware innovations.

Approaches for Assessing the Polymetallic Impact on Humans in an Urbanized Area Using Neural Network Modeling Methods

A methodology for assessing the response to the polymetallic effects of sensitive population groups has been developed using new information methods and data collection paths used for evaluation. The presented methodology takes into account the processes of polymeric intake, accumulation in the environment, and biosubstrates of the human body. The approach is presented for simultaneous accounting and analysis of dissimilar and heterogeneous data having different degrees of influence on the content of metals in human biosubstrates and the investigated components of the environment using neural self-organizing network Kohonen, implemented in the author’s model of neuronetwork filtration. A method of determining probability of exceeding the threshold values of metal concentrations in the objects under investigation using the risk theory is proposed. As the thresholds of these events, we have taken the median of continuous series of observations of metal concentrations. The facts of established exceeding the thresholds (events) were recorded in the whole set of observations, allocated in the form of clusters formed by the help of neural network classification. In this case, the spatial distribution of selected observations having specific address mappings forms the corresponding territorial zones, which can be used for operational and planned quality management of environmental components in an urbanized territory.

DSTL

Shingled magnetic recording (SMR) is regarded as a promising technology for resolving the areal density limitation of conventional magnetic recording hard disk drives. Among different types of SMR drives, drive-managed SMR (DM-SMR) requires no changes on the host software and is widely used in today’s consumer market. DM-SMR employs a shingled translation layer (STL) to hide its inherent sequential-write constraint from the host software and emulate the SMR drive as a block device via maintaining logical to physical block address mapping entries. However, because most existing STL designs do not simultaneously consider the access pattern and the data update frequency of incoming workloads, those mapping entries maintained within the STL cannot be effectively managed, thus inducing unnecessary performance overhead. To resolve the inefficiency of existing STL designs, this article proposes a demand-based STL (DSTL) to simultaneously consider the access pattern and update frequency of incoming data streams to enhance the access performance of DM-SMR. The proposed design was evaluated by a series of experiments, and the results show that the proposed DSTL can outperform other SMR management approach by up to 86.69% in terms of read/write performance.

Gunshot wound incidence as a persistent, tragic symptom of area deprivation

BackgroundMore than 30,000 Americans die every year of firearm-related injuries. Gun violence is frequently addressed by law enforcement and policing, as opposed to public health interventions that might address poverty or deprivation. Our goal was to evaluate the past 20 years of gunshot wound injury demographics seen at our level I academic trauma center and create a risk map model correlating gunshot wound incidence with area deprivation. MethodsPatients admitted for gunshot wound-related injuries between 1996 and 2017 were identified using our trauma registry. Demographic and injury data were extracted and analyzed. Multivariable logistic regression models were created to identify predictors of mortality. Geographic information system mapping of incident location and home address was completed to identify zip code hot spots of high gunshot wound incidence. Area Deprivation Indices, which reflect local income or poverty, housing, education, and employment were used as a marker of relative economic disadvantage. Spearman rank correlation was used to determine the relationship between Area Deprivation Indices score and gunshot wound rate. ResultsA total of 2,413 patients with gunshot wounds were evaluated. The cohort had a mean age of 28.8 ± 11.5 and was 89.6% male. Mean Injury Severity Score was 11 ± 12.5. gunshot wounds were most frequently a result of assault (91.1%), followed by unintentional injury (3.4%). Geographic information systems mapping revealed significant clustering of gunshot wounds. The areas with highest per capita incidence of gunshot wounds was strongly correlated with Area Deprivation Indices (0.594, P < .001). ConclusionGeographic regions of known lower socioeconomic resources have higher incidence of gunshot wounds in our community. Both Area Deprivation Indices and gunshot wound incidents in these distressed communities remained unchanged throughout the past 20 years, despite law enforcement crime suppression efforts. Gunshot wounds appear to be a symptom of area deprivation, similar to failing schools and poor health outcomes. Efforts to decrease poverty and community capacity-building may help alleviate this area deprivation.

GMig: Efficient vGPU Live Migration with Overlapped Software-Based Dirty Page Verification

This paper introduces gMig , an open-source and practical vGPU live migration solution for full virtualization. Taking the advantage of the dirty pattern of GPU workloads, gMig presents the One-Shot Pre-Copy mechanism combined with the hashing based Software Dirty Page technique to achieve efficient vGPU live migration. Particularly, we propose three core techniques for gMig: 1) Dynamic Graphics Address Remapping, which parses and manipulates GPU commands to adjust the address mapping and adapt to a different environment after migration, 2) Software Dirty Page, which utilizes a hashing based approach with sampling pre-filtering to detect page modification, overcomes the commodity GPU's hardware limitation, and speeds up the migration by only sending the dirtied pages, 3) Overlapped Migration Process, which significantly compresses the hanging overhead by overlapping the dirty page verification and transmission concurrently. Our evaluation shows that gMig achieves GPU live migration with an average downtime of 302 ms on Windows and 119 ms on Linux. With the help of Software Dirty Page, the number of GPU pages transferred during the downtime is effectively reduced by up to 80.0 percent . The design of sampling filter and overlapped processing can bring about further 30.0 and 10.0 percent improvements in page processing.

Airborne Communication Computer Based on PowerPC+ SRIO Architecture

In order to break through the transmission capacity limitation of airborne computers, an airborne communication computer based on PowerPC+ SRIO Architecture is designed according to the wide application of the SRIO bus and the high performance of the PowerPC processor. In terms of optimization design, the computer adopts a redundant fault-tolerant system and improves the SRIO register initialization and address mapping method. The experimental results show that the transmission speed of the airborne communication computer based on PowerPC+ SRIO architecture reaches 81% of the theoretical value, and 16KBytes data can be transmitted in real time within 1μs.

Tiler: An Autonomous Region-Based Scheme for SMR Storage

Shingled Magnetic Recording (SMR) Disks are adopted as a high-density, non-volatile media that significantly precedes conventional disks in both the storage capacity and cost. However, inefficient read-modify-writes (RMWs) greatly challenge the management of SMR disks. This article for the first time presents an approach called Tiler to manage SMR disks by dividing the physical space into small autonomous regions (ARs). Each AR can manage its space allocation, address mapping, and cleaning independently. By managing these ARs in a log-structured way, RMWs can be avoided; besides, ARs can also help update data when the adjacent tracks contain no valid data. Tiler is capable of partitioning a large-scale cleaning into self-contained-small-scale cleaning and thus, the data that need to be relocated are limited inside independent ARs, which further minimizes the performance overhead. Our experimental results show that Tiler can shorten the overall system response time by 50.21 percent and reduce the cleaning time by 90.24 percent on average.

ZDC: A Zone Data Compression Method for Solid State Drive Based Flash Memory

Solid-state drive (SSD) with flash memory as the storage medium are being widely used in various data storage systems. SSD data compression means that data is compressed before it is written to Not-And (NAND) Flash. Data compression can reduce the amount of data written in NAND Flash and improve the performance and reliability of SSDs. At present, the main problem facing data compression of SSD is how to improve the efficiency of data compression and decompression. In order to improve the performance of data compression and decompression, this study proposes a method of SSD data deduplication based on zone division. First, this study divides the storage space of the SSD into zones and divides them into one hot zone and multiple cold zones according to the different erasing frequency. Second, the data in each zone is divided into hot data and cold data according to the number of erasures. At the same time, the address mapping table in the hot zone is loaded into the cache. Finally, when there is a write or read request, the SSD will selectively compress or decompress the data according to the type of different zones. Through simulation tests, the correctness and effectiveness of this study are verified. The research results show that the data compression rate of this research result can reach 70–95%. Compared with SSD without data compression, write amplification is reduced by 5 to 30%, and write latency is reduced by 5 to 25%. The research results have certain reference value for improving the performance and reliability of SSD.

A Statistical Method for MCU Extraction Without the Physical-to-Logical Address Mapping

A statistical method was proposed to extract multiple-cell upsets (MCUs) from single-event upsets (SEUs) without the physical-to-logical address mapping of the device under test (DUT). The method was first developed to extract the mapping relation between the least significant bits (LSBs) of the physical address and the logical address bits. Then, the mapping relation was utilized to extract MCUs from the SEUs. Using the proposed method, the proportion, size, and shape of the MCU can be obtained with high accuracy. To evaluate the proposed statistical method, the method was applied to SEU test data of a 0.18-μm static random-access memory (SRAM) irradiated by various heavy ions. The results demonstrated its effectiveness in MCU extraction.