DRAM (Dynamic Random Access Memory) line hammering defense method, device and system, chip and electronic equipment

Abstract

The invention relates to the technical field of computers, in particular to a DRAM (Dynamic Random Access Memory) line hammering defense method, device and system, a chip and electronic equipment. The method is applied to a DRAM (Dynamic Random Access Memory) controller and comprises the following steps: acquiring a row identifier of a row activation command for requesting a DRAM; when the row identifier does not exist in an entry container and the entry container is not full, storing the row identifier and a corresponding activation count in the entry container; under the condition that the row identifier does not exist in an entry container and the entry container is full, replacing one entry in the entry container with an entry attribute of a new row identifier based on an activation count and / or an access time sequence recorded in the entry container; and under the condition that any activation count in the entry container exceeds a row activation threshold value, determining the corresponding row as an attack row hammered by the row, and executing defense. According to the embodiment of the invention, chip area overhead and related power consumption can be effectively reduced.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a DRAM row hammer attack defense method, apparatus, system, chip and electronic device. Background Technology

[0002] Dynamic Random Access Memory (DRAM) is an indispensable key component in modern computing systems. With advancements in manufacturing processes, DRAM cell density has continuously increased, leading to increasingly significant electromagnetic coupling effects between cells. This has resulted in a growing and serious row hammer security problem. A row hammer attack refers to an attacker's frequent, periodic access to a specific DRAM row (the attack row), causing bit flips in adjacent rows (the victim rows) due to accelerated charge leakage. This can compromise data integrity and even jeopardize system security.

[0003] To address the Row Hammer threat, the industry has proposed various detection and defense solutions. Existing monitoring solutions often employ a separate counter for each row, resulting in hardware resources increasing linearly with the number of rows. However, a single bank in modern high-capacity DRAM (such as third-generation high-bandwidth memory HBM3) contains tens of thousands of rows, and a single DRAM chip can have millions of rows. Maintaining an activation counter for each row in the DRAM controller would incur enormous hardware area overhead and power consumption. Summary of the Invention

[0004] In view of this, this disclosure proposes a DRAM row hammer attack defense technology solution.

[0005] According to one aspect of this disclosure, a DRAM row hammering defense method is provided, applied to a DRAM controller, comprising:

[0006] Retrieve the row identifier of the row activation command requesting DRAM;

[0007] If the row identifier does not exist in the entry container and the entry container is not full, the row identifier and the corresponding activation count are stored in the entry container; the entry container includes M monitoring entries, where M is a positive integer much smaller than the total number of rows in the DRAM storage.

[0008] If the row identifier does not exist in the entry container and the entry container is full, based on the activation count and / or access sequence recorded in the entry container, replace one entry in the entry container with the entry attribute of the new row identifier;

[0009] If any activation count in the entry container exceeds the row activation threshold, the corresponding row is identified as the attack row for row hammering, and defense is executed.

[0010] In one possible implementation, the fields of the entries in the entry container include a minimum activation count. Based on the activation count recorded in the entry container, an entry in the entry container is replaced with an entry attribute of a new row identifier, including:

[0011] Replace the entry in the entry container whose minimum activation count is true;

[0012] Compare the activation counts of all entries in the replaced entry container, and set the minimum activation count of the entry with the smallest activation count to true.

[0013] In one possible implementation, the activation count of all entries in the entry container after the comparison replacement includes:

[0014] The binary comparison method is used. Starting from the first entry in the entry container, the activation counts of adjacent entries are compared in turn. The entry with the smaller activation count is selected to continue the comparison with the next entry until the entry with the smallest activation count is determined.

[0015] In one possible implementation, the fields of the entries in the entry container include access sequence, where the relative sequence of each entry is represented by an order value.

[0016] The step of storing the row identifier and its corresponding activation count in the entry container when the row identifier does not exist in the entry container and the entry container is not full includes:

[0017] The row identifier and its corresponding activation count are stored in the entry container, the access timing sequence value is set to a preset maximum value, and the timing field value of the remaining entries in the entry container is decremented by 1.

[0018] In one possible implementation, replacing an entry in the entry container with the new row identifier's entry attribute includes:

[0019] When a new entry needs to be added to a full entry container, the entry with the smallest sequence value in the access sequence field is selected for replacement, and the sequence value of the new entry's sequence field is set to the preset maximum value. The sequence field values ​​of the remaining entries are decremented by 1.

[0020] In one possible implementation, replacing an entry in the entry container with the new row identifier's entry attribute includes:

[0021] When a row corresponding to an existing entry in the entry container is activated again, the original sequence value in the time sequence field of that entry is changed to the preset maximum value, and the values ​​in the time sequence fields of the remaining entries that are greater than the original sequence value are reduced by 1.

[0022] In one possible implementation, after identifying the corresponding row as the attack row for row hammering, the method further includes:

[0023] Embed a refresh management RFM flag in the existing command issued to the attack line to notify the DRAM to record the address of the attack line;

[0024] Send a DRFM command to the DRAM to trigger the DRAM's internal refresh mechanism to refresh the affected row.

[0025] In one possible implementation, after identifying the corresponding row as the attack row for row hammering, the method further includes:

[0026] Generate a pseudo-read instruction for the victim's line, wherein the pseudo-read instruction is a non-business read request;

[0027] The DRAM command scheduling module and DRAM protocol control module convert the fake read instruction into a sequence of row activation (ACT), read data (RD), and precharge (PRE) commands, and send it to the DRAM to force refresh the victim row.

[0028] Receive read data returned from the victim line, and perform error verification and correction (ECC) operations on the read data;

[0029] If a correctable error is detected, the corrected data is written back to the affected row.

[0030] In one possible implementation, the method further includes:

[0031] In response to the user's configuration command for the defense strategy, the DRAM row hammer defense strategy executed by the DRAM controller is determined, and the defense strategy includes: a defense strategy based on DRFM and a defense strategy based on pseudo-read commands.

[0032] In one possible implementation, the method further includes:

[0033] In response to user commands to configure configurable parameters, perform configuration operations;

[0034] The configurable parameters include at least one of the following:

[0035] Row activation threshold;

[0036] The number of monitored entries M in the entry container;

[0037] The row replacement strategy can be configured as a replacement strategy based on access time or a replacement strategy based on activation count;

[0038] The scope of the victim lines affected by the attack line.

[0039] According to another aspect of this disclosure, a DRAM row hammering defense system is provided, the system comprising:

[0040] The DRAM command scheduling module is used to receive row activation commands requesting DRAM and send them to DRAM;

[0041] The dynamic row activation monitoring module is used to obtain the row identifier of the row activation command, execute any of the above methods, determine the attacking row of the row hammer, and send the address of the attacking row to the insertion request module;

[0042] The insertion request module is used to embed a refresh management RFM flag in the command issued by the DRAM command scheduling module to the attack line, so as to notify the DRAM to record the address of the attack line; and send a DRFM command to the DRAM to trigger the DRAM's internal refresh mechanism to refresh the victim line.

[0043] According to another aspect of this disclosure, a DRAM row hammering protection device is provided, applied to a DRAM controller, comprising:

[0044] The acquisition module is used to acquire the row identifier of the row activation command requesting DRAM;

[0045] A storage module is used to store the row identifier and its corresponding activation count in an entry container when the row identifier does not exist in the entry container and the entry container is not full; the entry container includes M monitoring entries, where M is a positive integer much smaller than the total number of rows in the DRAM storage.

[0046] The replacement module is used to replace an entry in the entry container with the entry attribute of the new row identifier when the row identifier does not exist in the entry container and the entry container is full, based on the activation count and / or access sequence recorded in the entry container.

[0047] The determination module is used to identify the corresponding row as the attack row for row hammering when any activation count in the entry container exceeds the row activation threshold, and to perform defense.

[0048] According to another aspect of this disclosure, a chip is provided, including the aforementioned DRAM row hammer test apparatus.

[0049] According to another aspect of this disclosure, an electronic device is provided, including the chip described above.

[0050] In this embodiment, the row hammering method is implemented by the DRAM controller hardware. It obtains the row identifier of the requesting DRAM row activation command. If the row identifier does not exist in the entry container and the entry container is not full, it stores the row identifier and its corresponding activation count in the entry container. The entry container includes M monitoring entries, where M is a positive integer much smaller than the total number of rows in the DRAM memory. If the row identifier does not exist in the entry container and the entry container is full, based on the activation count and / or access timing recorded in the entry container, one entry in the entry container is replaced with an entry attribute of the new row identifier. If any activation count in the entry container exceeds the row activation threshold, the corresponding row is identified as the attack row for row hammering, and defense is performed. Therefore, by maintaining an entry container containing only M monitoring entries in the DRAM controller, where M is a positive integer much smaller than the total number of rows in the DRAM memory, and storage or replacement operations are only performed when the row identifier does not exist in the entry container, the DRAM controller does not need to maintain an activation counter for each row in a massive number of DRAM rows. This significantly reduces the required hardware storage resources and substantially lowers chip area overhead and related power consumption.

[0051] Furthermore, by employing a dynamic entry replacement strategy based on activation counts and / or access timing, this small-capacity entry container can efficiently track and filter out suspicious rows with the highest activation frequency within the current time period, achieving effective monitoring of millions of DRAM row address spaces with minimal resource overhead. By accurately identifying the attacking row and executing defenses when any activation count exceeds the row activation threshold, precise and efficient detection and real-time response to row hammer attacks are achieved.

[0052] Other features and aspects of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0053] The accompanying drawings, which are included in and form part of this specification, illustrate exemplary embodiments, features, and aspects of this disclosure together with the specification and serve to explain the principles of this disclosure.

[0054] Figure 1 A flowchart illustrating a DRAM row hammering defense method according to an embodiment of the present disclosure is shown.

[0055] Figure 2 A block diagram of a DRAM row hammering defense system according to an embodiment of the present disclosure is shown.

[0056] Figure 3 A block diagram of another DRAM row hammering defense system according to an embodiment of the present disclosure is shown.

[0057] Figure 4A block diagram of a DRAM row hammering defense device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0058] Various exemplary embodiments, features, and aspects of this disclosure will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0059] As used herein, the terms “comprising,” “including,” “having,” or variations thereof are open-ended and include one or more of the stated features, integrals, elements, steps, components, or functions, but do not exclude the presence or addition of one or more other features, integrals, elements, steps, components, functions, or groups thereof.

[0060] When an element is referred to as “connected,” “coupled,” “responding,” or a variation thereof relative to another element, it may be directly connected, coupled, or responding to another element, or there may be an intermediate element present.

[0061] Although the terms first, second, third, etc., may be used herein to describe various elements / operations, these elements / operations should not be limited by these terms. These terms are only used to distinguish one element / operation from another. Therefore, without departing from the teachings of the inventive concept, a first element / operation in some embodiments may be referred to as a second element / operation in other embodiments.

[0062] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0063] Furthermore, to better illustrate this disclosure, numerous specific details are set forth in the following detailed description. Those skilled in the art will understand that this disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of this disclosure.

[0064] Figure 1 A flowchart illustrating a DRAM row hammering defense method according to an embodiment of the present disclosure is shown. Figure 1 As shown, this method is applied to a DRAM controller and includes:

[0065] In step S11, the row identifier of the row activation command requesting DRAM is obtained;

[0066] The DRAM controller first obtains the row identifier of the row activation command requesting DRAM.

[0067] Row activation commands are fundamental commands in DRAM operations, used to activate specific rows for data read and write operations. Row activation commands can be initiated by upper-layer applications, such as commands requested by applications performing normal business processing, or they could be requests for row hammer attacks. The row identifier, which can be a row address, is a key component of this command, specifying the specific row in DRAM that needs to be activated.

[0068] By acquiring the row identifier, the DRAM controller can accurately identify the row involved in the current operation, thereby providing basic information for further row hammer monitoring and defense operations.

[0069] In step S12, if the row identifier does not exist in the entry container and the entry container is not full, the row identifier and the corresponding activation count are stored in the entry container; the entry container includes M monitoring entries, where M is a positive integer much smaller than the total number of rows in the DRAM storage.

[0070] The DRAM controller checks whether the row identifier just acquired already exists in the entry container, which is used to monitor row activation frequency. The entry container records frequently activated rows in order to determine whether there are signs of row hammering attacks. In one example, the entry container can be a table used to store data.

[0071] If the controller detects that a row identifier is not in the entry container, and the entry container has not yet reached its maximum capacity (i.e., it is not full), the controller can create a new entry for this new row identifier in the entry container. This new entry not only stores the row identifier itself but also records an initial activation count. The activation count records the number of times the row has been activated; the count increases each time a row activation command is executed for that row. For example, when a row identifier is recorded for the first time, its initial activation count can be set to 1, indicating that the row has been activated once.

[0072] For example, suppose the DRAM memory has 1024 rows, and the size M of the entry container is set to 8. This means the entry container can only record the activation status of 8 rows simultaneously. When a new row identifier (e.g., row address 0x123) is acquired, if the entry container does not yet record this row identifier, and the entry container currently only records 5 row identifiers, then the controller will create a new entry for row address 0x123 in the entry container and initialize the activation count to 1. In this way, the entry container can dynamically record the rows most likely to be frequently activated, thus effectively monitoring potential row hammer attacks.

[0073] It is important to note that the size of the entry container can be determined based on specific needs. The number of entries is M, where M is a positive integer and is much smaller than the total number of rows in the DRAM storage. In other words, the entry container does not record the activation status of every row in the DRAM, but rather records the rows that are frequently activated. These are the rows most likely to become targets of row hammer attacks, thus conserving storage resources.

[0074] In this way, the entry container can efficiently complete the monitoring task while maintaining low storage overhead, and promptly identify those rows that are abnormally frequently activated, providing key information for subsequent row hammer defense operations.

[0075] In step S13, if the row identifier does not exist in the entry container and the entry container is full, based on the activation count and / or access sequence recorded in the entry container, one entry in the entry container is replaced with the entry attribute of the new row identifier.

[0076] If the entry container is full, but there are still new rows that need to be recorded, the controller needs to free up space in the full entry container to store the new row identifier. The controller can determine which entries need to be replaced based on the activation count and / or access sequence of the entries already recorded in the entry container.

[0077] Activation count represents the number of times each entry's row has been activated. If an entry has a low activation count, it means that the row is activated infrequently, and therefore, the entry can be considered not a target of a row-based hammer attack. Access sequence, on the other hand, represents the chronological order in which each entry was last accessed. If an entry has an earlier access sequence, meaning it hasn't been accessed for a long time, then it can also be considered not a target of a row-based hammer attack.

[0078] Based on activation counts and / or access sequence, the controller can replace an entry in the entry container with an entry attribute of the new row identifier. Specifically, the controller can choose to replace the entry with the lowest activation count or the entry with the earliest access sequence. This ensures that the row identifier most likely to be the target of a row hammer attack is always retained in the entry container.

[0079] In step S14, if any activation count in the entry container exceeds the row activation threshold, the corresponding row is identified as the attack row for row hammering, and defense is performed.

[0080] The DRAM controller continuously monitors the activation count of each entry in the entry container, which records the frequency at which the corresponding row is activated. When the activation count of any entry in the entry container exceeds a preset row activation threshold, the controller can identify the corresponding row as the attack row for row hammering and execute defense.

[0081] The row activation threshold can be dynamically adjusted based on different DRAM types, system configurations, and security requirements. For example, for some systems with high security requirements, this threshold can be set lower to detect potential attacks earlier; while for systems with lower security requirements, this threshold can be set lower to reduce false alarms.

[0082] Once the corresponding row is identified as the attacking row for row hammering, defensive measures can be implemented, such as refreshing the attacked row. For details, please refer to the possible implementation methods provided in this disclosure, which will not be elaborated here.

[0083] In this embodiment, the row hammering method is implemented by the DRAM controller hardware. It obtains the row identifier of the requesting DRAM row activation command. If the row identifier does not exist in the entry container and the entry container is not full, it stores the row identifier and its corresponding activation count in the entry container. The entry container includes M monitoring entries, where M is a positive integer much smaller than the total number of rows in the DRAM memory. If the row identifier does not exist in the entry container and the entry container is full, based on the activation count and / or access timing recorded in the entry container, one entry in the entry container is replaced with an entry attribute of the new row identifier. If any activation count in the entry container exceeds the row activation threshold, the corresponding row is identified as the attack row for row hammering, and defense is performed. Therefore, by maintaining an entry container containing only M monitoring entries in the DRAM controller, where M is a positive integer much smaller than the total number of rows in the DRAM memory, and storage or replacement operations are only performed when the row identifier does not exist in the entry container, the DRAM controller does not need to maintain an activation counter for each row in a massive number of DRAM rows. This significantly reduces the required hardware storage resources and substantially lowers chip area overhead and related power consumption.

[0084] Furthermore, by employing a dynamic entry replacement strategy based on activation counts and / or access timing, this small-capacity entry container can efficiently track and filter out suspicious rows with the highest activation frequency within the current time period, achieving effective monitoring of millions of DRAM row address spaces with minimal resource overhead. By accurately identifying the attacking row and executing defenses when any activation count exceeds the row activation threshold, precise and efficient detection and real-time response to row hammer attacks are achieved.

[0085] In one possible implementation, the fields of the entries in the entry container include a minimum activation count. Based on the activation count recorded in the entry container, replacing one entry in the entry container with the entry attribute of the new row identifier includes: replacing the entry in the entry container whose minimum activation count value is true; comparing the activation counts of all entries in the entry container, and setting the minimum activation count of the entry with the smallest activation count value to true.

[0086] In this implementation, the entry container is designed such that each entry not only records the row identifier and activation count, but also contains a field to mark whether the entry has a minimum number of activations. This field can be called "MNA" (Minimum Number of Activations).

[0087] After storing a new entry in the entry container, the MNA value is updated. Then, when an entry in the entry container needs to be replaced, the entry with the minimum activation count in the entry container that is true can be directly replaced without having to compare the activation count again.

[0088] When a new entry is stored in the entry container, the DRAM controller iterates through all entries in the replaced entry container and compares the activation count of each entry. The activation count records the number of times the row has been activated; a lower activation count means that the row is activated less frequently and is therefore considered less likely to be a target of a row hammer attack.

[0089] During the comparison, the controller finds the entry with the lowest activation count and sets its MNA field to true (e.g., marked as 1). This ensures that the controller can identify the entry with the fewest activations in the current entry container.

[0090] After iterating through the activation counts of all entries, the entry with the fewest activation counts can be identified and marked, and its MNA field value can be set to true, for example, 1.

[0091] For example, assuming the size M of the entry container is 4, the entries in the current entry container and their activation counts are shown in the table below:

[0092]

[0093] If a new row identifier (e.g., 0x005) needs to be recorded, the controller immediately determines entry 3 as the entry for the row with the lowest activation count based on the value of the MNA field and replaces it. The controller then replaces entry 3 with the new row identifier 0x005, sets the new activation count to 1, and resets the value of the MNA field. In the replaced entry container, the activation counts of all entries are compared. In this example, entry 3 has the lowest activation count (1), so its MNA field is set to the true value 1. The replaced entry container is as follows:

[0094]

[0095] In this embodiment, since the solution is implemented in hardware, the minimum activation count (MNA) field is introduced to mark the entry with the fewest activations. This ensures that when a new row needs to be assigned an entry, the replacement operation is immediate; that is, only the entry with the smallest MNA value is selected for replacement without waiting for comparison results, thereby reducing critical path latency. This significantly reduces the complexity of hardware logic and operational latency, improving system response speed. After replacement, the activation count is compared again to determine the minimum activation count, and the value of the minimum activation count is updated, facilitating rapid replacement operations the next time an entry needs to be updated. Furthermore, since the row with the smallest activation count in the entry container is often not the row targeted by row hammer attacks, it ensures that the entry container always retains the row identifiers most likely to be the targets of row hammer attacks. In this way, the controller can more effectively monitor and identify potential row hammer attacks, thereby improving system security and reliability.

[0096] In one possible implementation, comparing the activation counts of all entries in the entry container includes: using a binary comparison method, starting from the first entry in the entry container, sequentially comparing the activation counts of two adjacent entries, selecting the entry with the smaller activation count and continuing to compare it with the next entry, until the entry with the smallest activation count is determined.

[0097] In this implementation, to determine the entry with the smallest activation count in the entry container, an efficient binary search method can be used when comparing the activation counts of all entries in the entry container. The binary search method can start from the first entry in the entry container and compare the activation counts of adjacent entries sequentially.

[0098] Specifically, the controller first compares the activation counts of the first and second entries, selects the entry with the smaller activation count, and then compares this entry with the next entry (i.e., the third entry). This comparison is performed continuously, selecting the entry with the smaller activation count in each comparison and continuing to compare it with the next entry, until all entries in the entry container have been traversed, and finally the entry with the smallest activation count is determined.

[0099] In this embodiment, the binary comparison method not only improves the efficiency of finding the entry with the minimum activation count but also reduces the number of comparison operations, thereby reducing the complexity and resource consumption of the hardware implementation. In this way, the controller can quickly locate the entry with the fewest activation counts and efficiently perform the entry replacement operation, ensuring that the entry container always records the row identifiers most likely to become targets of row hammer attacks. This method is particularly suitable for hardware implementation, reducing hardware resource usage and improving the overall system performance while ensuring operational efficiency.

[0100] In one possible implementation, the fields of the entries in the entry container include access sequence, where the relative sequence of each entry is represented by an order value. The step of storing the row identifier and its corresponding activation count in the entry container when the row identifier does not exist in the entry container and the entry container is not full includes: storing the row identifier and its corresponding activation count in the entry container, setting the order value of the access sequence to a preset maximum value, and decrementing the value of the sequence field of the remaining entries in the entry container by 1.

[0101] In this implementation, the fields of the entries in the entry container include access order, which can be Least Recently Used (LRU). The access order field can use an order value to represent the relative order of each entry. The access order field records the order in which entries are accessed; a larger order value indicates that the entry was accessed more recently, and a smaller order value indicates that the entry has not been accessed for a longer period of time.

[0102] Therefore, if the row identifier does not exist in the entry container and the entry container is not full, the row identifier and its corresponding activation count can be stored in the entry container, and the access sequence value can be set to a preset maximum value. Simultaneously, to maintain the correctness of the access sequence, the value of the sequence field of the remaining entries in the entry container is decremented by 1. This way, the access sequence values ​​of all other entries will decrease accordingly, ensuring that the access sequence value of the new entry is the maximum, indicating that the new entry is the most recently accessed.

[0103] For example,

[0104] Assuming the size M of the entry container is 4, the entries in the current entry container, their activation counts, and access sequences (LRU field) are shown in the table below:

[0105]

[0106] If a new row identifier (e.g., 0x005) needs to be recorded and the entry container is not full, the controller stores the new row identifier. This means creating a new entry for the new row identifier 0x005 in the entry container and initializing the activation count to 1. Then, it sets the access sequence, setting the LRU field of the new entry to a preset maximum value; in this example, let's assume the maximum value is 3. Next, it updates the access sequences of other entries, decrementing the access sequence field values ​​of the remaining entries in the entry container by 1. This way, the access sequence values ​​of all other entries will decrease accordingly.

[0107] The updated entry container is as follows:

[0108]

[0109] In this embodiment of the disclosure, by setting the access sequence value of a new entry to the maximum, it is indicated that the row of that entry has been accessed most recently. At the same time, the access sequence values ​​of other entries are correspondingly reduced, ensuring the correctness of the access sequence and the dynamic updating of the entry container. This effectively manages the entries in the entry container and ensures the correctness of the access sequence, so that reasonable decisions can be made when it is necessary to replace an entry.

[0110] In one possible implementation, replacing an entry in the entry container with a new row identifier's entry attribute includes: when a new row identifier needs to be replaced into a full entry container, selecting the entry with the smallest order value in the access sequence field for replacement, setting the order value of the new entry's sequence field to a preset maximum value, and decrementing the value of the sequence field of the remaining entries by 1.

[0111] When the entry container is full and a new row identifier needs to be recorded, the controller needs to select an entry from the entry container to replace it. The controller can determine which entry will be replaced based on the access sequence field of each entry. The sequence value in the access sequence field indicates the relative time order in which the entries were accessed; the smaller the value, the longer the entry has not been accessed.

[0112] The controller can find the entry with the smallest sequence value in the access sequence field, meaning this entry is the least visited entry in the entry container, and this entry will be selected for replacement. The controller then sets the new entry's sequence value, creating a new entry among the replaced entries to store the new row identifier and its initial activation count. Simultaneously, the new entry's access sequence field sequence value is set to a preset maximum value. This maximum value indicates that the new entry was most recently visited, ensuring its position in the access sequence is up-to-date.

[0113] To maintain the correctness of the access sequence field, the controller decrements the value of the access sequence field of all other entries in the entry container by 1. This causes the access sequence values ​​of all other entries to decrease accordingly, ensuring that the new entry has the maximum access sequence value, indicating that it is the most recently accessed entry.

[0114] For example, assuming the size M of the entry container is 4, the entries in the current entry container, their activation counts, and access sequences (LRU fields) are shown in the table below:

[0115]

[0116] If a new row identifier (such as 0x005) needs to be recorded, and the entry container is full, the controller will perform the following steps:

[0117] When a replacement entry is selected, the controller finds the entry with the smallest sequence value in the access timing field. In this example, entry 4 has an access timing value of 0, which is the smallest, so entry 4 will be selected for replacement.

[0118] When a new entry's timing value is set, the controller creates a new entry to store the new row identifier 0x005 and its initial activation count (let's say 1). Simultaneously, the access timing field's sequence value for the new entry is set to a preset maximum value. In this example, let's assume the maximum value is 3.

[0119] When updating the timing values ​​of other entries, the controller decrements the access timing field values ​​of the remaining entries in the entry container by 1. This reduces the access timing values ​​of all other entries accordingly.

[0120]

[0121] In this embodiment, when a new row identifier needs to be replaced in a full entry container, the entry with the smallest access sequence value in the access sequence field is selected for replacement. The new entry has the largest access sequence value, indicating that it was recently accessed. Simultaneously, the access sequence values ​​of other entries are correspondingly reduced, ensuring the correctness of the access sequence and the dynamic update capability of the entry container. This method effectively manages the entries in the entry container, ensuring the correctness of the access sequence and the dynamic update capability of the entry container, so as to make reasonable decisions when an entry needs to be replaced.

[0122] In one possible implementation, replacing an entry in the entry container with the entry attribute of the new row identifier includes: when the row corresponding to an existing entry in the entry container is activated again, changing the original sequence value in the time sequence field of that entry to a preset maximum value, and decrementing the values ​​in the time sequence fields of the remaining entries that are greater than the original sequence value by 1.

[0123] When a row identifier already existing in the entry container is reactivated, the controller detects this event, meaning the row corresponding to that identifier has been accessed multiple times within a short period. Upon reactivation of a row identifier already in the entry container, the controller changes the original sequence value in the entry's timing field to a preset maximum value. This entry is then marked as the most recently accessed entry, ensuring its position in the entry container is up-to-date.

[0124] To maintain the correctness of the timing field, the controller checks the timing field of the remaining entries in the entry container. If the timing field value of an entry is greater than the original order value, the controller decrements its value by 1, ensuring that the timing field values ​​of all other entries are reduced accordingly, thereby maintaining the timing order of the entire entry container.

[0125] For example, assuming the size M of the entry container is 4, the entries in the current entry container, their activation counts, and access sequences (LRU fields) are shown in the table below:

[0126]

[0127] If row identifier 0x002 is activated again, the controller will perform the following steps:

[0128] Update the access sequence field: Change the access sequence field of entry 2 from 1 to the preset maximum value of 3. Thus, entry 2 now represents the most recently accessed entry.

[0129] Adjust other entries: Check the timing fields of other entries. Entry 1's timing field value is 2, which is greater than the original timing value 1, so its value is decreased by 1, becoming 1. Entry 3's timing field value is 0, which is less than the original timing value 1, so it remains unchanged. Entry 4's timing field value is 3, which is greater than the original timing value 2, so it is decreased by 1, becoming 2.

[0130] The updated entry container is as follows:

[0131]

[0132] In this embodiment, when a new row identifier needs to replace an already full entry container, the entry with the smallest sequence value in the access sequence field is selected for replacement, and the sequence value of the new entry's sequence field is set to a preset maximum value. The sequence field values ​​of the remaining entries are decremented by 1. This ensures the correctness of the sequence order of the entire entry container, effectively manages the entries in the entry container, ensures the correctness of the access sequence, and guarantees the dynamic update capability of the entry container, enabling reasonable decisions to be made when an entry needs to be replaced.

[0133] The instruction manual indicates that the entry container can contain both an access-order LRU and a minimum activation count (MNA) simultaneously. Users can configure and select the corresponding detection strategy during use. An entry container containing both LRU and MNA is shown in the table below.

[0134]

[0135] In one possible implementation, after identifying the corresponding row as the attack row for row hammering, the method further includes: embedding a refresh management RFM flag in an existing command issued to the attack row to notify the DRAM to record the address of the attack row; sending a DRFM command to the DRAM to trigger the DRAM's internal refresh mechanism to refresh the victim row.

[0136] In this implementation, after the DRAM controller identifies an attack line through its dynamic monitoring mechanism, it will take an efficient defense process against DRAM chips that support Directional Refresh Management (DRFM).

[0137] At this point, an RFM flag can be embedded in the existing commands issued to the attack line. This command can be a command that the DRAM controller must issue to the attack line for normal read and write operations.

[0138] For example, the PRE command: when an attack line ends its access, the controller must issue a PRE command to close the current line and prepare for accessing a new line; the RD / WR command, combined with the Auto-Precharge flag, allows the controller to set the Auto-Precharge flag while issuing a read or write command, instructing the DRAM to automatically perform precharge after completing the current read or write operation.

[0139] In other words, the controller will not generate a new, additional command specifically to notify the DRAM. Instead, it will reserve or set the RFM flag in a specific bit field within the existing precharge command or the command packet with the Auto-Precharge RD / WR command.

[0140] When a command with the RFM flag inserted arrives at the DRAM chip, the DRAM performs its main operation (precharge or read / write) as if it were a normal command, but simultaneously parses and responds to the RFM flag. This flag's purpose is to notify the internal logic of the DRAM that the row address carried by the current command needs to be sampled and temporarily stored. In this way, the DRAM accurately knows which row is the attack row.

[0141] Then, the DRAM controller can send a separate, dedicated DRFM command to the same DRAM memory bank. Upon receiving this command, the DRFM chip will activate its internal refresh circuitry. Based on the previously sampled and stored attack row address, the DRFM chip will determine, through its internal DRAM logic, the specific victim row (usually a physically adjacent row) that needs to be refreshed, and perform an additional refresh operation on it.

[0142] In other words, the actual refresh operation is performed by the DRAM chip itself. The controller does not need to concern itself with the complex physical layout mapping relationship inside the DRAM; it only needs to issue commands. This ensures both the accuracy and reliability of refreshing the affected row and simplifies the controller design.

[0143] In this embodiment of the disclosure, by embedding the RFM flag in the existing, necessary memory access commands instead of generating additional dedicated commands to transmit sampling information, this scheme reduces the DRAM command bus overhead caused by Row Hammer defense, thereby eliminating the negative impact on memory bandwidth and access latency, and ensuring that the system can maintain peak performance while effectively defending against attacks.

[0144] Furthermore, by delegating the determination of the affected row and the final refresh operation to the internal mechanism of the DRAM chip, the inherent characteristics of DRAM are fully utilized to ensure the accuracy and efficiency of the refresh operation. On the other hand, the design complexity of the DRAM controller is reduced, eliminating the need to integrate physical layout information from all DRAM manufacturers, thus enhancing the versatility and portability of the solution.

[0145] In one possible implementation, after identifying the corresponding row as the attack row for row hammering, the method further includes: generating a pseudo-read instruction for the victim row, wherein the pseudo-read instruction is a non-business read request; converting the pseudo-read instruction into a row activation (ACT), read data (RD), and precharge (PRE) command sequence through a DRAM command scheduling module and a DRAM protocol control module, and sending it to the DRAM to force refresh the victim row; receiving read data returned from the victim row, and performing error checking and correction (ECC) operations on the read data; if a correctable error is detected, writing the corrected data back to the victim row.

[0146] This implementation is a versatile defense mechanism that does not rely on new DRAM features. The DRAM controller actively initiates a pseudo-read operation to force a refresh, and provides data error correction capabilities on this basis.

[0147] The DRAM controller generates a fake read instruction targeting the victim row. This fake read instruction is a non-business read request, meaning it doesn't originate from a genuine data demand from the processor, graphics card, or other computing units. Instead, it's an instruction initiated by the DRAM controller to defend against RowHammer attacks. The target row address of this instruction is a victim row address pre-calculated based on the attack row; the specific address is not detailed here.

[0148] The pseudo-read instruction is sent to the standard DRAM command processing pipeline and converted into the ACT->RD->PRE command sequence. The command scheduling module in the DRAM controller will schedule it as a normal read request and arrange its execution timing to avoid conflicts with other normal service requests and optimize bus efficiency.

[0149] The protocol control module in the DRAM controller can translate this pseudo-read instruction into a series of low-level physical commands that the DRAM chip can recognize, according to the Joint Electron Device Engineering Council Dynamic Random Access Memory (JEDEC DRAM) protocol specification: Row Activation Command (ACT) to open the victim row, Read Command (RD) to read data, and Precharge Command (PRE) to close the row.

[0150] The aforementioned ACT->RD->PRE sequence is sent to the DRAM chip. Regardless of whether the data read is useful, executing this complete sequence will perform a complete "read-amplify-rewrite" process on the storage capacitance of the target row (victim row).

[0151] In other words, the operation initiated by this fake read instruction is equivalent to a forced, additional refresh of the victim row, which promptly replenishes the charge that was accelerated by the Row Hammer attack, thereby effectively preventing bit flips.

[0152] After sending the dimension command, the DRAM chip will respond to the command and return the read data, which will then be returned to the DRAM controller.

[0153] The ECC error correction circuit within the controller verifies this data. If a single-bit error is detected, the ECC logic immediately corrects it. Subsequently, the controller initiates a write-back operation to rewrite the corrected data back to the original address of the victim line.

[0154] In this embodiment of the disclosure, by generating pseudo-read instructions internally by the controller and reusing existing command scheduling and protocol control modules, this solution does not rely on any special functions of the DRAM chip (such as DRFM), thus possessing strong versatility and backward compatibility. It can be applied to various models and brands of DRAM chips, providing a widely applicable solution for solving Row Hammer attacks.

[0155] Furthermore, by converting the pseudo-read instruction into a standard ACT->RD->PRE command sequence, the basic operation timing of DRAM is cleverly utilized to achieve the physical effect of refreshing the victim row, thus achieving reliable defense capabilities with minimal hardware design changes and effectively resisting Row Hammer attacks.

[0156] Finally, by performing ECC verification and error correction on the returned data and writing it back, after completing the defensive refresh, it can proactively detect and repair single-bit flip errors that have already occurred due to the attack, thereby significantly improving the reliability and robustness of the storage system.

[0157] In one possible implementation, the method further includes: in response to a user's configuration instruction for the defense strategy, determining a DRAM row hammer defense strategy executed by the DRAM controller, the defense strategy including: a DRFM-based defense strategy and a pseudo-read instruction-based defense strategy.

[0158] In this implementation, the DRAM controller's operating mode is not fixed, but can dynamically select and enable different defense strategies in response to configuration commands from system software or users. The behavior of the entire defense mechanism can be flexibly adjusted according to actual needs.

[0159] Specifically, users or system designers can issue commands to the DRAM controller through a software interface (such as a configuration register) to select the defense strategy to be activated from a predefined strategy library. These defense strategies mainly include two types: the first is a defense strategy based on Directed Refresh Management (DRFM), which is suitable for new DRAM chips that support such advanced functions and achieves efficient and accurate refresh by coordinating with the internal mechanisms of the DRAM; the second is a defense strategy based on pseudo-read commands, which has broad applicability, does not depend on specific DRAM characteristics, and achieves the refresh purpose by having the controller actively initiate specific access sequences.

[0160] In this disclosed embodiment, this configurable architecture provides a unified and flexible hardware design solution. For example, when the system uses GDDR7 memory that supports DRFM, the user can configure and enable a DRFM-based strategy to achieve optimal performance and efficiency; while when the system uses conventional DDR4 memory that does not support DRFM, the user can configure and switch to a pseudo-read instruction-based strategy to ensure that the defense function remains available. This flexibility allows the same DRAM controller design to adapt to multiple memory solutions, greatly enhancing its application range, while allowing users to make their own trade-offs between performance and compatibility.

[0161] In one possible implementation, the method further includes: performing a configuration operation in response to a user's configuration instruction for configurable parameters; the configurable parameters include at least one of the following: a row activation threshold; the number M of monitored entries in the entry container; a row replacement strategy, which can be configured as a replacement strategy based on access timing or a replacement strategy based on activation count; and the range of victim rows affected by the attacking row.

[0162] In this implementation, the user can also configure multiple configurable parameters, including at least one of the following: row activation threshold; the number M of monitored entries in the entry container; row replacement strategy, which can be configured as a replacement strategy based on access time sequence or a replacement strategy based on activation count; and the range of victim rows affected by the attacking row.

[0163] The row activation threshold (Rowhammer_TH) directly determines the sensitivity of the monitoring mechanism in identifying attack rows. The lower the threshold is set, the more sensitive the system is to frequently accessed rows and the more proactive the defense will be, but it may increase the probability of false alarms. Conversely, a higher threshold can reduce false alarms, but may slightly increase the defense latency.

[0164] The number of monitored entries M in the entry container allows users to directly weigh hardware resource overhead against monitoring accuracy; a larger M value enables the entry container to track more suspicious lines simultaneously, making it suitable for scenarios with high security requirements, while a smaller M value can maximize chip area and power consumption savings.

[0165] The row replacement strategy offers two options: users can choose between the LRU (Least Recently Used) strategy based on access time and the MNA (Minimum Activation Count) strategy based on activation count to better match the memory access pattern characteristics of the current system and optimize the utilization efficiency of the entry container.

[0166] Furthermore, the parameter of the range of affected rows affected by the attack row allows the solution to be adapted to different DRAM manufacturers' chips. This is because the internal physical layout and inter-row interference models of DRAM from different manufacturers may differ. This parameter can be used to precisely define the range of adjacent rows that need to be refreshed, ensuring the accuracy of the defense.

[0167] With this series of parameters, the same DRAM controller hardware design can be deployed in an optimized manner to various products, from cost-sensitive consumer electronics to servers and data centers with extremely high reliability requirements. Through parameter configuration, the software can be configured to adapt to the challenges brought by future new DRAM chips without modifying the hardware circuitry.

[0168] According to one aspect of this disclosure, a DRAM row hammering defense system is also provided. Figure 2 This diagram illustrates a block diagram of a DRAM row hammer defense system according to an embodiment of the present disclosure, such as... Figure 2 As shown, the system 20 includes:

[0169] The DRAM command scheduling module 21 is used to receive row activation commands requesting DRAM and send them to DRAM;

[0170] The dynamic row activation monitoring module 22 is used to obtain the row identifier of the row activation command, execute the above method to determine the attack row of the row hammer, and send the address of the attack row to the insertion request module;

[0171] The insertion request module 23 is used to embed a refresh management RFM flag in the command issued by the DRAM command scheduling module to the attack line, so as to notify the DRAM to record the address of the attack line; and send a DRFM command to the DRAM to trigger the DRAM's internal refresh mechanism to refresh the victim line.

[0172] The DRAM command scheduling module receives read / write requests from the user interface or specific requests generated internally by the controller (such as pseudo-read instructions issued by the victim row refresh module), and then sends the command to the DRAM to perform read / write operations. The read / write requests from the user interface can be issued by the user or by a row hammer attack.

[0173] The specific execution flow of the above-mentioned dynamic row activation monitoring module and insertion request module can be found in the method embodiments provided in this disclosure, and will not be repeated here.

[0174] The following describes an application scenario of an embodiment of this disclosure. Figure 3 A block diagram of another DRAM row hammering defense system according to an embodiment of the present disclosure is shown, such as Figure 3 As shown, the specific execution flow of this system includes:

[0175] During the monitoring phase, the dynamic row activation monitoring module continuously monitors all row activation commands (ACTCMD) requesting DRAM and efficiently identifies suspicious Row Hammer attack rows (RH_Row) based on parameters such as the number of monitoring entries, row replacement mode, and Rowhammer threshold preset through the APB configuration channel. After an attack row is identified, its address is simultaneously sent to the insertion request module and the victim row refresh module, triggering the defense process.

[0176] Once the defense phase begins, the corresponding defense is executed according to the user-defined preset strategy. For DRAM that supports DRFM, the insertion request module embeds the AutoPre and RFM flags into the normal read / write commands issued by the scheduler to the attack line; after receiving these commands, the DRAM protocol control module converts them into DRAM commands (DRAM CMD) carrying special flags, ultimately triggering the DRAM chip to perform efficient targeted refresh.

[0177] For DRAMs that do not support DRFM or specific configuration scenarios, the victim row refresh module will generate a pseudo-read instruction for the configured victim row. This instruction is also converted into a standard ACT->RD->PRE sequence and sent to DRAM via the DRAM command scheduling module and the DRAM protocol control module, thereby refreshing the victim row by forcing a "read-rewrite" operation.

[0178] The false read operation issued by the victim row refresh module will be verified by the ECC module after the data is returned. If the verification result finds a single bit flip error, the module will immediately instruct the scheduler to initiate a rewrite command to write the corrected data back to DRAM. This further ensures the integrity of the data on the basis of defending against Row Hammer attacks, forming a complete closed loop that combines monitoring, defense and error correction.

[0179] According to one aspect of this disclosure, a DRAM row hammering protection device is provided, applied to a DRAM controller. Figure 4 A block diagram of a DRAM row hammering defense device according to an embodiment of the present disclosure is shown, such as Figure 4 As shown, the device 30 includes:

[0180] The acquisition module 31 is used to acquire the row identifier of the row activation command requesting DRAM;

[0181] Storage module 32 is used to store the row identifier and its corresponding activation count in the entry container when the row identifier does not exist in the entry container and the entry container is not full; the entry container includes M monitoring entries, where M is a positive integer much smaller than the total number of rows in the DRAM storage.

[0182] Replacement module 33 is used to replace an entry in the entry container with the entry attribute of the new row identifier when the row identifier does not exist in the entry container and the entry container is full, based on the activation count and / or access sequence recorded in the entry container.

[0183] The determination module 34 is used to determine the corresponding row as the attack row for row hammering when any activation count in the entry container exceeds the row activation threshold, and to perform defense.

[0184] In one possible implementation, the fields of the entries in the entry container include a minimum activation count, and the replacement module is configured to:

[0185] Replace the entry in the entry container whose minimum activation count is true;

[0186] Compare the activation counts of all entries in the replaced entry container, and set the minimum activation count of the entry with the smallest activation count to true.

[0187] In one possible implementation, the replacement module is used to:

[0188] The binary comparison method is used. Starting from the first entry in the entry container, the activation counts of adjacent entries are compared in turn. The entry with the smaller activation count is selected to continue the comparison with the next entry until the entry with the smallest activation count is determined.

[0189] In one possible implementation, the fields of the entries in the entry container include access sequence, where the relative sequence of each entry is represented by an order value.

[0190] The storage module 22 is used for:

[0191] The row identifier and its corresponding activation count are stored in the entry container, the access timing sequence value is set to a preset maximum value, and the timing field value of the remaining entries in the entry container is decremented by 1.

[0192] In one possible implementation, the replacement module 23 is configured to:

[0193] When a new entry needs to be added to a full entry container, the entry with the smallest sequence value in the access sequence field is selected for replacement, and the sequence value of the new entry's sequence field is set to the preset maximum value. The sequence field values ​​of the remaining entries are decremented by 1.

[0194] In one possible implementation, the replacement module 23 is configured to:

[0195] When a row corresponding to an existing entry in the entry container is activated again, the original sequence value in the time sequence field of that entry is changed to the preset maximum value, and the values ​​in the time sequence fields of the remaining entries that are greater than the original sequence value are reduced by 1.

[0196] In one possible implementation, the apparatus further includes an insertion request module for:

[0197] Embed a refresh management RFM flag in the existing command issued to the attack line to notify the DRAM to record the address of the attack line;

[0198] Send a DRFM command to the DRAM to trigger the DRAM's internal refresh mechanism to refresh the affected row.

[0199] In one possible implementation, the device further includes:

[0200] The victim row refresh module is used to generate a pseudo-read instruction for the victim row, wherein the pseudo-read instruction is a non-business read request; through the DRAM command scheduling module and the DRAM protocol control module, the pseudo-read instruction is converted into a row activation ACT, read data RD and precharge PRE command sequence and sent to the DRAM to force refresh the victim row;

[0201] The error verification and correction module is used to receive read data returned from the victim line, perform error verification and correction (ECC) operations on the read data, and if a correctable error is detected, write the corrected data back to the victim line.

[0202] In one possible implementation, the device further includes:

[0203] The configuration module is used to determine the DRAM row hammer defense strategy executed by the DRAM controller in response to the user's configuration command for the defense strategy. The defense strategy includes: a DRFM-based defense strategy and a pseudo-read command-based defense strategy.

[0204] In one possible implementation, the configuration module is used for:

[0205] In response to user commands to configure configurable parameters, perform configuration operations;

[0206] The configurable parameters include at least one of the following:

[0207] Row activation threshold;

[0208] The number of monitored entries M in the entry container;

[0209] The row replacement strategy can be configured as a replacement strategy based on access time or a replacement strategy based on activation count;

[0210] The scope of the victim lines affected by the attack line.

[0211] According to another aspect of this disclosure, a chip is provided, including the aforementioned DRAM row hammer test apparatus.

[0212] According to another aspect of this disclosure, an electronic device is provided, including the chip described above.

[0213] In some embodiments, the functions or modules of the systems and apparatuses provided in this disclosure can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0214] Other components of the systems, chips, and electronic devices described in the above embodiments can be derived from various technical solutions now and in the future known to those skilled in the art, and will not be described in detail here.

[0215] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

[0216] In the description of this specification, it should be understood that the terms "center," "longitudinal," "transverse," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this disclosure and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this disclosure.

[0217] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this disclosure, "multiple" means two or more, unless otherwise explicitly specified.

[0218] In this disclosure, unless otherwise expressly specified and limited, the terms "installation," "connection," "linking," "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection, an electrical connection, or a communication connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this disclosure according to the specific circumstances.

[0219] In this disclosure, unless otherwise expressly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature being directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature being directly above or diagonally above the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0220] The foregoing disclosure provides many different implementations or examples for carrying out different structures of this disclosure. To simplify the disclosure, specific examples of components and arrangements have been described above. Of course, these are merely examples and are not intended to limit the scope of this disclosure. Furthermore, reference numerals and / or letters may be repeated in different examples; such repetition is for simplification and clarity and does not in itself indicate a relationship between the various implementations and / or arrangements discussed.

[0221] The above are merely specific embodiments of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this disclosure, and these should all be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

[0222] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A DRAM row hammer attack defense method, characterized in that, Applications in DRAM controllers include: Retrieve the row identifier of the row activation command requesting DRAM; If the row identifier does not exist in the entry container and the entry container is not full, the row identifier and the corresponding activation count are stored in the entry container; the entry container includes M monitoring entries, where M is a positive integer much smaller than the total number of rows in the DRAM storage. If the row identifier does not exist in the entry container and the entry container is full, based on the activation count and / or access sequence recorded in the entry container, replace one entry in the entry container with the entry attribute of the new row identifier; If any activation count in the entry container exceeds the row activation threshold, the corresponding row is identified as the attack row for row hammering, and defense is executed.

2. The method according to claim 1, characterized in that, The fields of the entries in the entry container include a minimum activation count. Based on the activation count recorded in the entry container, one entry in the entry container is replaced with the entry attributes of the new row identifier, including: Replace the entry in the entry container whose minimum activation count is true; Compare the activation counts of all entries in the replaced entry container, and set the minimum activation count of the entry with the smallest activation count to true.

3. The method according to claim 2, characterized in that, The activation count of all entries in the entry container after the comparison and replacement includes: The binary comparison method is used. Starting from the first entry in the entry container, the activation counts of adjacent entries are compared in turn. The entry with the smaller activation count is selected to continue the comparison with the next entry until the entry with the smallest activation count is determined.

4. The method according to claim 1, characterized in that, The fields of the entries in the entry container include access sequence, and the access sequence field uses an order value to represent the relative sequence of each entry; The step of storing the row identifier and its corresponding activation count in the entry container when the row identifier does not exist in the entry container and the entry container is not full includes: The row identifier and its corresponding activation count are stored in the entry container, the access timing sequence value is set to a preset maximum value, and the timing field value of the remaining entries in the entry container is decremented by 1.

5. The method according to claim 1, characterized in that, The step of replacing an entry in the entry container with the new row identifier's entry attribute includes: When a new entry needs to be added to a full entry container, the entry with the smallest sequence value in the access sequence field is selected for replacement, and the sequence value of the new entry's sequence field is set to the preset maximum value. The sequence field values ​​of the remaining entries are decremented by 1.

6. The method according to claim 1, characterized in that, The step of replacing an entry in the entry container with the new row identifier's entry attribute includes: When a row corresponding to an existing entry in the entry container is activated again, the original sequence value in the time sequence field of that entry is changed to the preset maximum value, and the values ​​in the time sequence fields of the remaining entries that are greater than the original sequence value are reduced by 1.

7. The method according to claim 1, characterized in that, After identifying the corresponding row as the attack row for row hammering, the method further includes: Embed a refresh management RFM flag in the existing command issued to the attack line to notify the DRAM to record the address of the attack line; Send a DRFM command to the DRAM to trigger the DRAM's internal refresh mechanism to refresh the affected row.

8. The method according to claim 1, characterized in that, After identifying the corresponding row as the attack row for row hammering, the method further includes: Generate a pseudo-read instruction for the victim's line, wherein the pseudo-read instruction is a non-business read request; The DRAM command scheduling module and DRAM protocol control module convert the fake read instruction into a sequence of row activation (ACT), read data (RD), and precharge (PRE) commands, and send it to the DRAM to force refresh the victim row. Receive read data returned from the victim line, and perform error verification and correction (ECC) operations on the read data; If a correctable error is detected, the corrected data is written back to the affected row.

9. The method according to claim 1, characterized in that, The method further includes: In response to the user's configuration command for the defense strategy, the DRAM row hammer defense strategy executed by the DRAM controller is determined, and the defense strategy includes: a defense strategy based on DRFM and a defense strategy based on pseudo-read commands.

10. The method according to claim 1, characterized in that, The method further includes: In response to user commands to configure configurable parameters, perform configuration operations; The configurable parameters include at least one of the following: Row activation threshold; The number of monitored entries M in the entry container; The row replacement strategy can be configured as a replacement strategy based on access time or a replacement strategy based on activation count; The scope of the victim lines affected by the attack line.

11. A DRAM row hammer attack defense system, characterized in that, The system includes: The DRAM command scheduling module is used to receive row activation commands requesting DRAM and send them to DRAM; The dynamic row activation monitoring module is used to obtain the row identifier of the row activation command, execute the method described in any one of claims 1-6, determine the attacking row of the row hammering, and send the address of the attacking row to the insertion request module; The insertion request module is used to embed a refresh management RFM flag in the command issued by the DRAM command scheduling module to the attack line, so as to notify the DRAM to record the address of the attack line; and send a DRFM command to the DRAM to trigger the DRAM's internal refresh mechanism to refresh the victim line.

12. A DRAM row hammer strike protection device, characterized in that, Applications in DRAM controllers include: The acquisition module is used to acquire the row identifier of the row activation command requesting DRAM; A storage module is used to store the row identifier and its corresponding activation count in an entry container when the row identifier does not exist in the entry container and the entry container is not full; the entry container includes M monitoring entries, where M is a positive integer much smaller than the total number of rows in the DRAM storage. The replacement module is used to replace an entry in the entry container with the entry attribute of the new row identifier when the row identifier does not exist in the entry container and the entry container is full, based on the activation count and / or access sequence recorded in the entry container. The determination module is used to identify the corresponding row as the attack row for row hammering when any activation count in the entry container exceeds the row activation threshold, and to perform defense.

13. A chip, characterized in that, Includes the DRAM row hammer test apparatus as described in claim 12.

14. An electronic device, characterized in that, Includes the chip according to claim 13.

Images