Apparatus, system, and method for resetting row hammer detector circuit based on self-refresh command

Abstract

The present application relates to apparatus, systems, and methods for row hammer detector circuit reset. A row hammer detector circuit includes a hash circuit configured to store a hash key and provide a first count value based on a hash between the hash key and a row address corresponding to a row of memory cells of a memory array. The row hammer detector circuit is configured to provide a match signal to cause a targeted refresh of a victim row adjacent to the row of memory cells in response to the count value exceeding a threshold. In response to an exit from a self-refresh mode, the hash circuit is configured to update the stored hash key with a new hash key.

Description

TECHNICAL FIELD

[0001] The present disclosure relates generally to semiconductor devices, and more specifically to semiconductor memory devices. BACKGROUND

[0002] In particular, the present disclosure relates to volatile memory, such as dynamic random access memory (DRAM). Information can be stored on individual memory cells of a memory as physical signals (e.g., charge on a capacitive element). The memory can be volatile memory, and the physical signals can decay over time, which can degrade or destroy the information stored in the memory cells. It can be necessary to restore the physical signals to an initial value by, for example, rewriting the information in the memory cells to periodically refresh the information.

[0003] As memory component sizes decrease, memory cell density greatly increases. Repeated access to a particular memory cell or group of memory cells, commonly referred to as 'row hammering,' can cause an increased rate of degradation of data in nearby memory cells. Memory cells affected by row hammering effects can be identified and refreshed as part of a targeted refresh operation. SUMMARY

[0004] Embodiments of the present disclosure provide an apparatus comprising: a row hammer detector circuit comprising: a hash circuit configured to store a hash key and provide a first count value based on a hash between the hash key and a row address corresponding to a row of memory cells of a memory array, wherein the row hammer detector circuit is configured to provide a match signal to cause a targeted refresh of a victim row of rows adjacent to the memory cells in response to the count value exceeding a threshold, wherein in response to exiting from a self-refresh mode, the hash circuit is configured to update the stored hash key with a new hash key.

[0005] Another embodiment of the present disclosure provides an apparatus comprising: a memory array comprising a plurality of rows of memory cells; a command decoder configured to receive a self-refresh command from a host, wherein the command decoder is configured to enter a self-refresh mode in response to the self-refresh command, wherein when in the self-refresh mode, the command decoder is configured to cause each of the plurality of memory cells to refresh and ignore memory access requests, wherein the command decoder is configured to exit the self-refresh mode in response to a self-refresh exit command from the decoder; and a row hammer detector circuit configured to cause targeted refresh of a victim row of memory cells of a plurality of rows of memory cells of the memory cell in response to detecting a row hammer attack based on a hash between a hash key and addresses of memory cells of an aggressor row of the plurality of memory cells corresponding to a victim row adjacent to the memory cell, wherein the row hammer detector circuit is configured to update the hash key with a new hash key in response to exiting from the self-refresh mode.

[0006] Yet another embodiment of the present disclosure provides a method comprising: receiving a self-refresh exit command at a memory from a host while in a self-refresh mode; causing the memory to exit the self-refresh command in response to receiving a self-refresh exit command from the host; and causing a hash key of a row hammer detector circuit of the memory to be updated with a new hash key in response to exiting from the self-refresh mode. BRIEF DESCRIPTION OF DRAWINGS

[0007] Figure 1 is a block diagram of a memory system according to an embodiment of the present disclosure.

[0008] Figure 2 is a block diagram of a semiconductor device according to an embodiment of the present disclosure.

[0009] Figure 3 is a block diagram of a refresh control circuit according to an embodiment of the present disclosure.

[0010] Figure 4 is a block diagram of an aggressor detector circuit according to an embodiment of the present disclosure.

[0011] Figure 5 is a block diagram of a hash circuit according to an embodiment of the present disclosure.

[0012] Figure 6 is a block diagram of a method of resetting a row hammer detector circuit according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0013] This application describes examples of operations for a memory to update a hash key used in row hammer detector circuitry in response to receiving a self-refresh command from a memory controller. Generally, in response to receiving a command from a memory controller to perform a self-refresh (e.g., a self-refresh command), the memory can enter a self-refresh mode or state (e.g., or an idle mode or state) and perform a refresh operation on all rows of one or more banks of a memory cell array of the memory. In some examples, the self-refresh command can identify a bank of a memory cell array on which to perform a self-refresh operation. In some examples, the self-refresh command can indicate a self-refresh of all rows of a memory cell array. While in the self-refresh mode, the memory can stop performing access operations corresponding to memory access requests (e.g., read or write requests). Upon exiting the self-refresh mode, the memory can resume memory access operations in response to access requests received from the memory controller.

[0014] In volatile memory, information can be stored by placing a charge across a capacitive element in a memory cell. Over time, the charge across the capacitive element in a memory cell can decay; thus causing the information to be lost if enough charge has dissipated. To prevent information from being lost or corrupted due to this decay, the memory can implement a refresh operation. During a refresh operation, information can be rewritten to a word line to restore the cell to its initial state. Generally, the memory can perform two types of refresh operations, such as an auto-refresh operation or a self-refresh operation. The type of refresh operation can be determined based on a command received from a memory controller (e.g., an auto-refresh command or a self-refresh command).

[0015] An auto-refresh operation is a background refresh operation in which refresh operations of individual rows of memory cells are interleaved with performing normal access operations (e.g., read and write operations). That is, during an auto-refresh operation, the memory intermittently refreshes a number of rows of memory cells of a memory array in a systematic manner while remaining available to perform normal access operations. An auto-refresh operation can be performed on the word lines of the memory in a sequence such that over time each of the word lines of the memory are refreshed at a faster rate than an expected data degradation rate.

[0016] A self-refresh operation can include the memory entering a dedicated self-refresh mode (or idle mode) in which each row of one or more banks of a memory array is refreshed. While in the self-refresh mode, the memory can not be available to perform normal access operations (e.g., the memory is effectively offline).

[0017] Repeated accesses (e.g., row hammering) to a particular row of memory (e.g., an aggressor row) can cause an increase in the rate of decay in rows (e.g., victim rows) that are close to or adjacent to the aggressor row. These repeated accesses can be part of a deliberate attack on the memory and / or can be due to a 'natural' access pattern of the memory. The increase in the rate of decay in the victim rows can require that the rows be refreshed earlier than normal to avoid loss of stored data. When the memory detects a row hammering attack, it can perform targeted refresh operations for one or more victim rows instead of automatic refresh operations.

[0018] The memory can detect a row hammering attack based on repeated accesses to an aggressor row that are performed at a very high rate. In some examples, a row hammering detector circuit (e.g., an aggressor detector circuit) of the memory can include one or more hash circuits having varying bit sizes (e.g., number of bits in a hash key) that are each configured to hash a received row address with a respective hash key. That is, the row hammering detector circuit can include a first hash circuit configured to hash a row address into an n-bit hash using an n-bit hash key and a second hash circuit configured to hash the row address into an m-bit hash using an m-bit hash key. The row hammering detector circuit can change a first count value associated with values of the n-bit hash and a second count value associated with values of the m-bit hash. Based on the values of these counts, the row hammering detector circuit can determine whether the row address is suspected of a row hammering attack.

[0019] The respective size of the hash circuit is less than the number of bits of the row address. Because the hash circuit uses fewer bits than the row address, hashing of the row address can result in collisions, where multiple addresses can be associated with the same hash value, e.g., the same count value. Thus, if the hash key is known, an attacker can circumvent row hammer detection by sending access requests with row address combinations that evade detection. To slow down hash key detection, the memory can include one or more random number generators to generate the hash key. Typically, the hash key can be generated during a power cycle or reset of the memory. However, in some applications, the memory can remain operational for a long period of time without a power cycle or reset, which provides an opportunity for an attacker to determine the hash key. Thus, in some examples, the memory can be configured to reset the hash key in response to a self-refresh operation. For example, the memory can be configured to reset the hash key in response to entering a self-refresh mode or upon exiting a self-refresh mode. The hash key can be updated by obtaining a new hash key from the one or more random number generators. In some examples, to ensure that the hash key value is not updated periodically within a preset period of time, the memory controller can issue at least one self-refresh command within a predetermined period of time, e.g., at least once an hour, once every 6 hours, once every 12 hours, once a day, once within a predetermined number of days, once a week, once a month, etc. Forcing the hash key to be updated at predetermined time intervals can mitigate an attacker’s ability to discover the hash key for exploiting the hash circuit and circumventing row hammer attack detection.

[0020] The following description of certain embodiments is merely exemplary in nature and is in no way intended to limit the scope or application of the disclosure. In the following detailed description of embodiments of the present systems and methods, reference is made to the accompanying drawings that form a part hereof, and in which are shown by way of illustration specific embodiments in which the described systems and methods can be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice presently disclosed systems and methods, and it is to be understood that other embodiments can be utilized and that structural and logical changes can be made without departing from the spirit and scope of the present disclosure. Furthermore, the following detailed description is presented in terms of specific embodiments directed to applying the principles of the present disclosure. As such, this detailed description is not intended to limit the scope of the present disclosure, and it is to be understood that other embodiments can be utilized and that structural and logical changes can be made without departing from the spirit of the present disclosure. The following detailed description is presented primarily for the purposes of providing examples and illustrating best modes of practicing the present disclosure, as well as to enable others skilled in the art to be able to practice the present disclosure in various embodiments, and it is to be understood that the description is not limiting of the present disclosure in any way.

[0021] Figure 1 is a block diagram of a memory system 100 in accordance with embodiments of the present disclosure. The memory system 100 can include a host controller 104 configured to communicate with a memory 110 via a command and address bus C / A. Figure 1 The memory system 100 depicted in the figures is simplified for clarity, and it should be appreciated that both the host controller 104 and the memory 110 will include additional circuitry without departing from the scope of the present disclosure.

[0022] The host controller 104 can include control logic 106 and a self-refresh timer 108. The control logic 106 can include input / output circuitry configured to provide commands and addresses to the memory 110 to cause the memory 110 to perform various operations such as access operations, refresh operations, etc. In some examples, the control logic 106 can be configured to issue a self-refresh command to the memory 110 based on the self-refresh timer 108 at some minimum interval. The minimum interval can include at least once an hour, at least once every 6 hours, at least once every 12 hours, at least once a day, at least once in a predetermined number of days, at least once a week, at least once a month, or some other minimum interval, etc.

[0023] The self-refresh timer 108 can be configured to provide a timeout signal after expiration of a predetermined period based on the minimum interval after being reset by the control logic 106 via a reset signal. In some examples, the control logic 106 can provide the self-refresh command prior to receiving the timeout signal. In some examples, the control logic 106 can reset the self-refresh timer 108 at any time the self-refresh command is provided.

[0024] The memory 110 can include a volatile memory device such as a DRAM device integrated on a single semiconductor chip. The memory 110 can include a random number generator 112, a row hammer detector circuit 114, and a memory array 116. The memory 110 can be configured to receive a command via the C / A bus that causes it to perform one or more refresh operations as part of a self-refresh mode or an auto-refresh mode. An auto-refresh mode is a background refresh mode in which rows of the memory array 116 are refreshed intermittently with the performance of memory access operations. A self-refresh mode is a refresh mode in which the memory 110 is taken offline to refresh all rows of one or more banks of the memory array 116. In some embodiments, the memory 110 can enter a self-refresh mode in response to a self-refresh command or signal received from a memory controller (not shown) via the C / A bus.

[0025] When in the auto-refresh mode, the row hammer detector circuit 114 is configured to detect a row hammer attack based on a pattern of repeatedly accessing aggressive rows at a very high rate. In some examples, the row hammer detector circuit 114 can include one or more hash circuits having varying bit sizes (e.g., number of bits in a hash key), each configured to hash a received row address with a respective hash key. That is, the row hammer detector circuit 114 can include a first hash circuit configured to hash a row address into an n-bit hash using an n-bit hash key and a second hash circuit configured to hash the row address into an m-bit hash using an m-bit hash key. The row hammer detector circuit 114 can change a first count value associated with a value of the n-bit hash and a second count value associated with a value of the m-bit hash. Based on these count values, the aggressor detector circuit can determine whether a row address is suspected of a row hammer attack.

[0026] The respective sizes of the hash circuits are less than the number of bits of the row address. Because the hash circuits use fewer bits than the row address, hashing of the row address can result in collisions, where multiple addresses can be associated with the same hash value (e.g., the same count value). Thus, if the hash key is known, an attacker can evade row hammer detection by sending access requests with row address combinations that evade detection. To mitigate hash key detection, the memory 110 can include one or more random number generators 112 that generate the hash key. The random number generator 112 can use a seed value to initiate generation of the hash key. In some examples, the seed value can be the last received row address, a value programmed in a mode register or a fuse storage, or some other value.

[0027] In general, the random number generator 112 can generate the hash key during a power-up sequence or after the memory 110 is reset. However, in some applications, the memory 110 can remain operational for a long period of time without a power cycle or reset, which provides an opportunity for an attacker to determine the hash key. Thus, in some examples, the memory 110 can cause the random number generator 112 and the row hammer detector circuit 114 to generate and implement a new key hash in response to a self-refresh exit command received from the host controller 104. Because a reset of the hash key can result in the count values being reset, performing a reset after exiting the self-refresh mode can mitigate any previously ongoing row hammer attacks, as each row will have recently been refreshed. In some other examples, the random number generator 112 can reset the hash key in response to entering the self-refresh mode, rather than after exiting the self-refresh mode.

[0028] Figure 2is a block diagram of a semiconductor device according to embodiments of the present disclosure. The semiconductor device 200 can be a semiconductor memory device, such as a DRAM device integrated on a single semiconductor chip. In some examples, the semiconductor device 200 can implement the memory 110. The semiconductor device 200 can include a clock input circuit 212, an internal clock generator 214, a command address input circuit 202, an address decoder 204, a command decoder 206, a plurality of row decoders 208, a memory cell array 218 including sense amplifiers and pass gates, a plurality of column decoders 210, a plurality of read / write amplifiers 220, an input / output (I / O) circuit 222, a refresh control circuit 216, a random number generator 230, and a voltage generator 224. The semiconductor device 200 can include a plurality of external terminals including address and command terminals coupled to a command / address bus, clock terminals CK and / CK, data terminals DQ and DQS, power supply terminals VDD and VSS.

[0029] The semiconductor device 200 includes a memory cell array 218. The memory cell array 218 can be shown to include a plurality of memory banks. In Figure 2 embodiments, the memory cell array 218 is shown to include 8 memory banks BANK0 to BANK7. More or fewer banks can be included in the memory cell array 218 of other embodiments. Each memory bank includes a plurality of word lines WL, a plurality of bit lines BL, and a plurality of memory cells MC arranged at intersections of the plurality of word lines WL and the plurality of bit lines BL. Selection of the word lines WL is performed by the row decoders 208, and selection of the bit lines BL is performed by the column decoders 210. In Figure 2 embodiments, the row decoders 208 include a respective row decoder for each memory bank, and the column decoders 210 include a respective column decoder for each memory bank. The bit lines BL are coupled to respective sense amplifiers (SAMP). Data read from the bit lines BL is amplified by the sense amplifiers SAMP and transferred to the read / write amplifiers through complementary local data lines (LIOT / B), pass gates (TG), and complementary main data lines (MIOT / B) coupled to the read / write amplifiers 220. Conversely, write data output from the read / write amplifiers 220 is transferred to the sense amplifiers SAMP through the complementary main data lines MIOT / B, pass gates TG, and complementary local data lines LIOT / B, and written in the memory cells MC coupled to the bit lines BL.

[0030] The semiconductor device 200 can employ a plurality of external terminals including command and address (C / A) terminals coupled to command and address buses to receive commands and addresses, a CS signal, clock terminals to receive a clock CK and / CK, data terminals DQ to provide data, and power supply terminals to receive power supply potentials VDD, VSS, VDDQ, and VSSQ.

[0031] The clock terminals are supplied with external clocks CK and / CK provided to the input circuit 212. The external clocks can be complementary. The input circuit 212 generates an internal clock ICLK based on the CK and / CK clocks. The ICLK clock is provided to the command decoder 206 and the internal clock generator 214. The internal clock generator 214 provides various internal clocks LCLK based on the ICLK clock. The internal clocks LCLK can be used for timing operations of various internal circuits. The internal clocks LCLK are provided to the input / output circuit 222 to time operations of circuits included in the input / output circuit 222, e.g., to a data receiver to time reception of write data.

[0032] The C / A terminals can be supplied with memory addresses. The memory addresses supplied to the C / A terminals are passed to the address decoder 204 via the command address input circuit 202. The address decoder 204 receives the addresses and supplies a decoded row address XADD to the row decoder 208 and a decoded column address YADD to the column decoder 210. The address decoder 204 can also supply a decoded bank address BADD, which can indicate a bank of the memory cell array 218 containing the decoded row address XADD and column address YADD. The C / A terminals can be supplied with commands. Examples of commands include timing commands for controlling timing of various operations, access commands for accessing the memory (e.g., read commands for performing read operations and write commands for performing write operations), as well as other commands and operations. An access command can be associated with one or more row addresses XADD, column addresses YADD, and bank addresses BADD to indicate memory cells to be accessed.

[0033] The commands can be provided as internal command signals to the command decoder 206 via the command address input circuit 202. The command decoder 206 includes circuitry that decodes the internal command signals to generate various internal signals and commands for performing operations. For example, the command decoder 206 can provide row command signals to select word lines and column command signals to select bit lines.

[0034] The device 200 can receive an access command as a read command. When a read command is received and a bank address, a row address, and a column address are supplied timely with the read command, read data is read from the memory cells in the memory cell array 218 corresponding to the row address and the column address. The read command is received by the command decoder 206, which provides internal commands so that the data read from the memory cell array 218 is provided to the read / write amplifiers 220. The read data is output from the data terminals DQ to the outside via the input / output circuit 222.

[0035] The device 200 can receive an access command as a write command. When a write command is received and a bank address, a row address, and a column address are supplied timely with the write command, write data supplied to the data terminals DQ is written to the memory cells in the memory cell array 218 corresponding to the row address and the column address. The write command is received by the command decoder 206, which provides internal commands so that the write data is received by the data receivers in the input / output circuit 222. A write clock can also be provided to the external clock terminals for timing the reception of the write data by the data receivers of the input / output circuit 222. The write data is supplied to the read / write amplifiers 220 via the input / output circuit 222 and supplied by the read / write amplifiers 220 to the memory cell array 218 for writing into the memory cells MC.

[0036] The semiconductor device 200 can also receive a command that causes it to perform one or more refresh operations as part of a self-refresh mode or an auto-refresh mode. The auto-refresh mode is a background refresh mode in which the rows of the memory cell array 218 are refreshed intermittently with the performance of memory access operations. The self-refresh mode is a refresh mode in which the semiconductor device 200 is taken offline to refresh all of the rows of one or more banks BANK0-7 of the memory cell array 218. In some embodiments, the semiconductor device 200 can enter the self-refresh mode in response to a self-refresh command or signal received from a memory controller (not shown) via the C / A bus. In some embodiments, the command decoder 206 can activate the refresh signal AREF in response to entering the self-refresh mode or the auto-refresh mode. That is, the refresh signal AREF can be a pulsed signal that is activated when the command decoder 206 receives a self-refresh command indicating entry into the self-refresh mode or an auto-refresh command indicating entry into the auto-refresh mode.

[0037] With respect to self-refresh mode, upon entering self-refresh mode, command decoder 206 can activate refresh signal AREF immediately, and thereafter periodically, with desired internal timing. Refresh signal AREF can be used to control the timing of refresh operations during self-refresh mode. Thus, refresh operations can continue automatically. In response to receipt of a self-refresh exit command received from a memory controller, semiconductor device 200 can exit self-refresh mode. In response to exiting self-refresh mode, command decoder 206 can stop the automatic activation of refresh signal AREF and can issue a self-refresh exit signal SREF EXIT. Refresh signal AREF can be supplied to refresh control circuit 216 and row decoder 208, and SREF EXIT signal can be supplied to refresh control circuit 216, row decoder 208, and random number generator 230.

[0038] In self-refresh mode or auto-refresh mode, refresh control circuit 216 supplies refresh row address RXADD to row decoder 208, which can refresh one or more word lines WL indicated by refresh row address RXADD. In some embodiments, refresh row address RXADD can represent a single word line. In some embodiments, refresh row address RXADD can represent multiple word lines, which can be refreshed sequentially or simultaneously by row decoder 208. In some embodiments, the number of word lines represented by refresh row address RXADD can vary from refresh address to refresh address. Refresh control circuit 216 can control the timing of refresh operations, and can generate and provide refresh row address RXADD. Refresh control circuit 216 can be controlled to vary the details of refresh row address RXADD (e.g., how refresh addresses are calculated, the timing of refresh addresses, the number of word lines represented by the addresses), or can operate based on internal logic.

[0039] When in auto-refresh mode, refresh control circuit 216 can selectively output a target refresh address (e.g., which specifies one or more victim rows based on an aggressor row) or an auto-refresh address (e.g., from an auto-refresh address sequence) as refresh row address RXADD. Based on the type of refresh row address RXADD, row decoder 208 can perform a target refresh or an auto-refresh operation. In some embodiments, an aggressor address can be determined based on a sampled and / or stored address. For example, a comparison between a sampled address and a stored address can be used to update a count value (e.g., an access count) associated with the stored address, and an aggressor address can be calculated based on the count value. Refresh row address RXADD can then be used based on the aggressor address.

[0040] While the present disclosure generally relates to determining aggressor word lines and victim word lines and addresses, it should be understood that, as used herein, an aggressor word line does not necessarily need to cause data degradation in adjacent word lines, and a victim word line does not necessarily need to suffer such degradation. The refresh control circuit 216 can use some criteria to determine whether an address is an aggressor address, which can capture potential aggressor addresses rather than definitively determining which addresses cause data degradation in nearby victim addresses. For example, the refresh control circuit 216 can determine potential aggressor addresses based on a pattern of accesses to the addresses and such criteria can include some addresses that are not aggressor addresses and can miss some addresses that are aggressor addresses. Similar victim addresses can be determined based on which word lines are expected to be affected by the aggressor word line, rather than definitively determining which word lines are experiencing increased rates of data decay.

[0041] The refresh control circuit 216 can include an aggressor detector circuit configured to detect a row hammer attack based on a pattern of repeatedly accessing an aggressor row at a rate that is too high. In some examples, the aggressor detector circuit can include one or more hash circuits having varying bit sizes (e.g., number of bits in a hash key) that are each configured to hash a received row address with a respective hash key. That is, the aggressor detector circuit can include a first hash circuit configured to hash a row address into an n-bit hash using an n-bit hash key and a second hash circuit configured to hash the row address into an m-bit hash using an m-bit hash key. The aggressor detector circuit can vary a first count value associated with values of the n-bit hash and a second count value associated with values of the m-bit hash. Based on the values of these counts, the aggressor detector circuit can determine whether the row address is suspected of a row hammer attack.

[0042] The respective sizes of the hash circuits are less than the number of bits of the row address. Because the hash circuits use fewer bits than the row address, hashing of the row address can result in collisions, where multiple addresses can be associated with the same hash value (e.g., the same count value). Thus, if the hash key is known, an attacker can evade row hammer detection by sending access requests with combinations of row addresses that evade detection. To mitigate hash key detection, the semiconductor device 200 can include one or more random number generators 230 that generate the hash key. The random number generators 230 can use a seed value to initiate generation of the hash key. In some examples, the seed value can be the last received row address, a value programmed in a mode register or a blow mode of a fuse memory bank, or some other value.

[0043] In general, the random number generator 230 can generate the hash key during a power-up sequence or after the semiconductor device 200 is reset. However, in some applications, the semiconductor device 200 can remain operational for a long period of time without a power cycle or reset, which provides an opportunity for an attacker to determine the hash key. Accordingly, in some examples, the random number generator 230 and the intrusion detector circuit of the refresh control circuit 216 can be configured to generate and implement a new hash key in response to the SREF EXIT signal. Because a reset of the hash key can cause the count value to be reset, performing a reset after exiting from self-refresh mode can mitigate any previously persistent row hammer attacks, since each row will have been recently refreshed. In some other examples, the random number generator 230 can reset the hash key in response to entering self-refresh mode, rather than after exiting from self-refresh mode.

[0044] In some examples, to ensure that the hash key value is not updated periodically within a preset period of time, the memory controller can issue at least one self-refresh command within a predetermined period of time, such as at least once an hour, once every 6 hours, once every 12 hours, once a day, once within a predetermined number of days, once a week, once a month, etc. Forcing the hash key to be updated at predetermined time intervals can mitigate an attacker's ability to discover the hash key for exploiting the hash circuit and evading row hammer attack detection.

[0045] As used herein, activation of a signal can involve any portion of the waveform of the signal to which a circuit responds. For example, if a circuit responds to a rising edge, then a switch from a low level to a high level of the signal can be an activation. One example type of activation is a pulse, in which the signal switches from a low level to a high level for a period of time, and then back to a low level. This can trigger a circuit that is at a high logic level in response to a rising edge, a falling edge, and / or a signal.

[0046] The power supply terminals are supplied with power supply potentials VDD and VSS. The power supply potentials VDD and VSS are supplied to an internal voltage generator 224. The internal voltage generator 224 generates various internal potentials VPP, VOD, VARY, VPERI, and the like, based on the power supply potentials VDD and VSS supplied to the power supply terminals. The internal potential VPP is primarily used in the row decoder 208, the internal potentials VOD and VARY are primarily used in sense amplifiers SAMP included in the memory cell array 218, and the internal potential VPERI is used in many other peripheral circuit blocks.

[0047] The power supply terminals are also supplied with power supply potentials VDDQ and VSSQ. The power supply potentials VDDQ and VSSQ are supplied to the input / output circuit 222. In embodiments of the present disclosure, the power supply potentials VDDQ and VSSQ supplied to the power supply terminals can be the same potentials as the power supply potentials VDD and VSS supplied to the power supply terminals. In another embodiment of the present disclosure, the power supply potentials VDDQ and VSSQ supplied to the power supply terminals can be different potentials from the power supply potentials VDD and VSS supplied to the power supply terminals. The power supply potentials VDDQ and VSSQ supplied to the power supply terminals are used for the input / output circuit 222 so that power supply noise generated by the input / output circuit 222 does not propagate to other circuit blocks.

[0048] Figure 3 is a block diagram of a refresh control circuit 300 according to embodiments of the present disclosure. In some embodiments, the refresh control circuit 316 can be included in Figure 1 The refresh control circuit 316 of the refresh control circuit memory array 116 is shown. Particular internal components and signals of the refresh control circuit 316 are shown to illustrate the operation of the refresh control circuit 316. Dotted lines 318 are shown to represent that in particular embodiments, each of the components (e.g., the refresh control circuit 316 and the row decoder 308) can correspond to a particular memory bank, and these components can be repeated for each of the banks of memory. Thus, there can be multiple refresh control circuits 316 and row decoders 308. For the sake of brevity, components for only a single bank will be described.

[0049] The DRAM interface 326 can provide one or more signals to the address refresh control circuit 316 and the row decoder 308. The refresh control circuit 316 can include a sample timing circuit 330, an aggression detector circuit 332, a row hammer refresh (RHR) state control circuit 336, and a refresh address generator 334. The DRAM interface 326 can provide one or more control signals, such as a refresh signal AREF, a self-refresh exit signal SREF EXIT, an activate signal ACT, and a precharge signal Pre, and a row address XADD. When the bank associated with the refresh control circuit 316 is in a refresh mode, the refresh control circuit 316 provides a refresh row address RXADD with timing based on the refresh signal AREF. The refresh control circuit can also provide a refresh row address RXADD (and other signals) based on the access pattern to the bank of memory to indicate that an emergency target refresh should be performed.

[0050] In Figure 3In example embodiments, the aggressor detector circuit 332 can sample the current row address XADD in response to activation of an optional sample signal Arm Sample provided by the sample timing circuit 330. The aggressor detector circuit 332 can be coupled to all row addresses XADD sent along the row address bus, but can only receive (e.g., process, attend to) the current value of the row address XADD when there is activation of the sample signal Arm Sample. In other example embodiments, sampling can not be used.

[0051] In some examples, the aggressor detector circuit 332 can include one or more hash circuits having varying bit sizes (e.g., number of bits in the hash key), each configured to hash a received row address with a respective hash key in response to the Arm Sample signal. That is, the aggressor detector circuit 332 can include a first hash circuit configured to hash a row address into an n-bit hash using an n-bit hash key, and a second hash circuit configured to hash the row address into an m-bit hash using an m-bit hash key. The aggressor detector circuit 332 can change a first count value associated with the value of the n-bit hash and a second count value associated with the value of the m-bit hash. Based on the values of these counts, the aggressor detector circuit 332 can determine whether the row address is suspected of a row hammer attack. In response to detecting a row hammer attack, the aggressor detector circuit 332 can provide a matched aggression HitXADD signal.

[0052] The respective sizes of the hash circuits are less than the number of bits of the row address. Because the hash circuits use fewer bits than the row address, hashing of the row address can result in collisions, where multiple addresses can be associated with the same hash value (e.g., the same count value). Thus, if the hash key is known, an attacker can circumvent row hammer detection by sending access requests with row address combinations that circumvent detection. To mitigate hash key detection, the random number generator 339 can generate a hash key using a random number. The random number generator 339 can use a seed value to initiate generation of the hash key. In some examples, the seed value can be the last received row address, a value programmed in a mode register or fuse storage, or some other value.

[0053] In general, the random number generator 339 can generate a hash key during a power-up sequence or after the semiconductor device 200 is reset. Additionally, the random number generator 339 and the aggressor detector circuit 332 can be configured to generate and implement a new hash key in response to the SREF EXIT signal. Because a reset of the hash key can result in the count values being reset, performing a reset after exiting from self-refresh mode can mitigate any previously ongoing row hammer attacks, as each row will have recently been refreshed. In some other examples, the random number generator 339 can reset the hash key in response to entering self-refresh mode, rather than after exiting from self-refresh mode.

[0054] In some instances, to ensure that the hash key value is updated periodically within a preset time period, the memory controller may issue at least one self-refresh command within the predetermined time period, such as at least once per hour, once every 6 hours, once every 12 hours, once a day, once within a predetermined number of days, once a week, once a month, etc. Forcing the hash key to be updated at predetermined time intervals can reduce the ability of attackers to discover the hash key and exploit the hash circuit, as well as evade hammer attack detection.

[0055] RHR state control circuit 336 can provide a signal RHR to indicate that a row hammer refresh (e.g., a refresh corresponding to a victim row that has been identified as an aggressor row) should occur. RHR state control circuit 336 can also provide an internal refresh signal IREF to indicate that an automatic refresh should occur.

[0056] In response to RHR or IREF activation, refresh address generator 334 can provide a refresh row address RXADD, which can be an auto-refresh address or one or more victim addresses corresponding to the victim row of the invading row that matches the invading address HitXADD. RHR state control circuit 336 can provide a set of RHR and IREF activations in response to refresh signal AREF. Row decoder 308 can perform a refresh operation in response to refresh row address RXADD and row hammer refresh signal RHR. Row decoder 308 can perform an auto-refresh operation based on refresh row address RXADD and internal refresh signal IREF.

[0057] DRAM interface 326 may represent one or more components that provide signals to a memory bank. In some embodiments, DRAM interface 326 may represent a connection to a semiconductor memory device (e.g., Figure 2 The memory controller of the semiconductor device 200. In some embodiments, the DRAM interface 326 may represent, for example, Figure 2 The DRAM interface 326 comprises the command address input circuit 202, the address decoder 204, and / or the command decoder 206. The DRAM interface 326 provides the row address XADD, the refresh signal AREF, and access signals such as the activation signal ACT and the precharge signal Pre. Although Figure 3The bank address BADD is not shown, but the DRAM interface 326 can also provide a bank address BADD, which can indicate in which bank the accessed row address XADD is located. The bank address BADD can activate the particular refresh control circuit 316 associated with the bank indicated by the bank address BADD. The DRAM interface can also place the refresh control circuit in the refresh mode by providing activation of the refresh signal AREF. The refresh signal AREF can be a periodic signal provided during the refresh mode, which can indicate the timing for the refresh operation. The access signal can be provided as part of the access operation along with the row address XADD. The activate signal ACT can be provided to activate a given bank of the memory. The precharge signal Pre can be provided to precharge a given bank of the memory. The row address XADD can be a signal that includes a number of bits, which can be transmitted serially or in parallel, and can correspond to a particular row of the activated memory bank.

[0058] In Figure 3 In example embodiments, the refresh control circuit 316 uses sampling to monitor a portion of the row address XADD provided along the row address bus. Thus, instead of responding to each row address, the refresh control circuit 316 can sample the current value of the row address XADD on the row address bus, and can determine which addresses are aggressor addresses based on the sampled row address. The timing of the sampling by the refresh control circuit 316 can be controlled by the sample timing circuit 330, which provides the sample signal Arm Sample. Each activation of the signal Arm Sample can indicate that the current value of the row address should be sampled. The activation of Arm Sample can be a 'pulse', in which Arm Sample is raised to a high logic level and then returned to a low logic level. The activation of the signal Arm Sample can be provided at a periodic timing, a random timing, a semi-random timing, a pseudo-random timing, or a combination thereof. In some embodiments, the timing of the signal Arm Sample can be based at least in part on one or more other signals, such as the access signal. In other embodiments, sampling can not be used, and the aggressor detector circuit 332 can receive each value of the row address XADD along the row address bus. In such embodiments, the sample timing circuit 330 and the sample signal Arm Sample can be omitted.

[0059] The aggressor detector circuit 332 can receive the row address XADD from the DRAM interface 326 and the Arm Sample from the sample timing circuit 330. The row address XADD on the row address bus can be received as the DRAM interface 326 directs access to the memory cell array (e.g., the memory 302), and the sample timing circuit 330 can provide the signal Arm Sample to indicate that the current value of the row address XADD should be sampled. The aggressor detector circuit 332 can determine whether the current value of the row address XADD is an aggressor address based on the sampled value of the row address XADD. The aggressor detector circuit 332 can provide the signal Aggressor to indicate whether the current value of the row address XADD is an aggressor address. The signal Aggressor can be a 'pulse', in which Aggressor is raised to a high logic level and then returned to a low logic level. The activation of the signal Aggressor can be provided at a periodic timing, a random timing, a semi-random timing, a pseudo-random timing, or a combination thereof. In some embodiments, the timing of the signal Aggressor can be based at least in part on one or more other signals, such as the access signal. In other embodiments, the aggressor detector circuit 332 can receive each value of the row address XADD along the row address bus. In such embodiments, the sample timing circuit 330 and the sample signal Arm Sample can be omitted. Figure 1access operations (e.g., read and write operations) of different rows of the memory cell array 118). Each time the aggressor detector circuit 332 receives an activation (e.g., a pulse) of the signal Arm Sample, the aggressor detector circuit 332 can sample the current value of XADD.

[0060] The aggressor detector circuit 332 can determine an aggressor address based on one or more of the sampled row addresses, and then can provide the determined aggressor address as the match address HitXADD. The aggressor detector circuit 332 can include one or more hash circuits configured to store a hash key that is hashed with a received address to provide a hash value. A count value associated with the hash value is updated, and once the count value exceeds a threshold, the aggressor detector circuit 332 can provide the match address HitXADD.

[0061] The memory device can implement a sequence of refresh operations in order to periodically refresh rows of the memory device as part of a refresh mode. The RHR state control circuit 336 can determine whether a given refresh operation is an auto-refresh operation or a target refresh operation. The RHR signal can be generated in order to indicate that the device should refresh a particular target row (e.g., a victim row) rather than an address from an auto-refresh address sequence. The RHR state control circuit 236 can also provide an internal refresh signal IREF that can indicate that an auto-refresh should occur. In some embodiments, the signals RHR and IREF can be generated such that they are not active at the same time (e.g., both are not at a logic high level at the same time). In some embodiments, IREF can be activated for every refresh operation, and unless RHR is also active, an auto-refresh operation can be performed, in which case, a target refresh operation is performed instead. The RHR state control circuit can perform a series of auto-refresh operations and target refresh operations in response to one or more activations of the refresh signal AREF.

[0062] In some embodiments, the refresh control circuit 316 can perform multiple refresh operations in response to each activation of the refresh signal AREF. For example, each time the refresh signal AREF is received, the refresh control circuit 316 can perform K different refresh operations by providing K different refresh row addresses RXADD. Each refresh operation can be referred to as a ‘pump.’ Each of the K different refresh operations can be an auto-refresh operation or a target refresh operation. In some embodiments, the number of target and auto-refresh operations can be constant in each group of pumps in response to an activation of the refresh signal AREF. In some embodiments, it can vary.

[0063] The refresh address generator 334 can receive a row hammer refresh signal RHR and a match address HitXADD. The match address HitXADD can represent an aggressor row. The refresh address generator 334 can determine locations of one or more victim rows based on the match address HitXADD and provide the locations as refresh row addresses RXADD when the signal RHR indicates a target refresh operation. In some embodiments, the victim rows can include rows that are physically adjacent to the aggressor row (e.g., HitXADD+1 and HitXADD-1). In some embodiments, the victim rows can also include rows that are physically adjacent to rows that are physically adjacent to the aggressor row (e.g., HitXADD+2 and HitXADD-2). Other relationships between victim rows and identified aggressor rows can be used in other instances. For example, + / -3, + / -4, and / or other rows can also be refreshed.

[0064] The refresh address generator 334 can determine a value of the refresh row address RXADD based on the row hammer refresh signal RHR. In some embodiments, when the signal RHR is not active, the refresh address generator 334 can provide one of a series of auto-refresh addresses. When the signal RHR is active, the refresh address generator 334 can provide a target refresh address, such as a victim address, as the refresh row address RXADD. In some embodiments, the refresh address generator 334 can count activations of the signal RHR and can provide victim rows that are closer to the aggressor address (e.g., HitXADD + / -1) more frequently than victim rows that are farther from the aggressor address (e.g., HitXADD + / -2).

[0065] The row decoder 308 can perform one or more operations on a memory array (not shown) based on the received signals and addresses. For example, in response to the activation signal ACT and the row address XADD (and IREF and RHR at low logic levels), the row decoder 308 can direct one or more access operations (e.g., read operations) to the specified row address XADD. In response to the RHR signal being active, the row decoder 308 can refresh the refresh row address RXADD.

[0066] Figure 4 is a block diagram of an aggressor detector circuit 400 according to embodiments of the present disclosure. In some embodiments, the aggressor detector circuit 400 can be included in Figure 1 a random number generator 112 of Figure 2 a refresh control circuit 216 of Figure 3 an aggressor detector circuit 332 of or any combination thereof.

[0067] The aggressor detector circuit 400 includes a number of hash circuits 412, 422, and 432, where when a sample signal ArmSample (e.g., as generated by Figure 3Each of the hash circuits 412, 422, and 432 is effective to hash a row address XADD along the row address bus, each time the sample timing circuit 330 provides the signal Arm Sample. Each hash circuit 412, 422, and 432 can change a count value stored in one of the registers of the associated data stack 410, 420, and 430 based on the value of the hash generated by the respective hash circuit 412, 422, and 432. The changed count value (e.g., the count value associated with the row address XADD) can be provided to the count logic 402, which can use the provided count value to determine whether the row address XADD is an aggressor row. If the count logic 402 determines that the row address XADD is an aggressor row, the problem logic 440 can provide an aggressor match signal HitXADD, which can be used to initiate a target row refresh.

[0068] Figure 4 The count logic 402 shows a number of sub-components of each of the count locator 404, the threshold comparator 406, and the count adjuster 408. These sub-components are shown as dashed boxes, and are optional components of the count logic 402. In some embodiments, the dashed sub-components can represent system-level components of the memory that are coupled to the count logic 402. For example, the timer sub-component can be coupled to a clock signal (e.g., ICLK) of the memory. In some embodiments, the sub-components can represent optional features of the aggressor detector circuit 400 and can be enabled / disabled by user settings (e.g., via a mode register setting, via a fuse, etc.). Figure 1

[0069] The aggressor detector circuit 400 includes a number of hash circuits, such as 412, 422, and 432, each of which is associated with a data stack (e.g., 410, 420, and 430), respectively. Since the hash circuits and data stacks can generally be similar to each other, only the first hash circuit 412 and data stack 410 are described in detail for brevity.

[0070] The first hash circuit 412 can be an m-bit hash circuit. In response to the signal Arm Sample being at an active level, the first hash circuit 412 can receive the row address XADD from the row address bus and can convert it to an m-bit hash value. For example, the row address XADD can be a particular number of bits (e.g., 17 bits). The first hash circuit 412 can hash the row address XADD into an m-bit number. The number of bits m can generally be less than the number of bits in the unhashed row address XADD. Thus, multiple values of the row address XADD can be associated with a given value of the m-bit hash.

[0071] The data stack 410 can be any structure capable of storing a number of different count values. For example, the data stack 410 can include a number of registers, each of which can store a count value (e.g., as a binary number). The data stack 410 can hold a number of possible values equal to the m-bit hash value (e.g., 2​m The data stack 410 can include a number of count values (e.g., one count value for each different count value). For example, if the first hash circuit 412 is an 8-bit hash circuit, then the data stack 410 can include 256 different count values. Thus, each count value can be associated with one of the values of the m-bit hash value.

[0072] When the hash circuit 412 receives a row address XADD, it can provide an m-bit hash value associated with the value of the row address XADD. In response to the m-bit hash value, the count value in the data stack 410 associated with that value of the m-bit hash value can be changed (e.g., incremented). In some embodiments, the count value CV0 associated with the value of the m-bit hash (e.g., associated with the row address XADD) can be provided to the count logic 402, which can change the count value CV0 and then rewrite it into the data stack 410.

[0073] The different hash circuits 412, 422, and 432 can be independent of each other. Thus, a given row address can be hashed by the first hash circuit 412 into a first value, and by the second hash circuit 422 into a second hash value. The first hash value and the second hash value are not necessarily the same value (although they can be the same). Since the hash values are used as indices for the count values, this means that each count value can be associated with a set of different row addresses.

[0074] The different hash circuits 412, 422, and 432 can all produce different lengths of hashes. For example, the first hash circuit 412 can be an m-bit hash circuit, the second hash circuit 422 can be an n-bit hash circuit, and the third hash circuit 432 can be an o-bit hash circuit, where m, n, and o are different numbers. Thus, the associated data stacks 410, 420, 430 can hold different numbers of count values. For example, m can be an 8-bit hash and the first data stack 410 can hold 256 count values, n can be 7 and the second data stack 420 can hold 128 different count values, and o can be 6 and the third data stack 430 can hold 64 different count values. In other example embodiments, different lengths of hashes can be used. The use of different hashes means that each count value can be associated with a different number of row addresses.

[0075] Hash circuits 412, 422, and 432 can each receive a corresponding hash key via corresponding hash key signals HASH KEY (0) to (2), which can partially determine the hash value generated in response to the received row address. The hash key can be stored in memory (e.g., in a set of latches, a mode register, etc.) and can be received by hash circuits 412, 422, and 432. In some instances, hash circuits 412, 422, and 432 are configured to update the stored hash key value with the new corresponding hash key value received via the HASH KEY (0) to (2) signals in response to the self-refresh exit signal SREF EXIT. Additionally, all stored count values ​​can be cleared when the hash key is updated.

[0076] Each hash circuit can receive a hash key of length based on the length of the hash value, and can have several hash keys based on the number of bits in the received row address. For example, if the row address is R bits long, then the first hash circuit 412 can receive a first set of hash keys containing R individual keys, each of which is an m-bit binary number. The second hash circuit 422 can receive a second set of hash keys containing R individual keys, each of which is an n-bit binary number. The third hash circuit 432 can receive a third set of hash keys containing R individual keys, each of which is an 0-bit binary number.

[0077] In some embodiments, each set of hash keys may be independent of each other. In some embodiments, one or more individual keys may be shared among several sets of keys, but may be truncated to indicate hash outputs of different lengths. In some embodiments, the hash keys provided on the HASH KEY (0) to (2) signals may be generated by a random number generator (e.g., Figure 1 Random number generator 112 Figure 2 Random number generator 230 and / or Figure 3 A random number generator (339) is provided. For example, the random number generator can generate a hash key based on a seed value.

[0078] In response to row address XADD, each of the data stacks 410, 420, and 430 can provide corresponding count values ​​CV0, CV1, and CV2 to counting logic 402. These count values ​​can be different from each other because each can be associated with a different (and a different number of) values ​​for row address XADD. Counting logic 402's counting adjuster 408 can update the received values, for example, by incrementing them. In some embodiments, the way the counting adjuster 408 changes count values ​​CV0 to CV2 can depend in part on the values ​​of count values ​​CV0 to CV2. For example, count value CV1 can only be changed (e.g., incremented) if the value CV0 is above a threshold (e.g., has reached its maximum value).

[0079] In some embodiments, the count adjuster 408 can periodically change the count values (e.g., decrease them) in different directions. For example, after a set period of time (e.g., a particular number of clock cycles), the count adjuster 408 can change (e.g., decrease) all of the count values stored in the data stacks 410, 420, and 430. In some embodiments, the count adjuster 408 can decrease the count values to a minimum value by resetting them (e.g., to 0).

[0080] The count locator 404 can select one of the received counts, or can synthesize a new value based on the set of count values CV0-CV2. The count locator 404 can use one or more statistical values based on the set of count values CV0-CV2. For example, the count locator 404 can compare the count values CV0-CV2 and take the minimum value. The count locator 404 can also generate a statistical value based on the set of count values, and can for example provide an average or median value of CV0-CV2. In some embodiments, only one of the minimum, median, and average values can be provided. In some embodiments, the user can be able to select which statistical value to use. In some embodiments, all three minimum, median, and average values can be calculated and output by the count locator and can be used separately. Other statistical values can be used in other example embodiments.

[0081] In some embodiments, the count locator 404 can select one of the count values CV0-CV2, rather than using a statistical value. For example, in embodiments where each count value is changed only if the previous count value is above a threshold value (e.g., CV1 is changed if CV0 is greater than a threshold value), a particular count value (e.g., CV2) can be provided by the count locator 404. In some embodiments, which count value is used can change periodically. For example, the count value can be randomly selected.

[0082] The count locator 404 can provide the statistical value (e.g., the minimum value) to the threshold comparator 406. The threshold comparator 406 can compare the received statistical value to a threshold value Thresh. If the threshold comparator 406 determines that the received statistical value is greater than the value Thresh, the count logic 402 can provide a capture signal Capture at a valid level (e.g., a high logic level, a pulse, a rising edge, etc.). In some embodiments, the threshold value can change periodically. For example, the threshold value Thresh can change randomly based on the output of a random number generator RNG.

[0083] The challenge logic 440 can receive the signal Capture. When the signal Capture is valid, the challenge logic 440 can provide a hit signal HitXADD at the output with a value indicating a match.

[0084] Figure 5is a block diagram of a hash circuit 500 according to embodiments of the present disclosure. In some embodiments, the hash circuit 500 can be used as Figure 4 the hash circuits 412, 422, and / or 432 of FIG. 1. Figure 5 The hash circuit 500 represents a simplified view of the operation of a hash circuit in order to explain the general operation of a hash circuit. Hash circuits of the present disclosure can use more complex logic and / or other processes to convert an input signal into a hash.

[0085] Figure 5 The hash circuit 500 is shown as including a random number generator (RNG) 502 (e.g. Figure 1 the random number generator 112 of FIG. 1, Figure 2 the random number generator 230 of FIG. 2, Figure 3 the random number generator 339 of FIG. 3), which can be used to generate a set of hash keys Key based on a seed value Seed. In Figure 5 In embodiments of the present disclosure, the RNG 502 can be included in the hash circuit 500, and the hash circuit can directly receive the seed value Seed in order to generate a set of keys. In some embodiments, the RNG 502 can be a system-level component, and not be included in each individual hash circuit. In some embodiments, the RNG 502 can be omitted, and other methods can be used to generate the keys Key.

[0086] The hash circuit 500 can receive an input value Input, which can be N+1 bits (e.g., Input<0:N>). In some embodiments, the value Input can be a row address. The hash circuit 500 can generate an output value Hash, which can be M+1 bits (e.g., Hash<0:M>). The value M can typically be a smaller number than the value N.

[0087] The RNG 502 generates a set of keys based on the values N and M. Specifically, the RNG 502 generates N+1 keys, each of which is M+1 bits in length. The block 504 can combine each key from the set of keys with a bit of the input value. For example, the input value (e.g., Input Each bit of the Input can be combined with the corresponding one of the keys Kio:Mto produce a Word. So the first bit can be combined with the first key, and so on. In Figure 5 In the example of FIG. 6, AND logic can be used to combine each bit of the Input with the associated key. The length of each word can be M+1 bits, and after combining each bit of the Input with the associated key, there can be a set of N+1 words.

[0088] Block 506 can combine the words together to produce the output Hash. In Figure 5 In the example of FIG. 6, XOR logic can be used to combine all of the words together. Once the words have been combined, the output can be an output value Hash of length M+1 bits.

[0089] Figure 6 is a block diagram of a method of a reset row hammer detector circuit according to embodiments of the disclosure. In some embodiments, the method 600 can be implemented by one or more of the components discussed in Figures 1 to 5 Although the sequence of operations is discussed with respect to the method 600, it should be understood that, in other embodiments, particular operations can be performed in a different order, repeated, and / or omitted. In some embodiments, particular steps can occur at the same time as one another.

[0090] The method 600 can include receiving a self-refresh exit command at a memory from a host while in a self-refresh mode at 610. The method 600 can further include causing the memory to exit the self-refresh mode in response to receiving the self-refresh exit command at 620. The memory can include Figure 1 the memory 110 of FIG. 1, and / or Figure 2 the semiconductor device of FIG. 2.

[0091] The method 600 can further include causing a hash key of a row hammer detector circuit of the memory to be updated with a new hash key in response to exiting the self-refresh mode at 630. The row hammer detector circuit can include Figure 1 the row hammer detector circuit 114 of FIG. 1, Figure 2 the aggressor detector circuit of the refresh control circuit memory array 116 of FIG. 1, Figure 3 the aggressor detector circuit 332 of FIG. 3, Figure 4 the aggressor detector circuit 400 of FIG. 4, or a combination thereof. The hash key can be associated with a hash circuit of the row hammer detector circuit, such as Figure 4 any of the hash circuits 412, 422, or 432 of FIG. 4. In some examples, the method 600 can further include causing a random number generator of the memory to provide the new hash key in response to exiting the self-refresh mode. The random number generator can include Figure 1 the random number generator 112 of FIG. 1, Figure 2 the random number generator 230 of FIG. 2, Figure 3 the random number generator 339 or any combination thereof. In some examples, the hash key and the new hash key each have fewer bits than a row address of the memory.

[0092] In some examples, the method 600 can include entering a self-refresh mode in response to receiving a self-refresh command from a host. The host can include Figure 1 the host controller 104. In some examples, the method 600 can further include stopping read and write access operations to a memory array of the memory in the self-refresh mode. In some examples, the method 600 can further include, while in the self-refresh mode, refreshing each row of memory cells of a bank of the memory array of the memory.

[0093] In some examples, the method 600 can further include, prior to entering the self-refresh mode, causing a targeted refresh of a victim row of memory cells of a memory array of the memory in response to detecting a row hammer attack based on a hash between the hash key and an address of a memory cell corresponding to an aggressor row of a victim row of adjacent memory cells. The memory array can include Figure 1 the memory array 116 and / or Figure 2 the memory cell array 218.

[0094] It should be appreciated that any of the examples, embodiments, or processes described herein can be combined with one or more other examples, embodiments, and / or processes, or can be separated and / or performed alone in separate devices or device portions according to the present systems, devices, and methods.

[0095] In conclusion, the foregoing discussion, which describes examples, embodiments or processes, should not be understood as limiting the claims to any particular embodiment or group of embodiments. Thus, although specific embodiments have been described in some detail, these are not intended to restrict the scope of the application as set out in the claims. It will be appreciated that various modifications can be made to the systems and devices described herein, and that such modifications are intended to fall within the scope of the claims.

Claims

1. A device for operating a memory, comprising: A row hammer detector circuit includes: a hash circuit configured to store a hash key and provide a first count value based on a hash between the hash key and a row address corresponding to a row of a memory cell in a memory array, wherein the row hammer detector circuit is configured to provide a matching signal in response to the count value exceeding a threshold to cause a targeted refresh of a victim row of a row adjacent to the memory cell, wherein in response to exiting a self-refresh mode, the hash circuit is configured to update the stored hash key with a new hash key.

2. The device of claim 1, further comprising a random number generator configured to provide the new hash key in response to exiting the self-refresh mode.

3. The device of claim 1, further comprising the memory array configured to store information in rows of the memory cells.

4. The device of claim 1, further comprising a command decoder configured to exit the self-refresh mode in response to a self-refresh exit command received from the host.

5. The device of claim 4, wherein the command decoder is configured to enter the self-refresh mode in response to a self-refresh command received from the host.

6. The device of claim 1, further comprising the memory array, the memory array including a storage bank containing rows of the memory cells, wherein when in the self-refresh mode, the memory array is configured to refresh each row of the memory cells of the storage bank.

7. The device of claim 1, wherein the hash key has fewer bits than the row address.

8. The device of claim 1, wherein the row hammer detector circuit further includes a second hash circuit configured to store a second hash key and provide a second count value based on a hash between the second hash key and the row address, wherein the row hammer detector circuit is configured to provide the matching signal in response to the second count value exceeding the threshold to cause the target refresh of the victim row of the row adjacent to the memory cell.

9. The device of claim 8, wherein the number of bits of the hash key is different from that of the second hash key.

10. The device of claim 8, wherein in response to exiting the self-refresh mode, the second hash circuit is configured to update the stored second hash key with a second new hash key.

11. A memory device comprising: A memory array comprising multiple rows of memory cells; A command decoder configured to receive a self-refresh command from a host, wherein the command decoder is configured to enter a self-refresh mode in response to the self-refresh command, wherein while in the self-refresh mode, the command decoder is configured to cause each of a plurality of memory cells to be refreshed and memory access requests to be ignored, wherein the command decoder is configured to exit the self-refresh mode in response to a self-refresh exit command from the decoder. and A row hammer detector circuit is configured to cause a target refresh of the victim rows of the plurality of memory cells in response to a row hammer attack detected based on a hash key and the address of the memory cell corresponding to the victim row of the plurality of memory cells adjacent to the victim row of the memory cell, wherein the row hammer detector circuit is configured to update the hash key with a new hash key in response to exiting the self-refresh mode.

12. The memory device of claim 11, wherein the row hammer detector circuitry is configured to detect the row hammer attack based on a count value associated with the hash exceeding a threshold.

13. The memory device of claim 12, wherein the row hammer detector circuit is configured to reset the count value in response to exiting the self-refresh mode.

14. The memory device of claim 11, further comprising a random number generator configured to provide the new hash key.

15. The memory device of claim 11, wherein the plurality of rows of said memory cells comprise volatile memory cells.

16. A method for operating a memory, comprising: When in self-refresh mode, a self-refresh exit command is received from the host at the memory. The memory exits the self-refresh mode in response to receiving a self-refresh exit command from the host. and In response to exiting the self-refresh mode, the hash key of the row hammer detector circuit of the memory is updated with a new hash key.

17. The method of claim 16, further comprising: Before entering the self-refresh mode, a target refresh of the victim row of the memory cell is initiated in response to a row hammer attack detected based on a hash detection between the hash key and the address of the aggressor row of the memory cell corresponding to the victim row of the memory cell in the memory array adjacent to the memory.

18. The method of claim 16, further comprising causing the random number generator of the memory to provide the new hash key in response to exiting the self-refresh mode.

19. The method of claim 16, further comprising entering the self-refresh mode in response to receiving a self-refresh command from the host.

20. The method of claim 16, further comprising stopping read and write access operations of the memory array of the memory in the self-refresh mode.

21. The method of claim 16, further comprising, when in a self-refresh mode, refreshing each row of memory cells of the memory bank of the memory array.

22. The method of claim 16, wherein the hash key and the new hash key each have fewer bits than the row address of the memory.

Images