Apparatus and method for dynamic allocation of intruder detection

Abstract

Apparatus, systems, and methods for dynamic allocation of intruder detection. A memory can include an intruder address storage structure that tracks access patterns to row addresses and their associated bank addresses. These can be used to determine whether a row and bank address received as part of an access operation are intruder row and bank addresses. The intruder row address can be used to generate a refresh address for the bank identified by the intruder bank address. Because the intruder storage structure tracks row addresses and bank addresses, its storage space can be dynamically allocated among banks based on access patterns to those banks.

Description

Technical Field

[0001] This disclosure pertains to devices and methods for detecting aggressors in dynamically allocated systems. Background Technology

[0002] This disclosure generally relates to semiconductor devices, and more specifically, to semiconductor memory devices. Specifically, this disclosure relates to volatile memory, such as dynamic random access memory (DRAM). Information may be stored as physical signals in individual memory cells (e.g., charges on capacitive elements). The memory may be volatile, and the physical signals may decay over time (which may degrade or destroy the information stored in the memory cells). It may be necessary to periodically refresh the information in the memory cells by, for example, restoring the physical signals to their initial values ​​by rewriting the information.

[0003] As the size of memory components decreases, the density of memory cells increases significantly. Various access patterns to specific memory cells or groups of memory cells (often referred to as an attack) can lead to an increased rate of data degradation in neighboring memory cells. As part of a targeted refresh operation, the memory cells affected by the attack can be identified and refreshed. Memory can track access patterns to various memory addresses to determine if they are involved in an attack. However, tracking accesses to each address can be extremely memory-intensive. Summary of the Invention

[0004] In one aspect, this disclosure is directed to an apparatus comprising: a plurality of memory rows, each including a plurality of word lines; an intruder storage structure including a plurality of slots, each slot configured to store a row address associated with one of the plurality of word lines and a row group address associated with one of the plurality of rows; storage logic circuitry configured to receive the row address and the row group address, compare the received row address and the received row group address with a stored row address and a stored row group address in the plurality of slots, and determine whether the received row address and the row group address are an intruder row address and an intruder row group address; and a plurality of row decoders, each associated with one of the plurality of memory rows, wherein a selection of the plurality of row decoders is configured to refresh one or more of the plurality of word lines in the associated row based on the identified intruder row address, and wherein the selection of the plurality of row decoders is based on the intruder row group address.

[0005] In another aspect, this disclosure relates to a device comprising: an address decoder configured to provide a row address and an associated row group address as part of an access operation along an address bus; and an intruder detector circuit configured to update a count value based on the value of the row address and the value of the associated row group address, and to determine, in part based on the count value, that the row address and the row group address are intruders, wherein a refresh address is generated based on the determined intruder row and row group addresses.

[0006] In another aspect, this disclosure relates to a method comprising: performing an access operation by providing a row address and a row group address; receiving the row and row group addresses at an aggressor detector circuit; determining, in part, whether the received row and row group address is an aggressor row and row group address based on a match between the received row and row group address and one of a plurality of stored row and row group addresses in the aggressor detector circuit; and if the received row and row group address is an aggressor row and row group address, generating a refresh address based on the received row address and providing the refresh address to the row group based on the received row group address. Attached Figure Description

[0007] Figure 1 This is a block diagram of a semiconductor device according to an embodiment of the present disclosure.

[0008] Figure 2 This is a block diagram of a refresh control circuit according to an embodiment of the present disclosure.

[0009] Figure 3 This is a block diagram of a portion of a memory according to some embodiments of the present disclosure.

[0010] Figure 4 This is a block diagram of an attacker detector according to some embodiments of the present disclosure.

[0011] Figure 5 This is a block diagram of a method according to some embodiments of the present disclosure. Detailed Implementation

[0012] The following description of certain embodiments is exemplary in nature and is in no way intended to limit the scope of this disclosure or its application or use. In the following detailed description of embodiments of the systems and methods of the invention, reference is made to the accompanying drawings, which form a part of this document, and to specific embodiments of the described systems and methods shown in the illustrations. These embodiments are described in sufficient detail to enable those skilled in the art to practice the currently disclosed systems and methods, and it should be understood that other embodiments may be utilized, and structural and logical changes may be made without departing from the spirit and scope of this disclosure. Furthermore, for clarity, detailed descriptions of certain features will not be elaborated where they would be obvious to those skilled in the art, so as not to obscure the description of embodiments of this disclosure. Therefore, the following detailed description should not be construed in a limiting sense, and the scope of this disclosure is limited only by the appended claims.

[0013] Information in volatile memory devices can be stored in memory cells (e.g., as charge on capacitive elements) and can decay over time. In each row of a memory array, memory cells can be organized into rows (word lines) and columns (bit lines). Memory cells can be refreshed on a row-by-row basis. To prevent information loss or corruption due to this decay, the memory can implement a background refresh process, such as an automatic refresh operation as part of a self-refresh mode. During a refresh operation, information can be rewritten to word lines to restore its initial state. Automatic refresh operations can be performed on word lines of memory in a sequence, such that the word lines of memory are refreshed over time at a rate faster than the expected rate of data degradation.

[0014] For example, various attack patterns involving repeated access to specific rows of memory (e.g., the attacker row) may cause an increased rate of decay in adjacent rows (e.g., the victim row) due to factors such as electromagnetic coupling between rows. These repeated access patterns can be termed 'row hammers'. These repeated accesses can be part of an intentional attack on the memory and / or may be attributable to the memory's 'natural' access patterns. The increasing rate of decay in the victim row may necessitate that it be refreshed as part of a targeted refresh operation to prevent information loss.

[0015] The memory can track accesses to different rows to determine which rows are attackers. Attacker detector circuitry can store the addresses of potential attackers for each row (e.g., addresses of previously accessed rows) and compare those stored row addresses with the currently accessed row address. The memory's ability to accurately capture attacker addresses depends in part on how the memory stores potential attacker addresses. Some solutions may include a memory structure for storing potential attacker addresses for each row group in the memory. However, this solution does not scale well with the number of rows. Furthermore, partitioning the memory on a row-by-row basis can be inefficient because it is unlikely that each row group will be attacked simultaneously. Therefore, there is a need to increase the efficiency of attacker address storage and tracking.

[0016] This disclosure relates to apparatus, systems, and methods for dynamically allocated attacker detection. A memory device may have an attacker address storage structure shared among one or more rows of the memory. Individual storage slots of the storage structure can be dynamically allocated among different rows (e.g., based on access to those rows). For example, the storage structure may store row addresses and their associated row group addresses. An attacker can be identified based on the stored row and row group addresses. Once an attacker is detected, its victim can be located and refreshed based on the row and row group addresses. Because slots in the storage structure are not permanently assigned to a given row, space can be dynamically allocated to those rows based on access patterns to different rows. In this way, if a single row is attacked, more storage devices can be used to track the attack, even if the attacker address storage device may contain less total storage space than is available in a row-specific solution. In some embodiments, the shared attacker address storage device may also be moved to a region of the memory die further away from the row (e.g., not in the row group logic area), which helps reduce the amount of freed space closer to the row. In some embodiments, sharing of attacker storage may also allow for a reduction in the total amount of attacker storage on a memory device compared to a memory device having separate attacker storage for each row group.

[0017] Figure 1 This is a block diagram of a semiconductor device according to an embodiment of the present disclosure. Semiconductor device 100 may be a semiconductor memory device, such as a DRAM device integrated on a single semiconductor chip.

[0018] Semiconductor device 100 includes memory array 118. Memory array 118 is shown as comprising multiple memory rows. Figure 1In one embodiment, the memory array 118 is shown as comprising eight memory rows BANK0 to BANK7. In other embodiments, the memory array 118 may contain more or fewer rows. Each memory row comprises multiple word lines WL, multiple bit lines BL and / BL, and multiple memory cells MC arranged at the intersections of the multiple word lines WL and the multiple bit lines BL and / BL. The selection of word lines WL is performed by the row decoder 108, and the selection of bit lines BL and / BL is performed by the column decoder 110. Figure 1 In this embodiment, row decoder 108 includes a corresponding row decoder for each memory row, and column decoder 110 includes a corresponding column decoder for each memory row. Bit lines BL and / BL are coupled to corresponding sense amplifiers (SAMPs). Read data from bit lines BL or / BL is amplified by the sense amplifier SAMP and transmitted to read / write amplifier 120 via complementary local data line (LIOT / B), transmission gate (TG), and complementary main data line (MIOT / B). Conversely, write data output from read / write amplifier 120 is transmitted to the sense amplifier SAMP via complementary main data line MIOT / B, transmission gate TG, and complementary local data line LIOT / B, and written to the memory cell MC coupled to bit line BL or / BL.

[0019] The semiconductor device 100 may employ multiple external terminals, including: a command and address (C / A) terminal coupled to the command and address bus to receive commands and addresses; a CS signal clock terminal for receiving clock CK and / or CK; a data terminal DQ for providing data; and a power supply terminal for receiving power supply potentials VDD, VSS, VDDQ, and VSSQ.

[0020] An external clock CK and / or CK is supplied to the clock terminals, and this external clock is provided to input circuitry 112. The external clocks may be complementary. Input circuitry 112 generates an internal clock ICLK based on the CK and / or CK clocks. The ICLK clock is provided to command decoder 110 and internal clock generator 114. Internal clock generator 114 provides various internal clocks LCLK based on the ICLK clock. The LCLK clock can be used for timing operations of various internal circuits. An internal data clock LCLK is provided to input / output circuitry 122 to time the operation of circuits contained within input / output circuitry 122, for example, to a data receiver to time the reception of written data.

[0021] The C / A terminal can be supplied with a memory address. The memory address supplied to the C / A terminal is transmitted to the address decoder 104 via the command / address input circuit 102. The address decoder 104 receives the address and supplies the decoded row address XADD to the row decoder 108 and the decoded column address YADD to the column decoder 110. The address decoder 104 can also supply a decoded row group address BADD, which indicates a row group of the memory array 118 containing the decoded row address XADD and column address YADD. Commands can be supplied to the C / A terminal. Examples of commands include timing commands for controlling the timing of various operations, access commands for accessing memory, such as read commands for performing read operations and write commands for performing write operations, as well as other commands and operations. Access commands can be associated with one or more row addresses XADD, column addresses YADD, and row group addresses BADD used to indicate the memory cell to be accessed.

[0022] Commands can be provided as internal command signals to command decoder 106 via command / address input circuitry 102. Command decoder 106 includes circuitry for decoding the internal command signals to generate various internal signals and commands for performing operations. For example, command decoder 106 can provide row command signals for selecting word lines and column command signals for selecting bit lines.

[0023] Device 100 can receive access commands as read commands. When a read command is received and is promptly supplied to the row, column, and group addresses, read data is read from the memory cells in memory array 118 corresponding to the row and column addresses. The read command is provided by command decoder 106, which provides an internal command causing the read data to be supplied from memory array 118 to read / write amplifier 120. The read data is output to the outside via input / output circuitry 122 from data terminal DQ.

[0024] Device 100 can receive access commands as write commands. When a write command is received and is promptly supplied to the group address, row address, and column address, write data supplied to the data terminal DQ is written to the memory cells in memory array 118 corresponding to the row and column addresses. The write command is received by command decoder 106, which provides an internal command to cause the write data to be received by the data receiver in input / output circuit 122. A write clock can also be provided to an external clock terminal for timing the data receiver in input / output circuit 122 to receive the write data. The write data is supplied to read / write amplifier 120 via input / output circuit 122, and then to memory array 118 to be written to memory cells MC via read / write amplifier 120.

[0025] The device 100 may also receive commands that cause it to perform one or more refresh operations as part of a self-refresh mode. In some embodiments, the self-refresh mode command may be issued externally to the memory device 100. In some embodiments, the self-refresh mode command may be generated periodically by a component of the device. In some embodiments, a refresh signal AREF may also be activated when an external signal indicates a self-refresh entry command. The refresh signal AREF may be a pulse signal that is activated when the command decoder 106 receives a signal indicating entry into the self-refresh mode. The refresh signal AREF may be activated immediately after the command input and may thereafter be activated cyclically according to desired internal timing. The refresh signal AREF can be used to control the timing of refresh operations during the self-refresh mode. Therefore, refresh operations may continue automatically. A self-refresh exit command may stop the automatic activation of the refresh signal AREF and may return the device 100 to an idle state and / or resume other operations.

[0026] A refresh signal AREF is supplied to refresh control circuitry 116. Refresh control circuitry 116 supplies a refresh row address RXADD to row decoder 108, which refreshes one or more word lines WL indicated by the refresh row address RXADD. In some embodiments, refresh address RXADD may represent a single word line. In some embodiments, refresh address RXADD may represent multiple word lines, which may be refreshed sequentially or simultaneously by row decoder 108. In some embodiments, the number of word lines represented by refresh address RXADD may vary from one refresh address to another. Refresh control circuitry 116 can control the timing of the refresh operation and can generate and provide refresh address RXADD. Refresh control circuitry 116 can be controlled to change details of refresh address RXADD (e.g., how the refresh address is calculated, the timing of the refresh address, the number of word lines represented by the address), or it can operate based on internal logic.

[0027] The refresh control circuit 116 can selectively output a target refresh address (e.g., which specifies one or more victim addresses based on the attacker) or an auto-refresh address (e.g., a sequence of auto-refresh addresses) as a refresh address RXADD. Based on the type of the refresh address RXADD (and in some embodiments, an additional signal indicating the type of operation), the line decoder 108 can perform a target refresh or auto-refresh operation. The auto-refresh address can be a sequence of addresses provided based on the activation of the refresh signal AREF. The refresh control circuit 116 can cycle through a series of auto-refresh addresses at a rate determined by AREF. In some embodiments, the auto-refresh operation can typically occur at such a timing that the sequence of auto-refresh addresses is cycled such that, for a given word line, no information degradation is expected during the time between auto-refresh operations. In other words, the auto-refresh operation can be performed such that each word line is refreshed at a rate faster than the expected rate of information decay.

[0028] The refresh control circuit 116 can also determine the target refresh address (e.g., the victim address corresponding to the victim row) based on the access patterns of nearby addresses in the memory array 118 (e.g., the attacker address in the attacker row). The refresh control circuit 116 can use one or more signals from the device 100 to calculate the target refresh address RXADD. For example, the refresh address RXADD can be calculated based on the row address XADD provided by the address decoder.

[0029] In some embodiments, refresh control circuitry 116 may sample the current value of row address XADD provided by address decoder 104 along the row address bus and determine a target refresh address based on one or more of the sampled addresses. The sampled addresses may be stored in a data storage unit of the refresh control circuitry. When row address XADD is sampled, it may be compared with an address stored in the data storage unit. In some embodiments, an intruder address may be determined based on the sampled address and / or the stored address. For example, a comparison between the sampled address and the stored address may be used to update a count value (e.g., an access count) associated with the stored address, and the intruder address may be calculated based on the count value. The refresh address RXADD may then be used based on the intruder address.

[0030] While this disclosure generally relates to identifying aggressor and victim word lines and addresses, it should be understood that, as used herein, an aggressor word line may not necessarily cause data degradation in adjacent word lines, and a victim word line may not necessarily undergo such degradation. The refresh control circuit 116 can use criteria to determine whether an address is an aggressor address, thereby capturing potential aggressor addresses rather than definitively determining which addresses are causing data degradation in nearby victims. For example, the refresh control circuit 116 can determine potential aggressor addresses based on address access patterns, and this criterion may include some addresses that are not aggressors while missing some that are. Similarly, victim addresses can be determined based on the expectation that word lines will be affected by an aggressor, rather than definitively determining which word lines are experiencing an increased rate of data decay.

[0031] As described in more detail herein, the refresh control circuit 116 can be partitioned between components specific to a given row group and components shared between rows groups. The intruder detector portion of the refresh control circuit 116 can be common across one or more rows groups, while the portion of the refresh control circuit 116 that generates the refresh address RXADD can be row group specific. Therefore, a single intruder detector portion can exist, while multiple refresh address generator portions can exist (e.g., one per row group). In some embodiments, these components can be placed in different portions of the physical die holding the memory device. Figure 2 The example refresh control circuit is described in more detail below.

[0032] Supply potentials VDD and VSS are supplied to the power supply terminals. These potentials are then supplied to the internal voltage generator circuit 124. The internal voltage generator circuit 124 generates various internal potentials VPP, VOD, VARY, VPERI, etc., based on the supply potentials VDD and VSS supplied to the power supply terminals. Internal potential VPP is primarily used in the line decoder 108, internal potentials VOD and VARY are primarily used in the sense amplifier SAMP included in the memory array 118, and internal potential VPERI is used in many peripheral circuit blocks.

[0033] Supply potentials VDDQ and VSSQ are also supplied to the power supply terminals. These supply potentials VDDQ and VSSQ are supplied to the input / output circuit 122. In some embodiments of this disclosure, the supply potentials VDDQ and VSSQ supplied to the power supply terminals may be the same as the supply potentials VDD and VSS supplied to the power supply terminals. In another embodiment of this disclosure, the supply potentials VDDQ and VSSQ supplied to the power supply terminals may be different from the supply potentials VDD and VSS supplied to the power supply terminals. The supply potentials VDDQ and VSSQ supplied to the power supply terminals are used in the input / output circuit 122 to prevent power supply noise generated by the input / output circuit 122 from propagating to other circuit blocks.

[0034] Figure 2 This is a block diagram of a refresh control circuit according to an embodiment of the present disclosure. In some embodiments, the refresh control circuit 216 may be included in... Figure 1 The refresh control circuit 116 is shown. Some internal components and signals of the refresh control circuit 216 are shown to illustrate its operation. The dotted line 218 indicates that in some embodiments, each of the components (e.g., RHR state control circuit 236, refresh address generator 234, local intruder storage device 238, and line decoder 208) may correspond to a specific row of the memory, and these components may be repeated for each row of the memory. Similarly, other components, such as sampling timing circuit 230 and intruder detector 232, may be shared between rows. For simplicity, since the components repeated for each row may be substantially similar to each other, only the interaction between shared components and single-row-by-row components will be described in detail.

[0035] DRAM interface 226 can provide one or more signals to address refresh control circuitry 216 and row decoder 208. Refresh control circuitry 216 may include sampling timing circuitry 230, intruder detector circuitry 232, row hammer refresh (RHR) state control circuitry 236, and refresh address generator 234. DRAM interface 226 can provide one or more control signals, such as refresh signal AREF and row address XADD. Refresh control circuitry 216 provides timing to refresh address XADD based on refresh signal AREF, where some of the refresh address is based on the received row address XADD.

[0036] In some embodiments, the intruder detector circuit 232 may sample the current row address XADD in response to an activation sampling signal ArmSample. The intruder detector circuit 232 may be coupled to the row address XADD and the group address BADD along the address bus, but may only receive (e.g., process, pay attention to) the current values ​​of the row address XADD and the group address BADD when the sampling signal ArmSample is activated. The sampled address may be stored in the intruder circuit 232 and / or compared with previously stored addresses. The intruder detector circuit 232 may provide a matching address HitXADD (e.g., an identified intruder address) based on the current sampled row address XADD and group address BADD and / or the previously sampled row address and group address. The intruder address HitXADD may be a sampled / stored row address and may be directed to group-level circuitry (e.g., a local intruder storage device 238) based on the group address BADD sampled / stored together with the sampled / stored row address.

[0037] RHR state control circuit 236 can provide a signal RHR to indicate that a row hammer refresh should occur (e.g., refresh of a victim row corresponding to an identified attacker row). RHR state control circuit 236 can also provide an internal refresh signal IREF to indicate that an automatic refresh should occur. In response to activation of RHR or IREF, refresh address generator 234 can provide a refresh address RXADD, which can be an automatic refresh address or one or more victim addresses corresponding to an attacker row with a matching address HitXADD stored in the local attacker storage device 238 (or directly provided by attacker detector circuit 232). RHR state control circuit 236 can provide a set of activations of RHR and IREF in response to refresh signal AREF, indicating the number of refresh pumps for each activation of refresh signal AREF. Row decoder 208 can perform a targeted refresh operation in response to refresh address RXADD and row hammer refresh signal RHR. Row decoder 208 can perform an automatic refresh operation based on refresh address RXADD and internal refresh signal IREF.

[0038] DRAM interface 226 may represent one or more components that provide signals to components in a row. In some embodiments, DRAM interface 226 may represent a device coupled to a semiconductor memory device (e.g., Figure 1 The memory controller of the device 100). In some embodiments, the DRAM interface 226 may represent, for example, Figure 1 The DRAM interface 226 includes components such as command address input circuitry 102, address decoder 104, and / or command decoder 106. The DRAM interface 226 provides row address XADD, group address BADD, refresh signal AREF, and access signals such as activation signal ACT and precharge signal PRE. The refresh signal AREF may be a periodic signal indicating when an automatic refresh operation occurs. The access signals ACT and PRE may be provided substantially together with the row address XADD and group address BADD as part of the access operation. The activation signal ACT may be provided to activate the group and row of memory associated with the associated group and row address. The precharge signal PRE may be provided to precharge the group and row of memory specified by the group and row address.

[0039] The row address XADD can be a multi-bit signal (which can be transmitted serially or in parallel) and can correspond to a specific row in an active memory row. Similarly, the row address BADD can be a multi-bit signal corresponding to a specific row in the memory array. The number of bits in the row and row addresses can be based on the number of rows and the number of rows in each row. For example, the row address can be 17 bits long, while the row address can be 5 bits long.

[0040] exist Figure 2 In one example embodiment, refresh control circuitry 216 uses sampling to monitor a portion of addresses XADD and BADD provided along the address bus. Therefore, not in response to every address, refresh control circuitry 216 can sample the current values ​​of addresses XADD and BADD on the address bus and can determine which addresses are intruders based on the sampled addresses. The timing of sampling by refresh control circuitry 216 can be controlled by sampling timing circuitry 230, which provides a sampling signal ArmSample. Sampling timing circuitry 230 can provide activation of the sampling signal ArmSample, and each activation of the signal ArmSample can indicate that the current value of the row address should be sampled. Activation of ArmSample can be a 'pulse', where ArmSample rises to a high logic level and then returns to a low logic level. Activation of the signal ArmSample can have periodic timing, random timing, semi-random timing, pseudo-random timing, or a combination thereof. In other embodiments, sampling may not be used, and intruder detector circuitry 232 can receive each value of row address XADD and group address BADD along the row address bus.

[0041] As described in more detail herein, the aggressor detector circuit 232 may determine an aggressor address based on one or more of the sampled row and group addresses, and then provide the determined aggressor address as a matching address HitXADD. Although based on row and group address pairs, in some embodiments, the matching address HitXADD may simply represent the identified aggressor row address, while the group address can be used to route the matching address HitXADD to the appropriate group portion 218. The aggressor detector circuit 232 may include a data storage unit (e.g., several registers) for storing the sampled row and group addresses. When the aggressor detector circuit 232 samples new values ​​for the row address XADD and group address BADD (e.g., in response to ArmSample activation), it can compare the sampled row and group addresses with the row / group addresses stored in the data storage unit. In some embodiments, the matching address HitXADD may be one of the addresses stored in the aggressor detector circuit 232 that most frequently matches the sampled address.

[0042] RHR state control circuit 236 can receive a refresh signal AREF and provide an auto-refresh signal IREF and a row hammer refresh signal RHR. The refresh signal AREF can be generated periodically and can be used to control the timing of refresh operations. The memory device can perform a series of auto-refresh operations to periodically refresh rows of the memory device. The RHR signal can be generated to indicate that the device should refresh a specific target row (e.g., a victim row) rather than an address from a sequence of auto-refresh addresses. RHR state control circuit 236 can also provide an internal refresh signal IREF, which can indicate that an auto-refresh operation should be performed. In some embodiments, signals RHR and IREF can be generated such that they do not act simultaneously (e.g., neither is simultaneously at a high logic level). In some embodiments, IREF can be activated for each refresh operation, and an auto-refresh operation can be performed unless RHR is also active; if RHR is also active, a target refresh operation is performed instead.

[0043] In some embodiments, the refresh control circuit 216 can perform multiple refresh operations in response to each activation of the refresh signal AREF. For example, each time the refresh signal AREF is received, the refresh control circuit 216 can perform N different refresh operations by providing N different refresh addresses RXADD. Each refresh operation can be referred to as a 'pump'. The different pumps generated in response to the refresh signal AREF can be a mixture of automatic refresh and target refresh operations. For example, if four pumps are generated, then two can be used for automatic refresh operations and two can be used for target refresh operations. Other modes can be used in other embodiments. In some embodiments, the mode of target operation and automatic refresh operation can vary between different groups of pumps.

[0044] The refresh address generator 234 can receive a row hammer refresh signal RHR and a matching address HitXADD. The matching address HitXADD can represent an aggressor row. The refresh address generator 234 can determine the location of one or more victim rows based on the matching address HitXADD, and provide the matching address as a refresh address RXADD when the signal RHR indicates a target refresh operation. In some embodiments, victim rows may include rows that are physically adjacent to the aggressor rows (e.g., HitXADD+1 and HitXADD-1). In some embodiments, victim rows may also include rows that are physically adjacent to physically adjacent rows of the aggressor rows (e.g., HitXADD+2 and HitXADD-2). Other relationships between victim rows and identified aggressor rows can be used in other instances. For example, + / -3, + / -4, and / or other rows may also be refreshed.

[0045] Refresh address generator 234 can determine the value of refresh address RXADD based on the row hammer refresh signal RHR. In some embodiments, when the signal RHR is not active, refresh address generator 234 can provide one of a series of auto-refresh addresses. When the signal RHR is active, refresh address generator 234 can provide, for example, a target refresh address of the victim address as refresh address RXADD. In some embodiments, refresh address generator 234 can count the activation of the signal RHR and can provide closer victim rows (e.g., HitXADD+ / -1) more frequently than victim rows farther from the attacker address (e.g., HitXADD+ / -2).

[0046] In some embodiments, the matching address HitXADD may be stored in an optional local intruder storage device 238. In some embodiments, the refresh address generator 234 may retrieve the matching address HitXADD directly from the intruder detector circuitry 232. However, this could lead to timing difficulties, for example, if the intruder detector circuitry 232 is located in a portion of the memory device that is not close to the memory row assembly 218. Therefore, when the matching address HitXADD is identified, it may be stored in the local intruder storage device 238. The intruder detector circuitry 232 may provide the matching address HitXADD to the appropriate local intruder storage device 238 based on the row address associated with the matching address (e.g., the row address received / stored along with the matching address). In some embodiments, the matching address HitXADD may be provided to the local intruder storage device 238 along an address bus (e.g., a row address bus). Various timing logics may be used to prevent conflicts with other addresses along the address bus. In some embodiments, the intruder detector circuit 232 and the local intruder storage device 238 may be coupled by a dedicated bus (e.g., a bus different from the address bus used for partial carrying row addresses and group addresses for access operations). The dedicated bus may operate serially, in parallel, or in a combination thereof.

[0047] The row decoder 208 can perform one or more operations on the memory array (not shown) based on received signals and addresses. For example, in response to the activation signal ACT and the row address XADD (and IREF and RHR at low logic levels), the row decoder 208 can direct one or more access operations (e.g., read operations) to the specified row address XADD. In response to the RHR signal being activated, the row decoder 208 can refresh the refresh address RXADD.

[0048] Figure 3 This is a block diagram of a portion of a memory according to some embodiments of the present disclosure. In some embodiments, memory 300 may represent Figure 1 A portion of the memory 102. Specifically, the memory 300 shows certain components that can be used to discuss the operation of the attacker detector circuit 302. In some embodiments, the attacker detector circuit 302 may be included in Figure 2 In the aggressor detector circuit 232.

[0049] The intruder detector circuit 302 includes an address storage structure 304 and storage logic 306 for managing the information stored in the address storage structure 304. The address storage structure 304 has several individual slots (e.g., such as...). Figure 3 (as shown in the diagram), each of which stores one or more related information fragments. For example, in Figure 3In this embodiment, each slot of address storage structure 304 holds the row address XADD, the group address BADD, and the count value Count. As discussed in more detail herein, other embodiments may store different information and / or may store information in different ways.

[0050] Storage logic 306 may represent one or more components that manage the contents of address storage structure 304. When the sampling signal ArmSample is provided by sampling timing logic 308, storage logic 306 may capture the next row address XADD and row group address BADD along the address bus. Storage logic 306 may compare the received row and row group addresses with the row and row group addresses stored in address storage structure 304. Storage logic 306 may determine whether the received row and row group addresses match one of the stored row and row group addresses.

[0051] In some embodiments, address storage structure 304 may include content-addressable memory (CAM) cells. Each CAM cell may store individual bits of information. For example, if the row address is i bits long and the row / row address is j bits long, then each slot may contain i+j CAM cells. The CAM cells constituting the address storage portion of a slot may work together to provide a match signal indicating whether all bits of the received information (e.g., the sampled row / row / row address) match bits of the stored information (e.g., the stored row / row / row address). For example, each CAM cell may provide a cell match signal, and the cell match signals may be logically combined (e.g., using AND logic) to determine an overall match signal. In some embodiments, a match signal may be provided only if all bits of the sampled row / row address match the stored row / row address and all bits of the sampled row address associated with the sampled row / row address match the stored row address associated with the stored row / row address.

[0052] The aggressor detector 302 can use a counting-based scheme to determine whether a sampled row and row address is an aggressor address. Therefore, if a match exists between the received (e.g., sampled) row and row address and one of the stored row and row addresses, the count value associated with the stored row and row address can be changed (e.g., incremented). Storage logic 306 may include one or more counting logic circuits. In response to a match signal from the aggressor address storage device 304, the count value in the slot providing the match signal can be read out and updated (e.g., incremented).

[0053] The updated count value can be compared with a threshold by the comparator circuitry of storage logic 306. Based on the comparison (e.g., if the updated count is greater than the threshold), the storage logic can determine whether the sampled row / group address is an aggressor and can provide the sampled row address as the matching address HitXADD and the sampled row / group address BADD as the matching address HitBADD. If the sampled address is not a matching address (e.g., if the count is below the threshold), then the updated count value can be written back to the aggressor address storage device 304. If the sampled address is provided as the matching address HitXADD / HitBADD, then the count value can be further modified (e.g., decremented by the threshold, reset to an initial value such as 0, etc.) before being written back to the aggressor address storage device 304. In some embodiments, the stored row and group addresses can be removed from the address storage structure 304 once they have been used to provide the matching addresses HitXADD and HitBADD.

[0054] If no match is found between the received row and row group addresses and either of the stored row and row group addresses, then storage logic 306 may store the received row and row group addresses in address storage structure 304. Storage logic 306 may determine whether there is open space (e.g., a slot not currently in use) in the offender storage structure 304, and if so, store the received row and row group addresses in the open space. If no open space exists, storage logic 306 may use one or more criteria to determine whether and where to store new row and row group addresses. For example, the stored row and row group addresses associated with the lowest count value may be replaced.

[0055] In some embodiments, storage logic 306 may use different criteria to determine which addresses are matching addresses HitXADD and HitBADD. For example, storage logic 306 may compare the received row and row group addresses with the stored row and row group addresses, and provide the received row and row group addresses as addresses HitXADD and HitBADD if a match exists. In such embodiments, the aggressor storage structure 304 may not contain a count value. In another instance, storage logic 306 may provide the stored row and row group addresses with the highest count value as addresses HitXADD and HitBADD. In other example embodiments, other schemes may be used to identify aggressor addresses such that they can be provided as matching addresses HitXADD and HitBADD.

[0056] The match row and row group addresses HitXADD and HitBADD can respectively provide access to the row group-specific refresh circuitry associated with the row group match address HitBADD. The match row group address HitBADD can be used to route the match row address HitXADD to the row group-specific circuitry associated with the row group address HitBADD.

[0057] exist Figure 3 In the embodiments, three example rows 314, 324, and 334 are shown. Each row group is associated with a corresponding local address storage structure and address generator, as well as... Figure 3 Other row-specific circuitry (e.g., line decoders, RHR state control circuitry) not shown in the diagram are associated with this. Thus, for example, the first row group 314 has a row-specific local address storage device 310 and an address generator 312, the second row group 324 has a row-specific local address storage device 320 and an address generator 322, and the third row group 334 has a row-specific local address storage device 330 and an address generator 332. Since row-specific circuitry can be largely similar to each other, only the first row group 314 and its circuitry will be described in detail.

[0058] The matching address HitXADD may be stored in one of local address storage structures 310, 320, or 330 based on the matching row address HitBADD. For example, a row decoder (not shown) may activate one of the address storage structures, and then the matching row address HitXADD may be stored in the activated address storage structure. In some embodiments, addresses HitXADD and HitBADD may be provided along a dedicated bus. The dedicated bus may operate serially, in parallel, or in a combination thereof. In some embodiments, as part of normal access operations, addresses HitXADD and HitBADD may be provided along the same address bus carrying the row and row addresses (e.g., XADD and BADD). In such embodiments, the memory may include logic that manages the timing of providing addresses HitXADD and HitBADD so as not to interfere with normal memory operations.

[0059] Local address storage device 310 may store one or more addresses HitXADD associated with the value of HitBADD associated with queue group 314. In some embodiments, local address storage device 310 may store only a single address HitXADD. In some embodiments, local address storage device 310 may store multiple addresses HitXADD. In embodiments where local address storage device 310 stores multiple addresses, logic (e.g., FIFO) may be used to manage the queue.

[0060] When the grouping logic (e.g., Figure 2When the RHR status control 236 determines that a target refresh operation should be performed, the address HitXADD stored in the local address storage device 310 can be provided to the address generator 312. The address generator 312 can calculate one or more refresh addresses RXADD based on the provided HitXADD. For example, the refresh address RXADD can represent a word line that is physically adjacent to the word line associated with HitXADD. Other relationships (e.g., + / -2, + / -3, etc.) can be used. The row decoder associated with the row group 314 can then refresh the word line associated with the refresh address RXADD.

[0061] In some embodiments, the local storage device 310 may be omitted, and the intruder detector circuit 302 may directly provide the addresses HitXADD and HitBADD to the address generator.

[0062] In some embodiments, different components of memory 300 may be located in different areas of the memory chip. As indicated by dotted line 309, some components may be located in a 'row area' or row logic segment that is physically close to an associated row group. For example, local storage device 310 and address generator 312 may be located in a row area that is physically close to the first row group 314, local storage device 320 and address generator 322 may be located physically close to the second row group 324, and so on. In contrast, some components that are not row group specific, such as intruder detector 302, may be located in the central area or central logic area of ​​the memory chip. For example, intruder detector 302 may be located relatively far from any location in the row group. In some embodiments, intruder detector 302 may be located near the command / address pad of the memory (e.g., Figure 1 (Near the C / A terminals). Placing the intruder detector 302 in the central area can be useful because the central area is not as crowded as the group logic area, and the intruder storage structure 304 can occupy a relatively large amount of space.

[0063] In some embodiments, the use of a shared attacker detector circuit 302 can reduce the overall size of the address storage structure 304 compared to a memory device in which a shared attacker detector circuit 302 is absent (e.g., each row group has its own attacker detector circuit 302). For example, a shared address storage structure 304 can store N addresses, but a memory device without a shared storage device can have a storage structure that stores A addresses in each of B rows, and the total number of addresses stored, A*B, can be greater than N (but in some embodiments, N can be greater than A). This may be because the total number of addresses stored, A, can be based on the 'worst-case' of the rows, while the number N in the shared embodiment can be based on the worst-case scenario that takes into account the fact that all rows cannot simultaneously have a worst-case attack (e.g., due to limitations in how access in memory works).

[0064] Therefore, in, for example Figure 3 In the shared embodiment shown, the 'worst-case' scenario can be based on the maximum rate at which all rows of memory (e.g., 314, 324, 334, etc.) can be attacked, rather than on the rate at which any single row can be attacked. For example, the memory may have a maximum rate at which it can be accessed. Therefore, if a single row is being attacked at a relatively high rate, access to other rows of memory can be excluded. Thus, since the slots of address storage structure 304 can be dynamically allocated to different rows, the total number of slots can be based on this maximum attack rate, as the maximum attack rate of a single row prevents the maximum attack rate from occurring in additional rows. Therefore, in the shared embodiment, the total number of address storage spaces can be less than the total number of address storage spaces in a memory device that does not use shared attacker detection. This reduces the amount of space used for address storage on the device.

[0065] Figure 4 This is a block diagram of an attacker detector according to some embodiments of the present disclosure. In some embodiments, Figure 4 The aggressor detector 400 may be included in Figure 2 In the aggressor detector 232. Since the aggressor detector 400 can be broadly similar to... Figure 2 Aggressor detector 232 and / or Figure 3 The actions of 302 are therefore, for the sake of brevity, the features, operations, and components described in detail above will not be described again.

[0066] The aggressor detector 400 uses a hash circuit 410 to operate the aggressor storage structure 404. Figure 4 In this embodiment, instead of directly storing addresses XADD and BADD in storage structure 404, the attacker's storage structure can use hash generator 410 to generate hash values, which can be used to index count values ​​in storage structure 404. In this way, a large number of possible values ​​for the received row and group addresses XADD and BADD can be tracked by a smaller number of count values.

[0067] Hash generator 410 can receive input values ​​based on row and group addresses XADD and BADD, and can provide an indexed hash. The input value can contain a first number of bits, and the indexed hash can contain a second number of bits less than the first number. Therefore, multiple input values ​​can be associated with values ​​in the indexed hash. Each value in the indexed hash can be associated with a count value in storage structure 404.

[0068] Based on the hash value, one of the counts in storage structure 404 can be changed (e.g., incremented). Storage logic 406 can use the count value to determine whether the received row and group addresses XADD and BADD should be provided as matching addresses HitXADD and HitBADD. For example, storage logic 406 can compare the changed count value with a threshold, and if the count value is greater than the threshold, then the received row and group addresses can be provided as matching addresses. The count value can then be changed (e.g., reset, decremented, etc.).

[0069] In some embodiments, the input value input may include row and row group addresses XADD and BADD. For example, if the row address is 17 bits and the row group address is 5 bits, then the value input may be 22 bits and may be a concatenation of the row and row group addresses. In some embodiments, the input value input may be a row address, and a second hash generator (not shown) may hash the row group address.

[0070] Figure 5 This is a block diagram of a method according to some embodiments of the present disclosure. In some embodiments, method 500 may be implemented by one or more of the components, devices and / or systems described herein.

[0071] Method 500 may generally begin with box 510, and its description involves performing an access operation by providing a row address and a row / group address. The row and row / group addresses can be obtained from an address decoder (e.g., ...). Figure 1 (104) is provided along the address bus. Row and row group addresses can be multi-bit signals, with values ​​specifying the row and row group respectively. For example, the row group address can specify one of multiple row groups, while the row address can specify one of multiple rows (word lines) within said row group.

[0072] Block 510 may generally follow block 520, which describes receiving row and row group addresses at the intruder detector circuitry. In some embodiments, the row and row group addresses may be sampled and may be received in response to activation of a sampling signal. Activation of the sampling signal may be performed using random timing, regular timing, semi-random timing, pseudo-random timing, timing based on one or more other signals, or a combination thereof. In some embodiments, the intruder detector circuitry may be located in the central region of the memory device (e.g., near the C / A terminals).

[0073] Box 520 may generally follow box 530, which describes in part a determination of whether a received row and row address is an attacker row and row address based on a match between the received row and row address and one of a plurality of stored row and row addresses in the attacker detector circuitry. Storage logic circuitry may compare the received row and row address with one or more stored row and row addresses in an attacker address storage structure. If the received row and row address matches the value of a stored row address and its associated stored row address, then a match is determined. In some embodiments, if no match exists, the storage logic circuitry may store the received row and row address in the attacker address storage structure. In some embodiments, if a match exists, the received row and row address may be determined to be an attacker row and row address. In some embodiments, the attacker address storage structure may contain a count value associated with each stored row and row address, and the count value may be changed (e.g., incremented) in response to a match. The received row and row group addresses can be identified as the attacker's row and row group addresses based on the count value (e.g., a comparison of the count value with a threshold).

[0074] Box 530 may generally follow box 540, which describes that if the received row and row group addresses are intruder row and row group addresses, then a refresh address is generated based on the received row address and provided to the row group based on the received row group address. For example, the intruder row and row group addresses may be provided to a selected set of row group-specific circuitry based on the intruder row group address. In some embodiments, the row group-specific circuitry may include a local memory structure that can hold the intruder row address. The row group-specific circuitry may include a refresh address generator that can generate a refresh address based on the intruder row address as part of a target refresh operation. The refresh address may represent a word line that has a physical relationship (e.g., adjacency) with the word line represented by the intruder row address. As part of the target refresh operation, the word line associated with the refresh address may be refreshed.

[0075] As used herein, activation of a sample can refer to any portion of a signal waveform in which the circuit responds. For example, if the circuit responds to a rising edge, then a signal switching from low to high can be considered activation. One type of activation is a pulse, where a signal switches from low to high for a period of time and then returns to low. This can trigger circuitry that responds to rising edges, falling edges, and / or signals at high logic levels. Those skilled in the art will understand that while embodiments of a particular type of activation (e.g., active high) used by a particular circuit can be described, other embodiments may use other types of activation (e.g., active low).

[0076] Of course, it should be understood that any of the examples, embodiments, or processes described herein may be combined with or separated from one or more other examples, embodiments, and / or processes and / or performed in a separate device or device portion of a system, apparatus, or method according to the present invention.

[0077] Finally, the foregoing discussion is intended to illustrate the system of the invention only and should not be construed as limiting the appended claims to any particular embodiment or group of embodiments. Therefore, while the system of the invention has been described in detail with reference to exemplary embodiments, it should be understood that numerous modifications and alternative embodiments can be devised by those skilled in the art without departing from the broader and established spirit and scope of the system of the invention as set forth in the appended claims. Thus, the specification and drawings should be viewed in an illustrative manner and are not intended to limit the scope of the appended claims.

Claims

1. An apparatus for dynamic allocation intruder detection, comprising: a plurality of memory banks each comprising a plurality of word lines; an intruder storage structure comprising a plurality of slots, each slot configured to store a row address associated with one of the plurality of word lines and a bank address associated with one of the plurality of banks, a storage logic circuit configured to receive a row address and a bank address, compare the received row address and the received bank address with stored row addresses and stored bank addresses in the plurality of slots, and determine whether the received row address and bank address are an intruder row address and an intruder bank address; and a plurality of row decoders each associated with one of the plurality of memory banks, wherein a selected one of the plurality of row decoders is configured to refresh one or more of the plurality of word lines in an associated bank based on an identified intruder row address, and wherein the selected one of the plurality of row decoders is selected based on the intruder bank address.

2. The apparatus of claim 1, further comprising a plurality of command / address terminals, wherein the intruder storage structure is located in a region closer to the command / address terminals than to the plurality of memory banks, and wherein the plurality of row decoders are located in a region closer to the associated one of the plurality of memory banks than to the command / address terminals.

3. The apparatus of claim 1, wherein each of the plurality of slots is configured to store a count value, wherein the storage logic is configured to update a selected count value based on the comparison between the received row address and the received bank address and the stored row addresses and the stored bank addresses, and wherein the received row address and the received bank address are determined to be the intruder row address and the intruder bank address based in part on the selected count value.

4. The apparatus of claim 1, further comprising a sample timing circuit configured to provide activation of a sample signal, wherein the storage logic is configured to receive the row address and the bank address based on the activation of the sample signal.

5. The apparatus of claim 1, further comprising a plurality of local storage structures each associated with one of the plurality of memory banks, each of the plurality of local storage structures configured to store at least one identified intruder row address.

6. The apparatus of claim 5, wherein a selected one of the plurality of local storage structures is activated based on the identified intruder bank address, and wherein the identified intruder row address is stored in the selected one of the plurality of local storage structures.

7. The apparatus of claim 5, wherein the identified intruder row address is provided to a selected one of the plurality of local storage structures along a dedicated bus.

8. The apparatus of claim 1, wherein a number of the plurality of slots of the intruder detector is based on a maximum rate at which all of the plurality of banks can be attacked.

9. An apparatus for dynamic allocation aggressor detection, comprising: an address decoder configured to provide a row address and an associated bank address along an address bus as part of an access operation; and an aggressor detector circuit configured to update a count value based on a value of the row address and a value of the associated bank address, and determine that the row address and the bank address are aggressors based in part on the count value, and wherein a refresh address is generated based on the determined aggressor row and bank addresses.

10. The apparatus of claim 9, further comprising a plurality of memory banks, each of the memory banks being associated with one of a plurality of address generators, the plurality of address generators configured to generate the refresh address based on the determined aggressor addresses when selected, wherein a selected one of the plurality of address generators is selected based on the determined aggressor bank address.

11. The apparatus of claim 10, wherein the determined aggressor row and bank addresses are provided to the selected one of the plurality of address generators along the address bus.

12. The apparatus of claim 10, wherein the determined aggressor row and bank addresses are provided to the selected one of the plurality of address generators along a dedicated bus different from the address bus.

13. The apparatus of claim 10, further comprising a plurality of row decoders, each of the row decoders being associated with one of the plurality of memory banks, wherein at least one of the plurality of row decoders is configured to refresh one or more word lines of the associated one of the plurality of memory banks based on the refresh address.

14. The apparatus of claim 9, wherein the aggressor detector circuit comprises a hash circuit configured to generate a hash value based on the row address, the bank address, or a combination thereof, and wherein the hash value is used to index the count value.

15. The apparatus of claim 9, wherein the aggressor detector circuit comprises an aggressor address storage structure configured to store the row address and the associated bank address.

16. A method for dynamic allocation aggressor detection, comprising: performing an access operation by providing a row and bank address; receiving the row and bank address at an aggressor detector circuit; determining whether the received row and bank address is an aggressor row and bank address based in part on a match between the received row and bank address and one of a plurality of stored row and bank addresses in the aggressor detector circuit; and if the received row and bank address is an aggressor row and bank address, generating a refresh address based on the received row address and providing the refresh address to a bank based on the received bank address.

17. The method of claim 16, further comprising storing the received row and bank address if the received row and bank address does not match one of the plurality of stored row and bank addresses.

18. The method of claim 16, further comprising: updating a count value based on whether a match exists between the received row and bank address and one of the plurality of stored row and bank addresses in the snoop detector circuit; and determining that the received row and bank address is the snoop row and bank address based on the count value.

19. The method of claim 16, further comprising storing the snoop row address in a selected one of a plurality of local address storage structures selected based on the snoop bank address.

20. The method of claim 19, further comprising providing the snoop row address to the selected one of the plurality of local address storage structures along a dedicated bus different from an address bus used to carry the row and bank address as part of the access operation.

21. The method of claim 16, further comprising refreshing a word line in a bank associated with the snoop bank address associated with the snoop row address.

Images