DRAM (Dynamic Random Access Memory) line hammering test method and device, electronic equipment and chip

Abstract

The invention relates to the technical field of computers, in particular to a DRAM row hammering test method and device, electronic equipment and a chip, the method is executed in a DRAM controller in a hardware logic mode, and the method comprises the steps that a data writing request for a row to be tested is generated according to a preset data mode, the data writing request is converted into a writing command sequence, and the writing command sequence is sent to DRAM particles; generating an attack request for an attack line according to a preset attack mode, converting the attack request into a line activation and pre-charging command sequence, and sending the line activation and pre-charging command sequence to the DRAM particles; and reading data of the to-be-detected row in the DRAM particles, comparing the data with initially written data to detect whether bit flipping occurs, and determining the row subjected to bit flipping as a damaged row. According to the embodiment of the invention, the test efficiency and reliability can be effectively improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a DRAM row hammer test method and apparatus, electronic equipment and storage medium. Background Technology

[0002] With the rapid development of information technology, data security and storage security have become a focus of social concern. Dynamic Random Access Memory (DRAM), as a widely used semiconductor memory, is widely used in personal computers, servers, mobile devices, and other fields due to its high density and low cost. However, with the development of DRAM technology, especially with the increase in storage density, the security threats facing DRAM are also constantly increasing.

[0003] Row hammer attacks exploit the physical characteristics of DRAM by frequently activating the same or adjacent rows, causing charge leakage and affecting data in other rows, potentially inducing bit flips. This attack method can bypass traditional security mechanisms, causing data tampering and even potentially leading to malicious acquisition of system control, posing a serious threat to data and system security.

[0004] Currently, testing for Row Hammer attacks primarily relies on software implementations. These software testing tools induce bit flips by repeatedly reading and writing adjacent memory rows using specific instruction sequences. However, software attacks are affected by CPU scheduling and cannot directly control physical DRAM access, limiting the success rate of the attack. Furthermore, frequent memory access via software may trigger process crashes and kernel protection mechanisms, impacting system stability. Summary of the Invention

[0005] In view of this, this disclosure proposes a DRAM row hammer test counting method.

[0006] According to one aspect of this disclosure, a DRAM row hammer test method is provided, the method being executed in hardware logic in a DRAM controller, comprising:

[0007] A data write request for the row to be tested is generated according to a preset data pattern, and the data write request is converted into a write command sequence and sent to the DRAM chip;

[0008] An attack request is generated for the attack row according to a preset attack mode, and the attack request is converted into a row activation and precharge command sequence and sent to the DRAM chip.

[0009] The data of the line to be tested in the DRAM chip is read and compared with the data initially written to detect whether a bit flip has occurred. The line where a bit flip has occurred is identified as the victim line.

[0010] In one possible implementation, the preset attack mode includes a one-sided attack mode;

[0011] The step of generating an attack request for the attack line according to a preset attack mode includes:

[0012] Generate repeated row activation and precharge requests for a single attack row.

[0013] In one possible implementation, the preset attack mode includes a two-sided attack mode;

[0014] The step of generating an attack request for the attack line according to a preset attack mode includes:

[0015] Generate alternating row activation and precharge requests for the two attack rows.

[0016] In one possible implementation, the method supports a multi-bank concurrent attack mode, wherein generating an attack request for the attack row according to a preset attack mode and converting the attack request into a row activation and precharge command sequence includes:

[0017] Generate attack requests targeting attack lines in multiple different storage banks;

[0018] The attack request is converted into a time-series, cross-memory interleaved sequence of row activation and precharge commands.

[0019] In one possible implementation, converting the attack request into a row activation and precharge command sequence includes:

[0020] Based on a row hammer attack request targeting a target row in the target memory, a row activation command is generated and sent to the target memory, the row activation command containing the address of the target row;

[0021] After the tRAS time required by the DRAM specification is met, a precharge command is generated and sent to the target memory bank;

[0022] After the tRP time required by the DRAM specification is met, a new row activation command is generated and sent to the same target memory bank to launch the next attack against the same target row.

[0023] In one possible implementation, converting the attack request into a time-sequential, memory-interleaved sequence of row activation and precharge commands includes:

[0024] Based on the attack requests targeting attack rows in multiple different storage banks, multiple sets of row activation and precharge commands are generated and sent to different target storage banks respectively;

[0025] Multiple sets of commands are interleaved and sent in time;

[0026] Among them, the time interval between two consecutive row activation commands sent to any memory bank that meet the tRC timing requirements.

[0027] In one possible implementation, the preset data pattern is a data pattern corresponding to the preset attack pattern, and the process of determining the preset data pattern includes:

[0028] In the preset attack mode, multiple candidate data modes are used to perform attack tests on the DRAM chip respectively. The data of the attack row of the candidate data mode is a first logic value, and the data mode of the row to be tested is a second logic value that is complementary to the first logic value.

[0029] Based on the bit-flipping behavior under the various candidate data patterns, the data pattern that can trigger bit-flipping the fastest is determined as the preset data pattern corresponding to the preset attack pattern.

[0030] In one possible implementation, based on the bit-flipping behavior under the multiple candidate data patterns, the pattern that can induce bit flipping the fastest is determined, including:

[0031] Determine the bit-flipping behavior of multiple candidate data patterns after attack testing;

[0032] Based on the data that triggers bit flipping in each candidate data pattern, the data is configured to obtain the target data pattern that can trigger bit flipping as many bits as possible at the same time, which is the data pattern that can trigger bit flipping the fastest.

[0033] In one possible implementation, the method further includes:

[0034] Receive user configuration instructions via programmable registers to dynamically set at least one of the following parameters:

[0035] Attacking line address, line address to be tested, attack mode type, number of attacks, and the preset data mode.

[0036] In one possible implementation, the method further includes:

[0037] If an attacking line is detected, line hammer defense is performed on the victim line corresponding to the attacking line.

[0038] According to another aspect of this disclosure, a DRAM row hammer test apparatus is provided, the apparatus being executed in hardware logic within a DRAM controller, comprising:

[0039] The data inspection module is used to generate a data write request for the row to be tested according to a preset data pattern, and convert the data write request into a write command sequence and send it to the DRAM chip.

[0040] The attack module is used to generate an attack request for the attack row according to a preset attack mode, and convert the attack request into a row activation and precharge command sequence and send it to the DRAM chip;

[0041] The data inspection module is used to read the data of the line to be tested in the DRAM chip and compare it with the initially written data to detect whether a bit flip has occurred, and to identify the line where a bit flip has occurred as the victim line.

[0042] According to another aspect of this disclosure, a chip is provided, including the aforementioned DRAM row hammer test apparatus.

[0043] According to another aspect of this disclosure, an electronic device is provided, including the chip described above.

[0044] In this embodiment, the DRAM row hammer test method is executed in hardware logic within the DRAM controller. The hardware logic generates data write requests for the row under test, converts these requests into write command sequences, and sends them directly to the DRAM chip. Simultaneously, it generates attack requests for the attack row according to a preset attack mode, converts these requests into row activation and precharge command sequences, and sends them to the DRAM chip. This direct transmission from the DRAM controller to the DRAM chip bypasses CPU scheduling, improving the efficiency and accuracy of the write operation. This not only reduces latency caused by software-level scheduling and address translation but also avoids inefficiencies that may occur in software testing.

[0045] Furthermore, by directly generating and converting command sequences in the DRAM controller, and by having the DRAM controller interact directly with the DRAM chips, a row hammer test based on hardware logic execution was achieved. In this process, the data writing to the test row of the DRAM chip and the attack on the attack row are both executed by the DRAM controller hardware through the generation of command sequences. These command sequences do not require the conversion of virtual addresses to physical addresses through the operating system or memory management unit, thus significantly simplifying programming complexity and improving the efficiency and reliability of the test.

[0046] Furthermore, this method directly reads the data of the row to be tested from the DRAM chip through hardware logic and compares it with the initially written data to detect whether a bit flip has occurred. This avoids data errors caused by excessively long data transmission links during software reading, making the observation of bit flip phenomena more accurate and effectively verifying the defense mechanism. It overcomes the problem of difficulty in accurately observing bit flip phenomena in existing software testing methods, providing DRAM manufacturers and those skilled in the art with a more reliable and intuitive testing method.

[0047] Other features and aspects of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0048] The accompanying drawings, which are included in and form part of this specification, illustrate exemplary embodiments, features, and aspects of this disclosure together with the specification and serve to explain the principles of this disclosure.

[0049] Figure 1 A flowchart illustrating a DRAM row hammer test method according to an embodiment of the present disclosure is shown.

[0050] Figure 2 A flowchart illustrating another DRAM row hammer test method according to an embodiment of the present disclosure is shown.

[0051] Figure 3 The diagram illustrates two attack models according to an embodiment of the present disclosure.

[0052] Figure 4 A block diagram illustrating a DRAM row hammer test according to an embodiment of the present disclosure is shown. Detailed Implementation

[0053] Various exemplary embodiments, features, and aspects of this disclosure will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0054] As used herein, the terms “comprising,” “including,” “having,” or variations thereof are open-ended and include one or more of the stated features, integrals, elements, steps, components, or functions, but do not exclude the presence or addition of one or more other features, integrals, elements, steps, components, functions, or groups thereof.

[0055] When an element is referred to as “connected,” “coupled,” “responding,” or a variation thereof relative to another element, it may be directly connected, coupled, or responding to another element, or there may be an intermediate element present.

[0056] Although the terms first, second, third, etc., may be used herein to describe various elements / operations, these elements / operations should not be limited by these terms. These terms are only used to distinguish one element / operation from another. Therefore, without departing from the teachings of the inventive concept, a first element / operation in some embodiments may be referred to as a second element / operation in other embodiments.

[0057] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0058] Furthermore, to better illustrate this disclosure, numerous specific details are set forth in the following detailed description. Those skilled in the art will understand that this disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of this disclosure.

[0059] Figure 1 A flowchart illustrating a DRAM row hammer test method according to an embodiment of the present disclosure is shown. Figure 1 As shown, the method is executed in hardware logic within a DRAM controller, and the method includes:

[0060] In step S11, a data write request for the row to be tested is generated according to a preset data pattern, and the data write request is converted into a write command sequence and sent to the DRAM chip.

[0061] The method is executed by the DRAM controller, which uses hardware logic to execute the commands. The DRAM controller is directly connected to the DRAM chips and is a key component responsible for managing and controlling the DRAM chips (Dynamic Random Access Memory). It acts as a bridge between the processor (such as a CPU or GPU) and the DRAM chips.

[0062] The preset data pattern is the data arrangement selected before the test begins based on the test requirements. It can be configured by the user. The preset data pattern defines a specific style or sequence of data to be written, aiming to provide a clear comparison benchmark for subsequent bit flip detection by writing known and well-organized data.

[0063] For example, the pattern can be all-zeros, all-ones, hexadecimal 0x55 (which is represented by alternating '01's in binary), hexadecimal 0xAA (which is represented by alternating '10's in binary), or a random number pattern generated by a hardware random number generator. Choosing different data patterns helps to expose Row Hammer sensitivity under different conditions.

[0064] When generating a data write request, a series of write operations are created according to a preset data pattern. These operations target the row under test, which is the row in DRAM that will be attacked and have its bits flipped.

[0065] Data write requests can be translated into a sequence of commands compatible with the DRAM protocol. The DRAM protocol defines the standards for communicating with DRAM chips, including command format and timing requirements. To ensure that data can be correctly received and executed by the DRAM chips, write requests must comply with these protocol requirements. During the translation process, high-level write operations are mapped to low-level commands that the DRAM controller and the chips can understand.

[0066] Specifically, the protocol control logic in the DRAM controller can convert data write requests into a sequence of write commands that conform to DRAM specifications (such as JEDEC DDR / LPDDR / GDDR standards), so that the operation of the data write request meets the interface requirements of the DRAM chip in terms of electrical signals and timing.

[0067] A typical write command sequence includes Activate Target Memory and Row (ACT command), Write command (WR command), and accompanying column address and write data. Additionally, it may include a Precharge command (PRE command) to close the currently open row. This process can follow relevant timing parameters defined in the DRAM specification, such as tRCD (RAS to CAS Delay) and tWR (WriteRecovery time).

[0068] Then, a sequence of write commands conforming to the DRAM protocol is sent to the DRAM chip, which can be the actual dynamic random access memory chip. It receives and executes commands from the controller and accurately writes the specified data pattern into the memory cell of the row to be tested, which is determined by the row address and column address.

[0069] The DRAM controller can communicate directly with the DRAM chip through its internal hardware logic and send commands according to the timing requirements of the DRAM protocol, thereby achieving precise control over the DRAM chip. Specifically, the DRAM controller can be sent to the DRAM chip for execution through the DRAM physical interface (PHY).

[0070] In step S12, an attack request for the attack row is generated according to a preset attack mode, and the attack request is converted into a row activation and precharge command sequence and sent to the DRAM chip.

[0071] Preset attack modes are specific sequences used during testing to simulate Row Hammer attacks. Users can configure these modes according to their testing needs to simulate different attack scenarios. Preset attack modes define the activation and precharge sequences of attack rows to simulate different types of attack scenarios in the real world for comprehensive DRAM testing.

[0072] The attack line is a pre-set line to be attacked, that is, a frequently accessed line. By attacking this line, the goal is to induce a bit flip in its adjacent line (i.e., the line under test).

[0073] For example, the preset attack mode can be a single-sided attack mode, a two-sided attack mode, or a multi-bank concurrent attack mode. A single-sided attack mode involves repeated activation of a single attack line, while a two-sided attack mode involves alternating activation of two attack lines. A multi-bank concurrent attack mode activates attack lines in multiple banks simultaneously to increase the complexity and intensity of the attack. Choosing different attack modes helps assess the vulnerability of DRAM under different attack scenarios.

[0074] Attack requests can be translated into a sequence of row activation (ACT) and precharge (PRE) commands conforming to the DRAM protocol. The DRAM protocol defines the standards for communicating with DRAM chips, including command formats and timing requirements. To ensure that attack requests can be correctly received and executed by the DRAM chips, these requests must comply with the requirements of the DRAM protocol. During the translation process, high-level attack operations can be mapped into low-level commands that the DRAM controller and the chips can understand.

[0075] Specifically, the protocol control logic in the DRAM controller converts the attack request into a row activation and precharge command sequence that conforms to DRAM specifications (such as JEDECDDR / LPDDR / GDDR standards), so that the operation of the attack request meets the interface requirements of the DRAM chip in terms of electrical signals and timing.

[0076] The row activation and precharge command sequence typically includes the activation (ACT) command for the target memory bank and row, the precharge command (PRE) command, and the accompanying row address. This process can follow relevant timing parameters defined in the DRAM specification, such as tRAS (Row Active Time) and tRP (Row Precharge Time).

[0077] The row activation and precharge command sequence is then sent to the DRAM chip. The DRAM chip receives and executes the commands from the controller, simulating the effect of a Row Hammer attack. The DRAM controller can communicate directly with the DRAM chip through its internal hardware logic and send commands according to the timing requirements of the DRAM protocol, thereby achieving precise control of the DRAM chip. Specifically, the DRAM controller can send the command sequence to the DRAM chip for execution through the DRAM physical interface (PHY).

[0078] In step S13, the data of the line to be tested in the DRAM chip is read and compared with the initially written data to detect whether a bit flip has occurred, and the line that has a bit flip is identified as the victim line.

[0079] Once the attack is complete, the data can be read and compared to determine which rows were affected.

[0080] Specifically, data for the row under test can be read from the DRAM chip. The read operation is initiated by the DRAM controller, which generates a corresponding read command sequence based on the address information stored in the row under test. These command sequences must also conform to the requirements of the DRAM protocol to ensure that the DRAM chip can correctly execute the read operation.

[0081] A typical read command sequence includes the Activate Target Row (ACT command), the Read Command (RD command), and the accompanying column address. These commands cause the DRAM chip to output the data of the row under test to the data bus for the DRAM controller to read.

[0082] After reading the data of the row to be tested, this data can be compared with the initially written data. At the start of the test, by executing step S11, data defined by a preset data pattern is written into the row to be tested. The controller can store copies of the original data of the row to be tested. During the comparison process, the read data is compared bit by bit with these original data.

[0083] During the comparison, the system checks whether bit flipping occurred in the row under test during the attack. Bit flipping refers to the phenomenon where a data bit changes from 0 to 1 or from 1 to 0. If a change in data bits is detected during the comparison, it indicates that the row under test has been affected by a Row Hammer attack.

[0084] Upon detecting a bit flip, the victim row of the behavior under test can be identified. A victim row is a row whose data is accidentally altered during a RowHammer attack; that is, a row that is not directly attacked but ultimately experiences data errors due to physical charge interference. The controller records the row address of the identified victim row, the column address where the error occurred, the error bitmap, and the corresponding attack row information in a specific error log register.

[0085] By identifying the row where bit flipping occurs as the victim row, it can be used to defend against subsequent Row Hammer attacks. When a real Row Hammer attack occurs, defense can be carried out against the victim row corresponding to the attack row.

[0086] In this embodiment, the DRAM row hammer test method is executed in hardware logic within the DRAM controller. The hardware logic generates data write requests for the row under test, converts these requests into write command sequences, and sends them directly to the DRAM chip. Simultaneously, it generates attack requests for the attack row according to a preset attack mode, converts these requests into row activation and precharge command sequences, and sends them to the DRAM chip. This direct transmission from the DRAM controller to the DRAM chip bypasses CPU scheduling, improving the efficiency and accuracy of the write operation. This not only reduces latency caused by software-level scheduling and address translation but also avoids inefficiencies that may occur in software testing.

[0087] Furthermore, by directly generating and converting command sequences in the DRAM controller, and by having the DRAM controller interact directly with the DRAM chips, a row hammer test based on hardware logic execution was achieved. In this process, the data writing to the test row of the DRAM chip and the attack on the attack row are both executed by the DRAM controller hardware through the generation of command sequences. These command sequences do not require the conversion of virtual addresses to physical addresses through the operating system or memory management unit, thus significantly simplifying programming complexity and improving the efficiency and reliability of the test.

[0088] Furthermore, this method directly reads the data of the row to be tested from the DRAM chip through hardware logic and compares it with the initially written data to detect whether a bit flip has occurred. This avoids data errors caused by excessively long data transmission links during software reading, making the observation of bit flip phenomena more accurate and effectively verifying the defense mechanism. It overcomes the problem of difficulty in accurately observing bit flip phenomena in existing software testing methods, providing DRAM manufacturers and those skilled in the art with a more reliable and intuitive testing method.

[0089] In one possible implementation, the preset attack mode includes a one-sided attack mode; generating an attack request for the attack line according to the preset attack mode includes generating repeated line activation and precharge requests for a single attack line.

[0090] In one-sided attack mode, continuous row activation and precharge operations are performed on a single attack row in the DRAM. The purpose of one-sided attack mode is to simulate a scenario that may occur in actual attacks, namely, attempting to induce bit flips by repeatedly activating the same row.

[0091] When generating an attack request, a series of operations can be created specifically targeting a single attack row. This is achieved by repeatedly sending a Row Activation (ACT) request to activate the row, followed by a Precharge (PRE) request to deactivate it. This iterative activation and precharge process simulates the behavior of an attacker attempting to influence adjacent rows of data through charge leakage.

[0092] Specifically, a row activation request causes the DRAM chip to open a specific row, allowing data to be read or written. A precharge request is sent after row activation to close the row and prepare for the next activation. In one-sided attack mode, this activation and precharge process is repeated on the same attack row to achieve a predetermined number of attacks.

[0093] In this embodiment, by focusing the attack on a single row, interference from alternating access to multiple rows is eliminated, ensuring that any bit flips in adjacent rows (victim rows) induced by this can be definitively attributed to frequent access to that specific attack row. This provides a controllable and repeatable experimental environment for accurately measuring the sensitivity of a specific DRAM chip to frequent access to a single row and for accurately measuring the physical positional relationship between the attack row and the victim row. Furthermore, due to its simple logic, this mode is easy to implement in hardware with extremely high-frequency attack cycles, enabling rapid completion of traversal tests on a large number of memory cells and significantly improving testing efficiency.

[0094] In one possible implementation, the preset attack mode includes a two-sided attack mode; generating an attack request for the attack line according to the preset attack mode includes generating alternating row activation and precharge requests for the two attack lines.

[0095] In this implementation, the default attack mode is the two-sided attack mode, which is another form of Row Hammer attack test. It involves alternating row activation and precharge operations on two attack rows in DRAM.

[0096] The two-sided attack mode can simulate more complex attack scenarios, where the attacker not only activates one row, but alternately activates two rows in an attempt to induce a bit flip between them.

[0097] When generating an attack request, a series of operations can be created specifically targeting two selected attack lines. During the attack, an "activation-precharge" request is first issued to the first attack line, then to the second, and so on. This alternating activation and precharge process is repeated on both attack lines to achieve a predetermined number of attacks.

[0098] Specifically, for each attack row, a row activation request causes the DRAM chip to open that specific row, allowing data to be read or written. A precharge request is sent after row activation to close the row and prepare for the next activation. In a two-sided attack mode, this activation and precharge process alternates on two different attack rows to simulate a more realistic attack scenario.

[0099] In this embodiment, a two-sided attack mode can more effectively induce bit flips. Compared to a one-sided attack, a two-sided attack alternately activates two adjacent rows, simultaneously causing charge perturbations on both sides of the victim row located in the middle of their common position. This results in stronger voltage fluctuations and charge leakage, greatly increasing the probability of bit flips and effectively testing the stability of DRAM cells under extreme stress.

[0100] Furthermore, the dual-side attack mode can better simulate the most threatening attack scenarios in the real world, providing a more rigorous and reliable test benchmark for evaluating and verifying the effectiveness of various row hammer defense mechanisms (such as target row refresh - TRR).

[0101] In one possible implementation, the method supports a multi-bank concurrent attack mode. The step of generating attack requests for attack rows according to a preset attack mode and converting the attack requests into a row activation and precharge command sequence includes: generating attack requests for attack rows in multiple different banks; and converting the attack requests into a time-series, cross-bank interleaved row activation and precharge command sequence.

[0102] The multi-bank concurrent attack mode is used to simulate a scenario where multiple banks in DRAM are attacked simultaneously. In the multi-bank concurrent attack mode, attack requests can be generated targeting attack rows in multiple different banks. These requests can then be converted into a sequence of row activation and precharge commands that conform to the DRAM protocol timing and are interleaved across banks.

[0103] Specifically, when generating attack requests, the testing method creates operations for each attack line in a selected bank. These operations include sending a Row Activation (ACT) request to activate the line and then sending a Precharge (PRE) request to close it. Since the attack is concurrent, the attack requests can be organized into an interleaved sequence of commands across multiple banks, allowing ACT and PRE commands to be sent alternately between different banks.

[0104] During the conversion process, high-level attack operations are mapped into low-level commands that the DRAM controller and the DRAM chips can understand. At the same time, it is ensured that these commands meet the timing requirements of the DRAM protocol, so that the command sequence takes into account the timing differences between different memory banks and meets the interface requirements of the DRAM chips in terms of electrical signals and timing.

[0105] In this embodiment of the disclosure, by using a multi-memory concurrent attack mode, attack requests are generated for attack rows in multiple different memory banks. The attack requests are then converted into a time-sequential, cross-memory interleaved sequence of row activation and precharge commands, which can significantly improve the attack efficiency of Row Hammer testing, thereby greatly accelerating the testing process and more effectively stimulating deep vulnerabilities.

[0106] By applying pressure to multiple memory banks in parallel, the number of row activations per unit time can be far greater than in a single-bank attack mode, thus reaching the attack threshold required to induce bit flips much faster and significantly shortening the time required to complete a full-chip traversal test. Furthermore, this attack mode can simulate the most advanced and complex real-world RowHammer attack scenarios, providing a benchmark for evaluating the effectiveness of the complex multi-bank management logic and advanced defense mechanisms in DRAM controllers, ensuring their ability to withstand high-performance coordinated attacks in actual deployments.

[0107] In one possible implementation, converting the attack request into a row activation and precharge command sequence includes: generating a row activation command to the target memory based on a row hammer attack request targeting a target row in the target memory, the row activation command containing the address of the target row; generating a precharge command to the target memory after the DRAM specification-required tRAS time; and generating another row activation command to the same target memory after the DRAM specification-required tRP time, to launch a next attack against the same target row.

[0108] When converting attack requests into a sequence of row activation and precharge commands, the timing parameters required by the physical characteristics of the DRAM chips are followed to ensure effective execution of the commands and successful induction of the Row Hammer effect.

[0109] Specifically, upon receiving a row hammer attack request targeting a target row in a target bank, the request carries a specific location that needs to be frequently accessed. In response to this request, an ACT command can be generated and issued to the target bank. This command can be a standard DRAM command code, whose address field contains the specific address of the target row, informing the DRAM chip that accessing a specific row in the specified bank requires sensing and magnifying its contents into the row buffer.

[0110] After a row activation command is issued, the DRAM controller does not immediately issue the next command. Instead, it starts a timer or counter to ensure that the minimum row activation time (tRAS, Row AddressStrobe time) required by the DRAM specification is met. The tRAS parameter defines the minimum time that must be waited after a row is activated before pre-charging can begin, ensuring that the charge in the memory cell can be stably read into the induction amplifier. After the tRAS time is met, the DRAM controller generates and issues a pre-charge command (PRE Command) to the same target memory bank. This command closes the currently open row, restoring the memory bank to an idle state and preparing it for the next row activation.

[0111] After the precharge command is issued, the DRAM controller can re-enter a waiting state to ensure that the minimum row precharge time (tRP) required by the DRAM specification is met. The tRP parameter defines the minimum time that must be waited after the precharge command is issued before a (same or different) row in the same memory bank can be reactivated, ensuring that the internal circuitry of the memory bank has sufficient time to complete reset and stabilization. Only after the tRP time is met will the control logic generate and issue another row activation command to the same target memory bank, with the same row address as before, thus launching the next attack against the same target row.

[0112] In this embodiment, a row activation command containing the address of the target row is generated based on a row hammer attack request targeting a target row in the target memory. After the DRAM specification's tRAS time requirement is met, a precharge command is generated and sent to the target memory. After the DRAM specification's tRP time requirement is met, another row activation command is generated and sent to the same target memory to launch the next attack against the same target row. This ensures that the Row Hammer attack operation always strictly conforms to the physical timing requirements of the DRAM chips at the hardware level, avoiding potential operation failures, data corruption, or system instability due to violations of timing parameters, thus guaranteeing the reliability and repeatability of the attack test.

[0113] In one possible implementation, converting the attack request into a time-sequential, cross-memory interleaved sequence of row activation and precharge commands includes: generating multiple sets of row activation and precharge commands to be sent to different target memory units based on the attack request targeting attack rows in multiple different memory units; interleaving the multiple sets of commands in time before sending them; wherein the time interval between two consecutive row activation commands sent to any memory unit satisfies the tRC timing requirement.

[0114] When an attack is executed concurrently on multiple memory banks, all commands can follow the timing requirements of the DRAM protocol, thus effectively simulating a Row Hammer attack.

[0115] In this implementation, attack requests are generated targeting rows in multiple different banks. These requests are logically independent of each other, allowing for simultaneous attacks on specific rows in multiple banks.

[0116] Based on these multiple attack requests, multiple sets of row activation and precharge commands can be generated and sent to different target storage units. Each set of commands contains a complete "activation-precharge" loop, targeting its respective target storage unit and attack row.

[0117] For these multiple sets of commands, they can be interleaved in time and sent according to the timing specified in the DRAM protocol. When a memory bank is busy (waiting for tRAS and tRP times) after executing an activation command, the DRAM controller will allocate command bus resources to another memory bank that is already idle and send an activation command to it. In this way, ACT and PRE commands sent to different memory banks are interleaved into each other's idle periods on the timeline, forming a continuous command stream, which greatly improves bus utilization and attack throughput.

[0118] During this process, a time interval satisfying the tRC timing requirement must be inserted between two consecutive row activation commands sent to any memory bank. tRC (Row Cycle Time) is the minimum time required for a memory bank to complete one full "activation-precharge" cycle (tRC = tRAS + tRP). Therefore, for any memory bank, the time interval between two consecutive ACT commands must not be less than the specified tRC value. This ensures that the internal circuitry of the DRAM chip can complete operations correctly and avoids data corruption and command failure.

[0119] In this embodiment, multiple independent commands are generated based on attack requests targeting attack rows in multiple different memory banks. These commands are then finely interleaved in time according to DRAM timing rules before being sent, while strictly ensuring that the operation interval for each memory bank meets the tRC requirement. This successfully achieves a parallel Row Hammer attack across memory banks, expanding the attack scope from a single memory bank to the entire DRAM chip. This allows row activation operations to occur continuously, greatly accelerating the testing process, quickly exposing deeper and more difficult-to-trigger soft errors, and realistically simulating the most efficient and advanced actual Row Hammer attack techniques.

[0120] In one possible implementation, the preset data pattern is a data pattern corresponding to the preset attack pattern. The process of determining the preset data pattern includes: under the preset attack pattern, using multiple candidate data patterns to perform attack tests on the DRAM chip respectively, wherein the data of the attack row of the candidate data pattern is a first logic value, and the data pattern of the row to be tested is a second logic value complementary to the first logic value; based on the bit flipping behavior of the multiple candidate data patterns, determining the data pattern that can trigger bit flipping the fastest, as the preset data pattern corresponding to the preset attack pattern.

[0121] During DRAM row hammer testing, there is a correspondence between preset data patterns and preset attack patterns. The preset data pattern can be a data pattern with a higher flip probability under the preset attack pattern, so as to quickly trigger bit flips during the attack test, thereby improving test efficiency. The process of establishing this correspondence is described in detail below.

[0122] The candidate data pattern comprises two parts: attack row data and test row data. During testing, the DRAM controller configures the attack row data with a first logic value and the test row data with a complementary second logic value. Complementarity here means that the logic states of the corresponding bits in the attack row and the test row are opposite; for example, if one is logic 1, the other is logic 0. This configuration establishes a charge state difference between the attack row and the test row to quickly induce bit flips during attack testing and also accelerates the process of determining the correspondence.

[0123] Under the selected preset attack mode, the DRAM controller performs attack tests on the DRAM chips using each candidate data pattern. For each preset attack mode, the DRAM controller executes the complete attack sequence and then checks whether the data in the row under test has changed.

[0124] Based on the bit-flipping behavior determined across all candidate data patterns, the DRAM controller performs analysis and comparison. This analysis process identifies which combination of candidate data patterns can induce bit flips most rapidly, or induce the most erroneous bits with the same number of attacks. The identified data pattern with the highest attack efficiency can then be determined as the preset data pattern corresponding to this preset attack pattern; alternatively, the preset data pattern corresponding to the preset attack pattern can be obtained by combining the data patterns that induce bit flips under different candidate data patterns.

[0125] For example, this process can be implemented as follows: In a one-sided attack mode, test the combination of all 1s for the attack behavior and all 0s for the test behavior, and record the bit flipping; then, test the combination of all 0s for the attack behavior and all 1s for the test behavior, and record again. By comparing the results of the two tests, it is possible to analyze under which charge background (is the attack row at a high potential and the test row at a low potential, or vice versa) the DRAM cell is more prone to flipping. Furthermore, it is also possible to test fine-grained patterns such as attack behavior 0x55 (binary 01010101) and test behavior 0xAA (binary 10101010) to explore subtle differences in charge interference at different column addresses.

[0126] In a two-sided attack mode, the data pattern configuration needs to consider the synergistic effect of the two attack rows. For example, both attack rows can be configured with all-1 logic values, while the test row has all-0 logic values. This configuration allows for the establishment of the largest charge difference on both sides of the test row located between the two attack rows, typically producing the strongest interference effect. Another configuration is to have one attack row with all-1 logic values ​​and the other with all-0 logic values; this asymmetric configuration can be used to study interference characteristics under different combinations of charge backgrounds.

[0127] In this embodiment, when the attack row is frequently activated, its intense charge operations interfere with the charge stability of memory cells in adjacent rows under test. If the logic value stored in a cell in the row under test differs from the value of the corresponding cell in the adjacent attack row, i.e., creating a situation where "0" and "1" are adjacent, the driving force and probability of charge leakage increase. By systematically testing data patterns of different logic value correspondences between the attack row and the row under test, the combination that generates the maximum charge interference gradient between the two can be identified, thereby most effectively exposing the vulnerability of DRAM cells.

[0128] By employing the aforementioned process of determining preset data patterns, testing specific DRAM chips and attack patterns no longer relies on arbitrary or generic data background selection. This method proactively identifies and locks onto the data patterns that best expose the row hammer sensitivity of a DRAM cell, significantly improving the targeting and efficiency of testing. Subsequent testing using the determined preset data patterns can induce more significant bit-flipping phenomena in a shorter testing time or with fewer attack attempts, accelerating the identification of affected rows and improving row hammer testing efficiency.

[0129] In one possible implementation, based on the bit-flipping behavior of the multiple candidate data patterns, the pattern that can induce bit flipping the fastest is determined, including: determining the bit-flipping behavior of multiple candidate data patterns after the attack test; and configuring the data that triggers bit flipping in each candidate data pattern to obtain a target data pattern that can simultaneously trigger as many bit flips as possible, as the data pattern that can trigger bit flipping the fastest.

[0130] In determining the data pattern that can induce bit flips the fastest, the DRAM controller can collect and analyze bit flip behavior under multiple candidate data patterns and configure the data pattern.

[0131] The DRAM controller determines the specific bit-flipping behavior after performing an attack test in each candidate data mode. That is, it records which specific bit positions in the row under test have flipped from 0 to 1 or from 1 to 0, forming a bit-flipping map.

[0132] The DRAM controller performs a comprehensive analysis based on the "bit flipping pattern" collected from various candidate data patterns to identify those bits that repeatedly show high sensitivity in different tests, as well as the correlation between their flipping behavior and specific data logic values ​​in the attack row.

[0133] Based on this analysis, the DRAM controller performs data configuration for the data pattern. According to the patterns derived from the analysis, a new target data pattern is generated for the attack row and the row under test, ensuring that when the attack row is activated, effective charge interference is simultaneously generated on as many identified sensitive bits as possible. Specific data configuration strategies can include various forms. For example, the existing candidate pattern that performs best in testing can be directly selected; effective components from multiple candidate patterns can be combined and integrated to construct a new, more efficient synthetic pattern; or the values ​​at specific positions in the attack row can be set selectively based on the mapping relationship between flipped bits and the attack row data.

[0134] For example, suppose preliminary testing reveals that when using all-1 attack line data, bits 10, 20, and 30 of the line under test are prone to flipping; while when using 0x55 attack line data, bits 15, 25, and 35 of the line under test are prone to flipping. Therefore, the synthesized target attack line data pattern might be designed to: ensure bits 10, 20, and 30 are 1 (to attack their corresponding sensitive units), while also ensuring bits 15, 25, and 35 satisfy specific logic values ​​under the 0x55 context (e.g., alternation of 0 and 1), to coordinate the attack on another set of sensitive units. The initial data of the line under test would then be configured accordingly to be a pattern completely complementary to the attack line data, maximizing the charge difference.

[0135] In this embodiment of the disclosure, by testing the flip behavior under different data patterns, the data combinations that most expose the vulnerability of DRAM cells can be identified. Based on this, a target data pattern can be determined. Applying the determined target data pattern to subsequent tests can induce more bit flips per unit time, or achieve the same test objective with fewer attacks. This not only accelerates the identification process of victim rows but also provides a more accurate data foundation for a comprehensive assessment of the row hammer sensitivity of DRAM.

[0136] In one possible implementation, the method further includes: receiving user configuration instructions via a programmable register to dynamically set at least one of the following parameters: attack line address, line address to be tested, attack mode type, number of attacks, and the preset data mode.

[0137] Within the DRAM controller, a set of dedicated memory-mapped registers can be designed, visible to system software such as drivers or test firmware. Users or test programs can issue configuration commands by writing to specific addresses in these registers, thereby dynamically setting at least one of the following key test parameters:

[0138] Attack Row Address: You can directly specify one or more specific row addresses as attack targets for precise strikes; or you can set a starting address and a step value, which will be automatically incremented by the hardware to achieve traversal testing of row addresses.

[0139] Victim Row Address (Under-test Row Address): This specifies the row address where data integrity needs to be monitored and bit flipping needs to be checked. It is typically the row adjacent to the attack row, but can also be any row to study the long-range effects of the Row Hammer effect, depending on the physical mapping characteristics of DRAM.

[0140] Attack Pattern Type: The engine's operating mode can be selected through registers, such as single-sided attack, two-sided attack, or multi-memory concurrent attack, to simulate different attacker strategies.

[0141] Number of Attacks / Hammer Count: This setting determines the number of times the "activation-precharge" loop is executed for each attack line. It is used to calibrate the threshold for inducing bit flips, i.e., how many attacks are needed to cause an error.

[0142] Predefined Data Pattern: You can write the data pattern of the row to be tested before the test begins, such as all 0s, all 1s, hexadecimal 0x55, hexadecimal 0xAA, or random number pattern, to test the Row Hammer sensitivity under different data backgrounds.

[0143] In this embodiment, user configuration instructions are received via a programmable register interface to dynamically set key test parameters, transforming the hardware attack engine based on this method from a fixed-function circuit into a highly flexible, software-defined test platform. This significantly improves the flexibility, repeatability, and automation of testing. Users can quickly deploy and execute a large number of different test cases without modifying the underlying hardware design, greatly facilitating the extensive screening of DRAM vulnerabilities, the accurate calibration of Row Hammer thresholds, and the comparative verification of the effectiveness of different defense strategies. This also makes the engine highly suitable for integration into automated testing frameworks, becoming a powerful tool in chip verification, characterization, and security authentication processes.

[0144] In one possible implementation, the method further includes: upon detecting an attacking line of a row hammering attack, performing row hammering defense on the victim line corresponding to the attacking line.

[0145] The attack row detected here refers to the row attack row that is detected when a real row attack occurs in actual use. This detection can be achieved through various mechanisms. For example, if the controller finds that the number of activations of a row exceeds the safety threshold, it can determine that the row is an attack row (Aggressor Row).

[0146] After identifying the attacking line, a line hammering defense can be performed on the corresponding victim line. The victim line here refers to the line hammering test obtained according to any line hammering test method of this disclosure embodiment. The victim lines often differ between different brands / models of DRAM chips. Using the DRAM line hammering test method provided in this disclosure embodiment, the victim lines of any brand / model DRAM chip when receiving a line hammering attack can be accurately determined.

[0147] Therefore, when defending against row hammer attacks, defense can be implemented on the identified affected row, such as by issuing a refresh command to the affected row. For example, a refresh operation based on a dummy read can be used. The DRAM controller can generate a read request to the affected row. This request is not for acquiring data, but rather triggers a row activation (ACT) operation on the affected row. The subsequent precharge (PRE) operation is equivalent to a refresh, thereby strengthening the charge of that row.

[0148] In this embodiment of the disclosure, by immediately performing defensive operations on the corresponding victim line after an attack line is detected, integrated linkage between testing and defense is achieved.

[0149] Figure 2 The flowchart illustrates another DRAM row hammer test method according to an embodiment of the present disclosure, as shown below. Figure 2 As shown, firstly... Figure 2 The various modules and their functions are described in detail below:

[0150] Configuration module: Responsible for receiving and setting the Row Hammer (RH) test mode. This includes parameters such as the attack line and victim line settings, the number of attacks, and the data mode.

[0151] Main control module: Includes Row Hammer state machine (RH FSM) to control the state transitions of the entire test process. Based on the parameters set by the configuration module, the main control module generates control signals to drive other modules to perform corresponding operations.

[0152] Attack Module: Based on instructions from the main control module, it generates row activation (ACT) requests targeting specific attack rows (aggressor rows / banks). These requests are converted into command sequences conforming to the DRAM protocol to simulate Row Hammer attacks.

[0153] Data inspection module: This module generates write commands and writes data, writing a preset data pattern to the test row (victimrow / bank). After the attack is complete, this module generates read commands to read data from the test row, compares it with the initially written data, and records any errors that occurred.

[0154] DRAM Protocol Control Module and RH Resistance Module: This module receives ACT requests from the attack module, converts them into specific DRAM commands (DRAM CMDs), and sends them to the DRAM chips. This module ensures that all commands conform to DRAM timing specifications, such as tRAS and tRP. Optionally, this module may also include Row Hammer Resistance logic to implement the DRAM chips' defensive capabilities.

[0155] DRAM chip: Receives and executes commands from the DRAM protocol control module. During an attack, the DRAM chip may undergo bit flips, which are detected and recorded by the data inspection module.

[0156] The specific steps are as follows:

[0157] Step 1: The configuration module receives the RH mode settings input by the user, including the addresses of the attack line and the victim line, the attack mode type, the number of attacks, and the preset data mode.

[0158] Step 2: The main control module controls the entire test process through RH FSM according to the settings of the configuration module.

[0159] Step 3: The data inspection module sends a data write request (Wrreq) for the row to be tested according to the instructions of the main control module, and writes the preset data pattern.

[0160] Step 4: The attack module sends an attack request to the attack line according to the instructions of the main control module, and starts the attack sequence.

[0161] Step 5: The DRAM protocol control module receives the attack request, converts it into a command sequence that conforms to the DRAM protocol, and sends it to the DRAM chip.

[0162] Step 6: After the attack is completed, the data inspection module sends a data read request (RD req), reads the data and compares it with the initially written data, records errors, and identifies the victim line.

[0163] Step 7: If the DRAM chip contains RH resistance logic, this logic will be activated during the attack to resist or mitigate the impact of the attack.

[0164] The entire process directly controls the DRAM chips through hardware logic, enabling efficient and accurate Row Hammer attack testing, which helps to evaluate DRAM security and design optimization.

[0165] Figure 3 The diagram illustrates two attack models according to an embodiment of the present disclosure, as shown below. Figure 3 As shown in the figure, the attack line, the line under test (which may also contain the attack line itself), and the location where the bit flip occurs are indicated by color and markings.

[0166] Regarding the unilateral attack shown in the left image:

[0167] A DRAM structure contains a DRAM bank, which contains multiple rows and columns.

[0168] Attack lines: The lines marked in red in the diagram (e.g., line 3) represent attack lines that are frequently activated.

[0169] Rows under test: Rows marked in yellow in the figure (e.g., rows 2 and 4) represent affected rows that may experience bit flips due to charge leakage.

[0170] Bit Flip: The green square indicates the specific location in the victim row where a bit flip occurred due to a Row Hammer attack.

[0171] Regarding the dual-sided attack shown in the right image:

[0172] The DRAM structure is similar to that on the left, and it also contains a DRAM bank, which includes multiple rows and columns.

[0173] Attack lines: The two lines marked in red in the diagram (e.g., lines 2 and 4) represent attack lines that are frequently and alternately activated.

[0174] Row under test: The row marked in yellow in the figure (e.g., row 3) represents the victim row located between two attacking rows, which may have bit flipped due to charge leakage.

[0175] Bit Flip: Similarly, the green squares indicate the specific locations in the victim row where a bit flip has occurred due to a Row Hammer attack.

[0176] Figure 4 A block diagram illustrating a DRAM row hammer test according to an embodiment of the present disclosure is shown, as follows: Figure 4 As shown, the device 20 includes:

[0177] Data inspection module 21 is used to generate a data write request for the row to be tested according to a preset data pattern, and convert the data write request into a write command sequence and send it to the DRAM chip;

[0178] The attack module 22 is used to generate an attack request for the attack row according to a preset attack mode, and convert the attack request into a row activation and precharge command sequence and send it to the DRAM chip.

[0179] The data inspection module 21 is used to read the data of the line to be tested in the DRAM chip and compare it with the data initially written to detect whether a bit flip has occurred, and to identify the line that has a bit flip as the victim line.

[0180] In one possible implementation, the preset attack mode includes a one-sided attack mode;

[0181] The attack module is used to generate repeated row activation and precharge requests for a single attack row.

[0182] In one possible implementation, the preset attack mode includes a two-sided attack mode;

[0183] The attack module is used to generate alternating row activation and precharge requests for two attack rows.

[0184] In one possible implementation, the method supports a multi-bank concurrent attack mode, wherein the attack module is used to generate attack requests targeting attack lines in multiple different banks.

[0185] The device further includes a protocol control module for converting the attack request into a time-series, cross-memory interleaved sequence of row activation and precharge commands.

[0186] In one possible implementation, the protocol control module is configured to:

[0187] Based on a row hammer attack request targeting a target row in the target memory, a row activation command is generated and sent to the target memory, the row activation command containing the address of the target row;

[0188] After the tRAS time required by the DRAM specification is met, a precharge command is generated and sent to the target memory bank;

[0189] After the tRP time required by the DRAM specification is met, a new row activation command is generated and sent to the same target memory bank to launch the next attack against the same target row.

[0190] In one possible implementation, the protocol control module is configured to:

[0191] Based on the attack requests targeting attack rows in multiple different storage banks, multiple sets of row activation and precharge commands are generated and sent to different target storage banks respectively;

[0192] Multiple sets of commands are interleaved and sent in time;

[0193] Among them, the time interval between two consecutive row activation commands sent to any memory bank that meet the tRC timing requirements.

[0194] In one possible implementation, the preset data pattern is a data pattern corresponding to the preset attack pattern, and the process of determining the preset data pattern includes:

[0195] In the preset attack mode, multiple candidate data modes are used to perform attack tests on the DRAM chip respectively. The data of the attack row of the candidate data mode is a first logic value, and the data mode of the row to be tested is a second logic value that is complementary to the first logic value.

[0196] Based on the bit-flipping behavior under the various candidate data patterns, the data pattern that can trigger bit-flipping the fastest is determined as the preset data pattern corresponding to the preset attack pattern.

[0197] In one possible implementation, based on the bit-flipping behavior under the multiple candidate data patterns, the pattern that can induce bit flipping the fastest is determined, including:

[0198] Determine the bit-flipping behavior of multiple candidate data patterns after attack testing;

[0199] Based on the data that triggers bit flipping in each candidate data pattern, the data is configured to obtain the target data pattern that can trigger bit flipping as many bits as possible at the same time, which is the data pattern that can trigger bit flipping the fastest.

[0200] In one possible implementation, the device further includes:

[0201] The main control module is used to receive user configuration instructions via programmable registers to dynamically set at least one of the following parameters:

[0202] Attacking line address, line address to be tested, attack mode type, number of attacks, and the preset data mode.

[0203] In one possible implementation, the device further includes:

[0204] The resistance module is used to perform line hammer defense on the victim line corresponding to the attacking line when an attacking line is detected.

[0205] In some embodiments, the functions or modules of the apparatus provided in this disclosure can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0206] According to another aspect of this disclosure, a chip is provided, including the aforementioned DRAM row hammer test apparatus. According to another aspect of this disclosure, an electronic device is provided, including the aforementioned chip.

[0207] Other components of the chips and electronic devices in the above embodiments can be derived from various technical solutions that are now and will be known to those skilled in the art, and will not be described in detail here.

[0208] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

[0209] In the description of this specification, it should be understood that the terms "center," "longitudinal," "transverse," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this disclosure and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this disclosure.

[0210] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this disclosure, "multiple" means two or more, unless otherwise explicitly specified.

[0211] In this disclosure, unless otherwise expressly specified and limited, the terms "installation," "connection," "linking," "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection, an electrical connection, or a communication connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this disclosure according to the specific circumstances.

[0212] In this disclosure, unless otherwise expressly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature being directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature being directly above or diagonally above the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0213] The foregoing disclosure provides many different implementations or examples for carrying out different structures of this disclosure. To simplify the disclosure, specific examples of components and arrangements have been described above. Of course, these are merely examples and are not intended to limit the scope of this disclosure. Furthermore, reference numerals and / or letters may be repeated in different examples; such repetition is for simplification and clarity and does not in itself indicate a relationship between the various implementations and / or arrangements discussed.

[0214] The above are merely specific embodiments of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this disclosure, and these should all be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

[0215] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A DRAM row hammer test method, comprising: The method is executed in hardware logic in a DRAM controller, comprising: generating a data write request for a test row according to a preset data pattern, and converting the data write request into a write command sequence and sending to a DRAM chip; generating an attack request for an attack row according to a preset attack pattern, and converting the attack request into a row activation and precharge command sequence and sending to the DRAM chip; reading data of the test row in the DRAM chip and comparing with the initial written data to detect whether bit flipping occurs, and determining a row where bit flipping occurs as a victim row.

2. The method of claim 1, wherein, The preset attack pattern comprises a single-side attack pattern; The generating of the attack request for the attack row according to the preset attack pattern comprises: generating repeated row activation and precharge requests for a single attack row.

3. The method of claim 1, wherein, The preset attack pattern comprises a double-side attack pattern; The generating of the attack request for the attack row according to the preset attack pattern comprises: generating alternating row activation and precharge requests for two attack rows.

4. The method of claim 1, wherein, The method supports a multi-bank concurrent attack pattern, and the generating of the attack request for the attack row according to the preset attack pattern and the converting of the attack request into a row activation and precharge command sequence comprise: generating attack requests for attack rows in different banks; converting the attack requests into a time-sequential, cross-bank interleaved row activation and precharge command sequence.

5. The method of claim 1, wherein, The converting of the attack request into a row activation and precharge command sequence comprises: based on a row hammer attack request for a target row in a target bank, generating a row activation command sent to the target bank, the row activation command containing an address of the target row; after a tRAS time meeting a DRAM specification requirement, generating a precharge command sent to the target bank; after a tRP time meeting a DRAM specification requirement, generating again a row activation command sent to the same target bank to initiate a next attack for the same target row.

6. The method of claim 4, wherein, The converting of the attack request into a time-sequential, cross-bank interleaved row activation and precharge command sequence comprises: based on attack requests for attack rows in different banks, generating multiple groups of row activation and precharge commands sent to different target banks respectively; sending the multiple groups of commands after time interleaving arrangement; wherein a time interval between two consecutive row activation commands sent to any bank meets a tRC time requirement.

7. The method of claim 1, wherein, The preset data pattern is a data pattern corresponding to the preset attack pattern, and the determination process of the preset data pattern comprises: under the preset attack pattern, using multiple candidate data patterns to perform attack tests on a DRAM chip respectively, wherein data of an attack row in the candidate data pattern is a first logical value, and a data pattern of a test row is a second logical value complementary to the first logical value; based on bit flipping behaviors under the multiple candidate data patterns, determining a data pattern capable of triggering bit flipping most quickly as a preset data pattern corresponding to the preset attack pattern.

8. The method of claim 7, wherein, The determining of a pattern capable of inducing bit flipping most quickly based on bit flipping behaviors under the multiple candidate data patterns comprises: Determine bit flip behaviors of multiple candidate data patterns after attack test; Based on the data triggering bit flips in each candidate data pattern, configure data to obtain a target data pattern that can trigger bit flips of as many bits as possible simultaneously, as a data pattern that can trigger bit flips the fastest.

9. The method of claim 1, wherein, The method further includes: Receiving user configuration instructions through programmable registers to dynamically set at least one of the following parameters: Attack row address, to-be-tested row address, attack pattern type, attack times, and the preset data pattern.

10. The method of claim 1, wherein, The method further includes: In the case of detecting an attack row with row hammering, performing row hammering defense on the victim row corresponding to the attack row.

11. A DRAM row hammer test apparatus, comprising: The device is implemented in hardware logic in a DRAM controller, including: A data checking module configured to generate a data write request for a to-be-tested row according to a preset data pattern, convert the data write request into a write command sequence, and send the write command sequence to a DRAM chip; An attack module configured to generate an attack request for an attack row according to a preset attack pattern, convert the attack request into a row activation and precharge command sequence, and send the row activation and precharge command sequence to the DRAM chip; The data checking module is configured to read data of the to-be-tested row in the DRAM chip and compare the data with initially written data to detect whether bit flips occur, and determine a row with bit flips as a victim row.

12. A chip, characterized by The DRAM row hammer test device according to claim 11.

13. An electronic device, comprising: The chip according to claim 12.

Images