ProTRR: Principled yet Optimal In-DRAM Target Row Refresh

Abstract

The DRAM substrate is becoming increasingly more vulnerable to Rowhammer as we move to smaller technology nodes. We introduce PROTRR, the first principled in-DRAM Target Row Refresh mitigation with formal security guarantees and low bounds on overhead. Unlike existing proposals that require changes to the memory controllers, the in-DRAM nature of PROTRR enables its seamless integration. However, this means that PROTRR must respect the synchronous nature of the DRAM protocol, which limits the number of DRAM rows that can be protected at any given time. To overcome this challenge, PROTRR proactively refreshes each row that is most likely to observe bit flips in the future. While this strategy catches the rows that are hammered the most, some others may still fly under the radar. We use this observation to construct FEINTING, a new Rowhammer attack that we formally prove to be optimal in this setting. We then configure PROTRR to be secure against FEINTING. To achieve this, PROTRR should keep track of accesses to each row, which is prohibitively expensive to implement in hardware. Instead, PROTRR uses a new frequent item counting scheme that leverages FEINTING to provide a provably optimal yet flexible trade-off between the tolerated DRAM vulnerability, the number of counters, and the number of additional refreshes. Our extensive evaluation using an ASIC implementation of PROTRR and cycle-accurate simulation shows that PROTRR can provide principled protection for current and future DRAM technologies with a negligible performance, power, and area impact. PROTRR is fully compatible with DDR4 and the new Refresh Management (RFM) extension in DDR5.

An Experimental Analysis of RowHammer in HBM2 DRAM Chips

“…Fortunately, the problem of tracking the frequently activated DRAM rows can be interpreted as a frequent item counting problem and can be solved using more area-efficient algorithms. For example, the Misra-Gries algorithm [171] can be implemented in hardware to accurately track aggressor rows using a relatively small number of counters to detect potential aggressor rows, and its variants are adopted by several prior RowHammer mitigation mechanisms [102,107,110,112,117].…”

“…Achieving low performance and energy overheads requires accurately identifying aggressor rows and preventively refreshing victim rows only when necessary. To this end, ABACuS adopts the Misra-Gries algorithm [171] ( §2) to track aggressor rows, similar to prior work [102,107,110,112,117]. However, Misra-Gries alone cannot prevent RowHammer bitflips at low area cost ( §7.1).…”

“…We evaluate ABACuS' chip area, static power, and memory array access energy using CACTI [157]. Table 1 shows an area, power, and energy cost analysis of ABACuS along with four other state-of-the-art RowHammer mitigation mechanisms [1,102,106,176] (their configuration details are explained in §8). We perform this analysis at N RH values of 1000 and 125.…”

“…Key Problem. Many prior works (e.g., [1,98,102,106,107,110,112,116,117,125,134,135]) propose using a set of counters to track the activation counts of potential aggressor rows (counter-based mechanisms). Using counters to determine rows that reach close to RowHammer thresholds and taking mitigating actions accordingly can prevent RowHammer bitflips at low performance and energy overheads.…”

Understanding RowHammer Under Reduced Wordline Voltage: An Experimental Study Using Real DRAM Devices

“…Reducing a DRAM chip's RowHammer vulnerability via V PP scaling has two key advantages. First, as a circuit-level Row-Hammer mitigation approach, V PP scaling is complementary to existing system-level and architecture-level RowHammer mitigation mechanisms [3,5,13,30,45,48,[50][51][52]65,80,91,[96][97][98][99][100][101][102][103][104][105][106][107][108][109][110][111][112][113][114]. Therefore, V PP scaling can be used alongside these mechanisms to increase their effectiveness and/or reduce their overheads.…”