Revisiting RowHammer: An Experimental Analysis of Modern DRAM Devices and Mitigation Techniques

Kim, Jeremie S.; Patel, Minesh; Yağlıkçı, A. Giray; Hassan, Hasan; Azizi, Roknoddin; Orosa, Lois; Mutlu, Onur

doi:10.1109/isca45697.2020.00059

Cited by 98 publications

(199 citation statements)

References 71 publications

Supporting

Mentioning

196

Contrasting

Order By: Relevance

“…In all cases, the ever-shrinking SN capacitance amplifies the disturb whatever mechanism is looked at since each electron reaching a charged node has an effect on the node's potential that is inversely proportional to the node's capacitance. Indeed, the quite dramatic reduction in hammer count seen in newer DRAM generations [6] can mostly be attributed to the SN capacitance reducing at a rate of about 3 fF per node [24]. We can also predict the existence of susceptible cells within a technology node as those with one or more of the following characteristics: a cell that contains an SN capacitance whose value is in the lower end of the distribution; a cell with a transistor whose threshold voltage is in the lower end of distribution; a cell that is physically far away from where the victim wordline is held at ground; a cell close to a particularly egregious electron emitter.…”

Section: Discussionmentioning

confidence: 99%

“…Other relevant full-chip experimental data include the effect of temperature [3], [27], [16] where RH susceptibility has been seen to be the worst within the range of 13 • C to 30 • C [27] although the effect was not as pronounced in [16]. Also, more advanced DRAM technologies suffer more from this disturb in having greater numbers of bit-flips per aggressor wordline activation [3], [6], [8] and a lower hammer count needed to flip the first bit [6].…”

Section: Experimental Data At Chip Levelmentioning

confidence: 99%

“…The simplifying assumption used in (5) and (6) as was used by Sakurai [14] is that the source resistance of the circuit driving the wordlines is negligible compared to the line resistance. This seems reasonable in the case of a DRAM wordline where the tungsten gate will probably result in tens of ohms per cell.…”

Section: Capacitive Crosstalkmentioning

confidence: 99%

“…Two connected but distinct groups of RH literature concern us here. The first contains extensive and fascinating studies at the DRAM chip level usually carried out by the large DRAM users in combination with academic institutes [3], [6], [8]. These contain experimental data on RH behavior such as 1) the minimum number of aggressor row activations to induce the first flipped bit (the "hammer count") and the related "Maximum Activation Count" (MAC) being the maximum number of row activations before any flipped bits are encountered; 2) the locality of flipped bits with respect to the hammered row; 3) the effectiveness of bit flipping when the initial states are ones or zeros; 4) the observation that newer technology DRAMs have lower MACs; and finally 5) the differences between DRAM chips from various (unnamed) vendors.…”

mentioning

confidence: 99%

See 3 more Smart Citations

On DRAM Rowhammer and the Physics of Insecurity

Walker¹,

Lee

Beery³

2021

IEEE Trans. Electron Devices

View full text Add to dashboard Cite

The dynamic random access memory (DRAM) disturb known as rowhammer (RH) has come to dominate the insecurity of computing systems worldwide. Several studies have concentrated on electron injection from a switching cell select transistor and capture by nearby storage node junctions as being the main mechanism for the effect. This article for the first time looks in-depth at RH from the point of view of both electron injection and capture, and capacitive crosstalk. The absence of such comprehensive studies at the silicon level in the literature can be attributed to its sensitive nature within the industry and highlights the difficulty of DRAM scaling. This review article, therefore, forms a broad foundation to extend understanding of this dangerous disturb mechanism and in so doing provides an informed view on the ability of future DRAM technologies to solve RH once and for all. Index Terms-Crosstalk, dynamic random access memory (DRAM), electron injection, rowhammer (RH). I. INTRODUCTION T HE story of dynamic random access memory (DRAM) is that of the semiconductor industry itself [1], [2]. Fifty years of scaling a field-effect transistor and a capacitor has resulted in DRAM as the "main memory" in all compute systems from cloud servers through laptops to mobile phones. This success makes such systems prone to any security weakness that may lurk within DRAM itself. The DRAM disturb known as rowhammer (RH) has been causing increasing concern since its public unmasking in [3]. It is characterized by corrupted data in cells close to a row that is turned on and off many times between data refresh. Although the actual problem seems to have been known since 2010, and most probably before that within DRAM Research and Development, with some patent applications in 2012, RH was propelled to the forefront of hardware security issues when it was used to gain computer kernel privileges [4]. After ten years from the first inkling of a problem, the RH disturb varies widely between Manuscript

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Experimental Data At Chip Levelmentioning

confidence: 99%

Section: Capacitive Crosstalkmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

On DRAM Rowhammer and the Physics of Insecurity

Walker¹,

Lee

Beery³

2021

IEEE Trans. Electron Devices

View full text Add to dashboard Cite

show abstract

“…To prevent the row-hammering attack, some works [32] increases refresh rate, significantly degrading the system performance. Please, note that as mentioned in [33], the rowhammering can be predictable by observing the number of accessing of adjacent rows. Recently, [33], [34] proposed the algorithms that can predict the location of row-hammering.…”

Section: F Row-hammering Preventionmentioning

confidence: 99%

ZEM: Zero-Cycle Bit-Masking Module for Deep Learning Refresh-Less DRAM

Nguyen

et al. 2021

IEEE Access

View full text Add to dashboard Cite

In sub-20nm technologies, DRAM cells suffer from poor retention time. With the technology scaling, this problem tends to be worse, significantly increasing refresh power of DRAM. This is more problematic in memory heavy applications such as deep learning systems, where a large amount of DRAM is required, DRAM refresh power contributes to a considerable portion of total system power. With the growth in deep learning workloads, this is set to get worse. In this work, we present a zero-cycle bit-masking (ZEM) scheme that exploits the asymmetry of retention failures, to eliminate DRAM refresh in the inference of convolution neural networks, natural language processing, and the image generation based on generative adversarial network. Through careful analysis, we derive a bit-error-rate (BER) threshold that does not affect the accuracy of inference. Our proposed architecture, along with the techniques involved, are applicable to all types of DRAMs. Our results on 16Gb devices show that ZEM can improve the performance by up to 17.31% while reducing the total energy consumed by DRAM by up to 43.03%, dependent on the type of DRAM.

show abstract