Patent Application
20170117030
The invention pertains to data disturb vulnerabilities in Dynamic Random Access Memory (DRAM) integrated circuits. In particular, it pertains to mitigating attacks on a computational system by deliberate inducement of row disturbs (also known as “row hammering”) in the system's DRAM memory.
In memory technology, a “disturb” refers to data loss in one or more memory cells in a memory array. This can result from many causes ranging from environmental factors such as, for example, radiation by alpha particles or other ionized atoms and power supply glitches. They can also occur from operations on one or more other memory cells in the same array. Disturbs can occur in most memories. Failure mechanisms can vary from technology to technology (e.g., DRAM, SRAM, Flash, etc.) and can differ between different manufacturers and even between process generations in the same technology from the same manufacturer.
One of the characteristics of DRAM technology is that data is stored by capturing a quantity of charge on a capacitor in each memory cell. Accessing a memory cell is destructive, meaning that the data in all the cells in a row must be read and then rewritten to the cells in order to restore the charge level to its original condition before de-accessing the row. Thus a read access is effectively a read-restore operation and a write operation is effectively a read-modify-restore operation.
In most applications a DRAM controller is used to manage the complexities of DRAM operation details. If a row of memory cells is not accessed periodically in the course of operation, the charge in the memory cells can leak away resulting in data loss. The DRAM controller is responsible for managing this by issuing refresh (REF) commands to the DRAM with sufficient frequency that each memory cell undergoes a read-restore operation at least once during the specified refresh cycle.
In recent generations of DRAM devices, a disturb mechanism known as row hammering has been discovered that can be exploited by malicious persons who attempt infiltrate a computer system and gain access and/or control (hereafter “attackers” and often colloquially known as “hackers”). This vulnerability results from smaller, more densely packed memory cells in current generation DRAMs. Since the word lines are physically closer than in previous generations, the capacitive coupling between adjacent word lines is increased. Repeated activation of a word line (the “target row”) induces repeated partial activation on the two adjacent word lines (the “victim rows”). This in turn leads to charge loss from the cells on the victim rows which can result in some cells losing their data prior to the next refresh of that row. A variation of this known as “double hammering” is an attack in which two target rows on either side of a single victim row is repeatedly accessed causing disturbs more quickly.
DRAM integrated circuits are typically organized into banks which allows commands to be directed to different banks at different times substantially in parallel allowing multiple simultaneous operations to be performed in different parts of the memory. Typically, to perform an access operation (read or write) on a bank, a row is activated (or “opened”) by issuing a row activate command (ACT) for that bank and specifying a particular row address in that bank. This allows a succession of read and/or write operations to be performed at memory column addresses located on that row. When an access to a row is complete, the row must be deactivated (or “closed”—also known as pre-charging) by issuing a pre-charge command (PRE) to that bank or by issuing a pre-charge all command (PREA) to all banks at once.
Row hammering may involve issuing repeated pairs of an ACT command and a read with auto pre-charge command (RDA) to a particular target row (or rows) attempting to alter the data in one of the adjacent victim rows. The RDA command executes a combination of a normal read command (RD) with an immediately following pre-charge (an “auto pre-charge”) for that row. This may be the fastest way to execute a row hammer attack without being obvious (and thus easily detectable), since a series of ACT and immediate PRE commands without read or write operations would serve no legitimate purpose.
This is an effective attack method because typically one or more memory pages (usually four kilobytes in modern systems) can be stored into a single row allowing the processor to access one or more entire pages at a time. Thus row disturbs caused by accessing a particular page will occur in a completely different memory page—and therein lies the problem.
In most modern operating systems (OS), main memory is typically virtualized. This means each page has a “physical address” corresponding to the physical location in the DRAM and a “virtual address” which is what the operating system and user applications manipulate to emulate larger contiguous memory spaces. The OS maintains a “page table” which keeps track of the translations between each virtual page and its physical counterpart. Each page in the memory has a data record in the page table known as a page table entry (PTE). Since PTEs are also stored in main memory they are vulnerable to row hammering attacks.
Typically, different pages have different levels of privilege (e.g., the user security level required to access that page). Thus an attacker can launch a non-privileged application running a row hammering attack which can in turn corrupt data in memory locations where it does not have any access privileges. These locations may belong to another application or to even the operating system itself. This creates a security violation. Once the violation occurs, the attacker can use a variety of techniques beyond the scope of this disclosure to gain access to and/or control of the system.
A recent paper based on research conducted jointly by Carnegie Mellon University and Intel Corporation entitled Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors, by Yoongu Kim, et al, IEEE 41st International Symposium on Computer Architecture, June 2014 (henceforth Kim)—which is hereby included by reference herein in its entirety—analyzed the problem and suggested seven possible solutions: [1] make better memory chips, [2] correct errors with error correction coding (ECC), [3] refresh more frequently, [4] retire weak cells (by the manufacturer), [5] retire weak cells (by the end user), [6] identify target rows and refresh their neighbors, and their proposed solution [7] probabilistic adjacent row activation.
Kim solution [3], increasing the refresh rate, is the current conventional approach. In most current generation systems, doubling the refresh rate will eliminate the problem by insuring each row gets refreshed before a row hammer attack can do sufficient damage to cell charge to cause errors. While this has the virtue of simplicity, it requires an increase in system power which is undesirable in data center applications (due to the high power density) and in battery operated devices such as cellphones, tablets, and laptop computers (where long battery life is a major selling point). It also detracts from system performance since additional refresh cycles reduce memory system bandwidth.
Kim solution [1] is to design better memories. The major DRAM manufacturers have attempted to improve their memory designs, with some success. For example, the JEDEC LPDDR4 (Low Power Double Data Rate 4) SDRAM Standard, JESD209-4, August 2014 (henceforth JEDEC LPDDR4)—which is hereby included by reference herein in its entirety includes an optional feature called Target Row Refresh (TRR). If TRR is implemented, the LPDDR4 part is tested by the manufacturer to determine the Maximum Activate Count (MAC) for that particular part—the MAC being the number of repeated ACT and PRE (or PREA or RDA) commands between refresh cycles that can be tolerated in a single row before row hammering can cause a memory disturb.
The memory controller or operating system must track the number of row activations that have been issued to each row to determine if the MAC limit has been reached. Then the part must be put into its idle state (by pre-charging all banks) before entering TRR mode to perform three successive refreshes to the target row and its two adjacent neighbors. Since the memory controller only knows the target row, the SDRAM on-chip TRR circuit assists by internally identifying the two victim rows and handles their addressing for the controller. This places a substantial burden on the memory controller and/or the operating system software, thereby adding significant complexity to designing a secure system.
Although TRR is not a part of the JEDEC DDR4 (Double Data Rate 4) SDRAM Standard, JESD79-4, September 2012 (henceforth JEDEC DDR4)—which is hereby included by reference herein in its entirety—the major DRAM manufacturers have incorporated a TRR implementation into their most recent DDR4 offerings.
For example, Micron Technology offers a TRR circuit in their DDR4 parts which is similar (but not identical) to the LPDDR4 feature. Micron claims that while the circuitry is there, it is not usually needed since the majority of tested parts have no vulnerability. Unfortunately, most-but-not-all of the time leaves the system designer needing to deal with the not-all case which, in practice, is akin to the LPDDR4 solution.
SK Hynix also offers a TRR circuit on its recent DDR4 products similar (but not identical) to both the LPDDR4 and Micron solutions. This has the same drawbacks. Additionally, since these TRR circuits are not standardized, system designers must now make allowances for which manufacturer their DRAMs are sourced from and include the appropriate algorithms for both.
Samsung has a third solution known as “pseudo-TRR,” though the details are not publicly available. Samsung claims that the combination of pseudo-TRR and doubling the refresh rate will solve the row hammering problem, which suggests their answer to the problem is a combination of Kim solutions [1] and [3].
Kim solution [2], using error correction codes (ECC) is expensive and has limitations. Currently ECC is only used in data center and enterprise class memory modules, being too expensive for most consumer systems. ECC SDRAM modules typically use a Hamming single error correction, double error detection (SECDED) code. The Kim study notes that row hammering attacks frequently cause multiple errors in the typical 64-bit DRAM data word and that SECDED is insufficient to mitigate the problem alone. Stronger error correction codes (e.g., Reed-Solomon, binary BHC, etc.) can be used, but they are computationally intensive requiring considerable time, power, additional memory cells (to hold the parity bits for each data word), and silicon area to implement. This makes them undesirable for use in fast system memory applications and expensive for low performance systems.
Another issue with ECC is that in order to correct errors the data must be read out of the DRAM (perhaps during a refresh cycle), decoded, corrected, re-encoded and then written back into the memory cells. This takes longer that a normal refresh cycle and further increases power while decreasing memory bandwidth.
The Kim paper is fairly dismissive of solutions [4] and [5]. It states that solution [4], having the manufacturers retire victim rows before shipping the product, is impractical due to both test time and to the potential number of spare rows needed. Kim also observes that solution [5], having the user retire victim cells, simply throws the same burden on the system designer who has to find and replace bad memory rows performing analogous operations at the system level at significant cost in processing time and available memory.
Kim is also dismissive of solution [6], which is to identify target rows and refresh their neighbors. Since it is impractical to have an access frequency counter for each row in a memory chip, complicated algorithms, searches and approximations must be used, and these can yield many false hits requiring many unnecessary additional refresh cycles.
The Kim advocated solution [7], probabilistic adjacent row activation, has the virtue of simplicity and low overhead but is not without its drawbacks. The approach is to “flip” a biased “coin” after each active and pre-charge pair. Thus randomly (Kim suggests on the order of one in a thousand row activations) one of the two adjacent rows is randomly activated and then pre-charged (the equivalent of a refresh for that row). It may take many thousands of row activations to induce an error (50,000 or more according to Kim, or 200,000 or more according to JEDEC LPDDR4). Thus a row targeted many times may have a high probability that both of the adjacent victims will get refreshed long before the hammering attack succeeds in causing a disturb error, thus resulting in an acceptably low error rate that can be tuned for a particular system.
The downside to probabilistic adjacent row activation, like most of the other solutions, is that it places the burden, albeit lighter than most of the others, on the memory controller and/or software and requires adjacency information that the memory manufacturers typically do not provide and may not be willing to provide in the future. Kim suggests a possible work-around by making educated guesses about adjacency between rows, but this simply increases the overhead required (due to unnecessary refreshes when the educated guesses are wrong) while reducing the quality of the results (since the real victim row may be missed). Also, many engineers prefer to implement deterministic hardware and/or software (and/or may be required to do so by their managers) and may find the non-deterministic nature of probabilistic adjacent row activation to be unacceptable.
Thus it is highly desirable to have a solution to the row hammering problem that is substantially transparent to the memory controller and/or software and handles the issue internally to the DRAM with little overhead and minimal involvement from the memory controller or operating system.
Those of ordinary skill in the art will realize that the figures and descriptions of exemplary embodiments and methods of the present invention are illustrative only and not in any way limiting. Other embodiments will readily suggest themselves to such skilled persons after reviewing this disclosure.
Note that in DRAM terminology, different groups of circuits are often referred to as a “path” having a particular functionality. This is because all of these “paths” ultimately lead to the array of memory cells where the data is ultimately stored. It is a convenient way of talking about functions that are often located in multiple physical places and at multiple levels of the organizational hierarchy. For example, in
Returning to
The command input signals are monitored and may be captured on the rising and/or falling clock edges (or transitions) in control input block 112 depending on the design details of DRAM 100. Other signals like, for example, the address inputs for the bank, block and row address signals, may also be captured on the active edge or edges of CK and CK# though many of these signals and connections are not explicitly shown in
Command decoder 114 may accept the captured command input signals from control input 112 and convert them into a variety of internal control signals used for the correct operation of DRAM 100. While connections to the refresh control logic 116 and FIFO CAM 162 are explicitly shown and will be discussed below, many other connections are not shown in
Refresh control logic 116 may be controlled by command decoder 114 and in turn may control refresh counter 118. A connection to refresh control logic 116 from target row refresh queue 172 is explicitly shown and will be discussed below.
In general, SDRAM devices such as DRAM 100 cycle through all of the addressable rows in a sequential order determined by the details of the design of refresh counter 118 in response to a regular refresh operation presented to control input 112 and commanded by control decoder 114. Connections from refresh counter 118 to multiplexer 134 and BBR CAM 164 are explicitly shown and will be discussed below. DRAM parts typically comprise multiple banks in which the same row location in each bank is refreshed simultaneously during a normal refresh operation.
Depending on the size of the memory, more than one row location may be refreshed during a single refresh operation. In general, there is agreement industry wide that every row needs to be refreshed an average of once every 64 milliseconds (ms) below 85° C.—or every 32 ms above 85° C. Thus at temperatures less than 85° C. and in parts having 8,192 rows (or groups of rows) to refresh, a refresh command must be issued an average of once every 7.8 microseconds (μs)—or 3.9 ms above 85° C. This is a well-known specification (tREFI) present on DRAM data sheets for many generations.
Global address path 120 may monitor and capture the bank, block and row address inputs with respect to CK and CK# in address input 122. Address input 122 then presents the captured addresses to wherever they are needed. In normal operation this is typically address logic 124.
Typically, DRAMs are broken into multiple banks to allow parallel operations to occur substantially simultaneously. The bank address input comprises a number of bits, represented by A1 in
In most recent generations of SDRAMs, there have been eight banks meaning A1=3. DDR4 is the major exception having 16 banks with A1=4. The values of A2 and A3 vary according to the size of the memory (which relates to the number of memory cells, to the number of blocks, and to their internal organization in terms of rows and columns). Thus A2 and A3 vary from part to part and are typically treated as proprietary information by the manufacturer. An advantage of the present invention is that it provides a superior TRR solution internal to DRAM 100 so that manufactures may maintain these design details as proprietary information.
Returning to
Bank row decoder 132 may be used to translate between the block and row address bits and the actual physical row in the bank to be accessed, while the bank address bits are used to select which bank is selected for the operation. Multiplexer 134 may choose the source of the block and row address bits. For example, for a normal read or write operation the source may be address logic 124, and for a normal refresh operation the source may be refresh counter 118. The case where the source may be the target row refresh queue 172 will be discussed below.
Bank data path 150 may be instantiated multiple times in DRAM 100, at least once in each bank. While there are many sub-blocks in bank address path 150, only memory array 152 and bit line/sense amplifier (BLSA) circuits block 154 are shown in the
Global target row refresh (TRR) path 160 comprises sub-blocks FIFO CAM 162, BBR CAM 164, TRR Logic 166, watch list counters 168, tenure counters 170, and target row refresh queue 172. In general terms, this block may monitor decoder 114 to detect the arrival of active (ACT) commands and address input 122 to detect the arrival of the associated sequence of active row addresses. Global TRR path 160 provides a two-step filter that monitors the arriving sequence of active row addresses, detects active row addresses that are arriving at a more frequent rate than a predetermined maximum safe rate, tracks the number of occurrences of those detected active row addresses, and requests a special refresh operation for a specific active row address if the number of occurrences of that specific active row address exceeds a predetermined safe maximum number of occurrence. Thus, excessive row activations at a particular address (consistent with the address being a target of a row hammer attack) are protected and less frequently occurring addresses (consistent with the address not being a target of a row hammer attack) are filtered out.
Mode register 180 comprises a number of sub-registers which contain control data for DRAM 100. These are loaded by the memory controller, typically after reading them from the serial presence detect (SPD) device in a dual inline memory module (DIMM) application, or typically by software or firmware in other applications. In most DRAM devices, there are undefined bits or entire undefined registers reserved for future use in the relevant standard. Some of these available bits may be used control various features such as enabling or disabling global TRR path 160 or determining the depth of the various memories such as FIFO CAM 162 and BBR CAM 164.
Mode register 180 is coupled to address logic 124 and the data stored therein is typically loaded via the address inputs. It is also coupled to TRR logic 166 so that the contents of mode register 180 may enable control and/or global TRR path 160. The various control parameters for global TRR path 160 described herein may also be stored in mode register 180. Many of the connections to and from mode register 180 have been omitted from
Non-volatile memory (NVM) block 190 stores a variety of information used in the operation of DRAM 100. For example, many bits in NVM block 190 control test functions that are disabled after testing but before the part is shipped from the manufacturer. Other bits are used to tweak a number of internal design parameters like for example, trimming internal voltage levels from the outputs of internal regulators, trimming the delay values of critical circuits to maximize function and/or yield, or replacing malfunctioning rows and/or columns with redundant ones to turn damaged parts with bad memory bits into fully functional ones, etc. The exact nature of the non-volatile technology used to implement NVM block 190 is well known in the art. Typically, it is implemented with fuses, though any technology that retains data when the power supply is disconnected such as, for example, Flash, EEPROM, blown transistor gate oxide, antifuses, etc., may be used.
The information stored in NVM block 190 is typically defined by the manufacturer and transparent to the user. The various control parameters for global TRR path 160 described herein may also be stored in NVM block 190. In combination, mode register 180 and NVM block 190 may allow both the manufacturer and the end user (if allowed by the manufacturer) to control aspects of the functionality of global TRR path 160.
The parameter tRC is typically a key SDRAM datasheet parameter known industry wide as the “row cycle time” or sometimes as the ACTIVATE-to-ACTIVATE command period. It may typically be expressed as the sum of two other parameters tRAS (the ACTIVATE-to-PRECHARGE command period) and tRP (the PRECHARGE command period). This value may represent the shortest period that a row may be opened and then closed. Thus the lowest value of tRC may be the worst case condition for a row hammering attack and may determine the number of times a row hammer attack access may be attempted during a refresh cycle.
In equation 202, for this exemplary calculation a worst case tRC will be assumed to be 44.5 nanoseconds (ns), which corresponds the shortest tRC (for the fastest speed bin) in the datasheet for the recent Micron Technology 4 gigabyte (Gb) DDR4 offerings: MT40A1G4xx-0xxE, MT40A512M8xx-0xxE, and MT40A256M16GE-0xxE.
Equation 204 shows the exemplary derivation of tREFI=7.8 μs from a 64 ms refresh cycle time and 8,192 refresh cycles as discussed above.
Equation 206 shows the exemplary derivation of NHAMMER(max) defined as the maximum number of row openings and closings possible in a 64 ms refresh cycle divided by the smallest row access time tRC(min) (assumed to be 44.5 ns here) which yields approximately 1.44e+6 (1.44 million or 1,440,000) row cycle events. Note that for higher temperatures above 85° C. the refresh rate is effectively doubled due to the higher memory cell leakage while tRC remains substantially constant. Thus the 64 ms in the numerator of equation 206 becomes 32 ms above 85° C. meaning the value of NHAMMER(max) is halved, making the value for below 85° C. in equation 206 the worst case.
Equation 208 shows the exemplary assumption of NWC(min)=200,000 which is the worst case (e.g., the lowest) maximum access count (MAC) (e.g., the number of row accesses or cycles before row hammer damage can occur) from both the Micron DDR4 4 Gb datasheet and the JEDEC LPDDR4 Standard. This is a reasonable value to use for the threshold to design to for the parts most vulnerable to row hammering.
Equation 210 expresses an exemplary design goal for an embodiment of the present invention. Since NWC(min) is the number of accesses between refreshes a single row can tolerate, then a double row hammer attack could be performed with two rows each performing half of those accesses. To avoid tracking target row pairs (more involved than just single target rows), it makes sense to use half the worst case MAC so that double row attacks are caught in the same way as single row attacks. Thus for the exemplary calculation it is reasonable to assume NWC=100,000 (=1.00e+5). Persons skilled in the art will realize that other assumptions, data, or competing design goals will result different values of NWC in different embodiments.
Equation 212 shows the exemplary derivation of the worst case number of possible row hammer attacks that can occur during a refresh cycle NTRR(max). In this exemplary calculation NTRR(max)=15 (14.4 rounded up to the nearest integer) which means that there is only time in a 64 ms refresh cycle for a maximum of 15 row hammer attacks. Persons skilled in the art will appreciate that this calculation is exemplary only, that different assumptions would lead to different results, that other assumptions and factors might be introduced, and that for any specific DRAM embodiment the assumptions used may be different and more appropriate for the that particular case.
Thus in a worst case scenario for the assumptions in the calculations of
The various parameters calculated in Equations 202 through 214 are predetermined for a particular set of anticipated conditions. It is preferred that once global TRR path 160 is operational that these parameters do not change. If a change is desired, it is best to stop operating DRAM 100, refresh all rows in all banks, change any desired parameters, perform a global reset and then resume operations.
Providing a counter for each row in DRAM 100 to only track rows with high access rates is impractical in terms of silicon die area. Thus a filtering of the stream of row addresses accompanying active (ACT) commands is needed to screen out rows that are not activated frequently enough to need additional refreshing beyond the normal refresh cycle.
A FIFO is a first-in/first-out memory. Data is written into a FIFO as a series of data words. Data is then read out of the FIFO in a series of data words in the same order as they were originally written. There are many types of FIFO with a variety of features and styles of implementation known in the art. The particular implementation of the FIFO portion of FIFO CAM 162 is a matter of design choice.
A CAM is a content addressable memory. In a typical CAM, data words may be written into or read from a particular address in the memory just as in a typical SRAM (static random access memory). In a comparison mode, the CAM is typically presented with a data word at the data input port and the memory contents are evaluated to determine if the data presented is already resident in the memory. In FIFO CAM 162, the data reading and writing is handled by the FIFO portion of the circuitry, while the CAM portion compares an input data word to the current contents to determine if a match is present at the time it is presented to FIFO CAM 162 for writing. There are many types of CAM with a variety of features and styles of implementation known in the art. The particular implementation of the CAM portion of FIFO CAM 162 is a matter of design choice.
Returning to
The plurality of address entries 312 may be thought of as a shift register that is Ni words deep and (A1+A2+A3) bits wide, though many different implementations are possible and fall within the scope of the invention. The value for Ni is embodiment dependent and a matter of design choice. It may be programmable and selected after testing integrated circuit 100 in some embodiments. Typically, a minimum value of Ni=2*NTRR(max)+1 is desired for reasons described below. Thus in the exemplary embodiment described Ni≧31 since NTRR(max)=15. Persons skilled in the art will realize that the value chosen for Ni may be adjusted in a particular embodiment to accomplish other design objectives.
FIFO logic 310 is coupled to command decoder 114 as shown in
Returning to DRAM 100 in
As discussed above, the number of address entries 312 in FIFO CAM 162 may be a minimum of Ni=2*NTRR(max)+1. The need for the “+1” portion of the Ni equation was illustrated in
RAM logic 502 and CAM logic 504 are controlled by the TRR logic 166 of
If the PARA from FIFO CAM 164 does not match a tracked address entry 506 in BBR CAM 166, but its match flag 324 is set to logic-1, then then the contents of a tracked address entry 506 are evicted from BBR CAM 164 and replaced by the PARA while the associated watch list counter 168 and tenure counter 170 for that tracked address entry 506 are initialized (both set to logic-1 in some embodiments) to start tracking that PARA, and the associated match flag is discarded.
If the PARA from FIFO CAM 164 does not match a tracked address entry 506 in BBR CAM 166 and its match flag is set to logic-0, then the PARA and its associated match flag are discarded. In this manner, PARAs occurring at less than the row hammer danger rate are thus ignored by the second stage of the filtering process. Thus the two stage filtering performed by FIFO CAM 162 and BBR CAM 164 efficiently track only the row addresses that may be part of a row hammering attack.
Turning now to
The contents of rows 620-1 through 620-8 in
Since each PARA has occurred once since the last refresh cycle for any of these rows, the value in each watch list counter 668 is 1. Since PARA A was first, its associated tenure counter 670 in row 620-8 has a value of 8. Similarly, since PARA B was second, its associated tenure counter 670 in row 620-7 has a value of 7, and so on through PARA H which was last and its associated tenure counter 670 in row 620-1 has a value of 1.
Turning to
In the case illustrated in
Turning now to
Persons skilled in the art will realize that once a row 620 has counted to the point of sufficient tenure there is no reason to keep counting the tenure of a row 620. Such skilled persons will realize that the large tenure counts shown in
Notice that once BBR CAM 664 is full (e.g., all rows 620 are track PARAs) or reset to an appropriate state, each row will have a different value in its tenure counter since all tenure counters are incremented for each presented PARA. BBR CAM 664 may be designed so that when initialized it has a different value in each tenure counter 670 ranging from 1 to NTENURE(min) to simplify the logic design.
Applying the second criterion, row 620-4 is evicted and replaced by PARA K, row 620-2 is in turn evicted and replaced by PARA L, and lastly row 620-1 is evicted and replaced by PARA M. Notice that except for each evicted row in its turn (when its tenure counter is initialized to one), all of the tenure counters 670 of all the other rows 620 increment each operation.
Turning now to
As discussed earlier, NTRR(max) is an empirically determined design value representing the maximum number of rows that may be targeted during a refresh cycle. In the exemplary embodiment of
The desired size of FIFO CAM 162, Ni=2*NTRR(max)+1, was discussed in conjunction with
Returning to
The size of the first region may be NTRR(max) rows 620. Since this is the maximum possible number of potentially successful row hammer attacks this number of rows 620 should be available to store the highest watch list counter 668 values. In general, as these values continue to rise the contents of these rows 620 become harder to evict.
The size of the second region may be NTENURE(min) rows 620 which is the length of time a row 620 must remain resident in BBR CAM 164 before it can be evicted. The tenure requirement defends against row hammer algorithms devised by attackers with knowledge of the operation of FIFO CAM 162 and BBR CAM 164 which will be discussed below.
The size of the third region Nz may be at least one. This is to provide one or more rows 620 so that a high value row may not be evicted and replaced by a new PARA entering BBR CAM 164 as happened in the case described in conjunction with
The example of
Since NTRR(max) is the largest number of simultaneous row hammer attacks, NTENURE(min) must be large enough to have a row entry 620 for each of the NTRR(max) simultaneous attacks. This will force the attacker to have a bogus PARA for each real attack trying to evict the high watch list counter 868 values to replace them with lower ones. By adding one or more additional rows 820 (NO the time it takes to evict a row is increased to the point where there is insufficient time in a refresh cycle to maintain both an attack and simultaneously evict the rows 820 monitoring that attack. This ensures the real attack addresses can all be tracked in BBR CAM 164 without being evicted by calculated patterns of other addresses introduced into the address attack stream.
Turning now to
As in
Based on the discussion of
Persons skilled in the art will appreciate that there might be design tradeoffs where the values of Ni and Nk may be determined differently. For example, in the equations of
Returning to
Since the damage in a row hammering attack occurs in rows adjacent to the target row, the preferred way to ensure that the damage is contained is to make sure that the refresh counter sequence ensures that adjacent rows get refreshed in consecutive refresh operations, though other sequences may be used.
Thus if there is a match with refresh counter 118, then there is no reason to further monitor that particular PARA since any row hammering damage to the data in adjacent rows has just been corrected and/or soon will be corrected by prior and/or subsequent regular refresh operations. In such a case, TRR logic 166 resets the watch list counter 168 and the tenure counter 170 to their reset states. Both may set to one, but other values (e.g., zero) may be used. This effectively resets the monitoring of the PARA in tracked address 506 in which will either continue to count matches or be evicted based on the future stream of PARAs from FIFO CAM 162. Alternatively, the contents of tracked address 506 may be reset to its reset value. Persons skilled in the art will appreciate that there are other ways to implement this function and all of them are within the scope of the invention.
Returning to
Turning now to
The exact number of queue entries 1006 is a matter of design choice, though a best case minimum value may be NTRR(max). If an attacker has detailed knowledge of the circuitry of global TRR path 160, a calculated stream of incoming addresses might be designed to trigger a non-regular data loss mitigation refresh operation for as many as NTRR(max) watch list counters 168 on as many consecutive ACT commands. If the number of entries 1006 is insufficient, then TRRQ 172 may overflow resulting in lost data. This could be compensated for in queue control logic 1002, or in TRR Logic 166, or in some other manner, though supplying enough entries 1006 for the NTRR(max) dangerous target rows with the highest value watch list counters 168 may be simpler and less expensive. Those skilled in the art will realize that any method of preventing a TRRQ 172 overflow is within the scope of the invention.
Queue control logic 1002 monitors the tenure and occupancy of entries 1006 and analyzes the contents of each bank address register 1008. When there are occupied entries 2006 awaiting a special TRR refresh operation, the queue control logic 1002 may determine which banks have a pending TRR refresh entry 1006. Queue control logic 1002 then sends the contents of block address register 1010 and row address register 1012 for at least one entry 1006 to the bank addressed in the associated bank address register 1008. Queue control logic 1002 is coupled to refresh control logic 116 (not shown) and notifies it that one or more entries in TRRQ 172 need a special refresh operation. Refresh control logic 116 in turn schedules a non-regular data loss mitigation refresh operation, which will occur during a subsequent refresh command. During such a non-regular data loss mitigation refresh operation the value in the refresh counter does not change so it may resume regular refresh operations at the same location without skipping a location in the sequence of regular refresh operations.
If a plurality of entries 1006 are occupied and the bank address registers 1008 are for multiple banks, then in some embodiments multiple entries 1006 may be sent to different banks to allow simultaneous non-regular data loss mitigation refresh operations to occur simultaneously in those banks. If more than two entries 1006 address the same bank, the one with the highest tenure is sent to that bank and the other is retained for a subsequent special TRR refresh operation. In other embodiments entries 1006 in TRRQ 172 may also be processed one at a time as a matter of design choice.
Since for each target row there are two victim rows that must receive a special TRR refresh operation, the row address of each victim row must be determined from the address of the target row. This is preferably done in the bank row decoder 132 in each bank where a simple logic function can be built in to address the neighbors of a target row at particular address. Persons skilled in the art will realize that the victim row address determination can be performed elsewhere in DRAM 100 (e.g., in queue control logic 2002) as a matter of design choice and that all such embodiments fall within the scope of the invention.
Some DRAMs refresh only a single row in each bank during a refresh operation, while others refresh multiple rows. If only a single row is refreshed per refresh command, then two refresh commands are required to process an entry 1006 in TRRQ 172. If multiple rows are refreshed per refresh command, then only a single refresh command is required to process an entry 1006 in TRRQ 172. Either case is within the scope of the present invention.
Once the entry 1006 has been processed (e.g., both victim rows have been refreshed) then the entry 1006 is cleared from TRRQ 172. If there are still active entries (e.g., there were two target rows in the same bank which could not be processed during the same special TRR refresh operation) then queue control logic 1002 informs refresh control logic 116 that another special TRR refresh operation is required and needs to be scheduled.
The calculation in equation 214 in
Turning now to
FIFO CAM 1162 comprises two regions. The Ni(active) region and the shaded Ni(spare) region. Ni(active)=Ni in a particular application. The presence of Ni(spare) allows the value of Ni to be tuned for that application by allowing the number of rows 1312 to be selected from a range of values rather than Ni being a fixed value for all applications. The size of Ni(max) is a matter of design choice.
Similarly, BBR CAM 1164 comprises two regions. The Nk(active) region and the shaded Nk(spare) region. Nk(active)=Nk in a particular application. The presence of Nk(spare) allows the value of Nk to be tuned for that application by allowing the number of rows 1620 to be selected from a range of values rather than Nk being a fixed value for all applications. The size of Nk(max) is a matter of design choice.
DRAM 1100 further comprises a modified mode register 1180 and modified NVM block 1190 and both function substantially as do their counterparts mode register 180 and NVM block 190 in the exemplary embodiment DRAM integrated circuit 100 of
Apparatus and methods are disclosed for an embedded target row refresh (TRR) solution with modest overhead. In operation it is nearly transparent to the user. Except for enablement via the mode register and an increase in the average refresh rate on the order of no more than half of one percent, no further user action need be required. The stream of row addresses accompanying ACTIVE commands is monitored and filtered to only track addresses that occur at a dangerous rate and reject addresses that occur at less than a dangerous rate.
Those of ordinary skill in the art will realize that the above figures, descriptions, and embodiments are exemplary only. Many other embodiments will readily suggest themselves to such skilled persons after reviewing this disclosure. Thus the invention is not to be limited in any way except by the issued claims.
This application claims priority to U.S. provisional patent application 62/244,494 filed on Oct. 21, 2015 which is hereby included by reference herein in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 62244494 | Oct 2015 | US |
