Trap-Assisted DRAM Row Hammer Effect

RowHammer: A Retrospective

“…A very recent work [254] presents evidence via 3D CAD simulations with single charge traps, that the RowHammer effect is governed by the charge pumping process. The RowHammer effect is exacerbated when charge is captured around an aggressor wordline and carriers migrate to victim wordlines.…”

“…In fact, two of our works experimentally examine read disturb errors in flash memory: 1) our original work in DATE 2012 [42] that provides a rigorous experimental study of error patterns in modern MLC NAND flash memory chips demonstrates the importance of read disturb error patterns, 2) our recent work at DSN 2015 [51] experimentally characterizes the read disturb errors in flash memory, shows that the problem is widespread in recent flash memory chips, and develops mechanisms to correct such errors in the flash memory controller. Even though the mechanisms that cause the bit flips are different in different technologies, the high-level root cause of the problem, cell-tocell interference, due to the fact that the memory cells are too close to each other, is a fundamental issue that appears and will likely continue to appear in any technology that scales down to small enough technology nodes [53,254]. Thus, we should expect such problems to continue as we scale any memory technology, including emerging ones, to higher densities.…”

On DRAM Rowhammer and the Physics of Insecurity

“…Nothing was said about crosstalkinduced failures and victim cells that did not share the same active region as the aggressor cell. Yang and Lin [17] also concentrated on electron injection and migration as the single RH cause. A simulation-based study on electron capture and emission from traps based on the experimental work of Ryu et al [13] showed agreement with published experimental results [16], [18].…”

“…The first describes a collapsing inversion layer associated with the hammered cell transistor where a population of electrons is injected into the p-well as the transistor's gate turns off [16]. The second describes electron injection from charge traps near the silicon/gate dielectric interface of the cell select transistor [13], [17]. Several studies look into techniques for hampering the migration of these injected electrons.…”

“…Fig. 1(c) shows the cross section that is sometimes presented in the literature to study RH or to show the benefit of certain process changes that are claimed to moderate the disturb, namely the one where the aggressor cell shares the same active region as the victim cell [17]- [20]. Fig.…”