Detecting and mitigating attacks on row hammer mitigation circuit

Abstract

The invention relates to detecting and mitigating attacks on a row hammer mitigation circuit. Methods, devices, and systems related to detecting and mitigating waterfall attacks are described. A memory device may include a waterfall attack mitigation circuit configured to detect whether the memory device is a target of a waterfall attack based on a ratio of a read command to a write command received by the memory device. Upon detecting that the memory device is a target of a waterfall attack, the waterfall attack mitigation circuit may initiate certain mitigation actions, such as adjusting a threshold used to perform a row hammer related refresh.

Description

Technical Field

[0001] The present disclosure relates to devices, and in particular, to semiconductor memory devices that detect and mitigate attacks on row hammer mitigation operations. Background Art

[0002] An apparatus (e.g., a processor, a memory system, and / or other electronic device) may include one or more semiconductor circuits configured to store and / or process information. For example, the apparatus may include a memory device, such as a volatile memory device, a non-volatile memory device, or a combination device. A memory device, such as a dynamic random access memory (DRAM), may utilize electrical energy to store and access data. Summary of the invention

[0003] In one aspect, the present disclosure provides a memory device comprising: a memory array including multiple rows of memory cells; a row hammer mitigation circuit configured to: determine whether a first row of the multiple rows has accumulated an activation count that exceeds a row hammer mitigation threshold, and initiate a row hammer mitigation action in response to determining that the first row has accumulated an activation count that exceeds the row hammer mitigation threshold; and a waterfall attack mitigation circuit configured to: calculate a read-to-write ratio characterizing multiple commands received by the memory device, determine whether the calculated read-to-write ratio exceeds an expected read-to-write ratio, and initiate a waterfall mitigation action in response to determining that the calculated read-to-write ratio exceeds the expected read-to-write ratio.

[0004] In another aspect, the present disclosure further provides a Compute Express Link (CXL) card, comprising: a memory array; and a controller configured to: calculate a read-to-write ratio characterizing a plurality of commands received by the CXL card, determine whether the calculated read-to-write ratio exceeds an expected read-to-write ratio, and initiate waterfall mitigation actions in response to determining that the calculated read-to-write ratio exceeds the expected read-to-write ratio.

[0005] On the other hand, the present disclosure further provides a device comprising: a memory array; a row hammer mitigation circuit; and a waterfall attack mitigation circuit, which is configured to: determine a waterfall attack to calibrate the memory array based on multiple commands addressing the memory array, and adjust the configuration of the row hammer mitigation circuit based on the determination of the waterfall attack to calibrate the memory array. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Many aspects of the present disclosure may be better understood with reference to the following drawings. The components in the drawings are not necessarily drawn to scale. Instead, emphasis is placed on clearly illustrating the principles of the present disclosure. The drawings should not be construed as limiting the present disclosure to the specific embodiments depicted, but are for explanation and understanding only.

[0007] Figure 1 is a block diagram schematically illustrating a memory device according to an embodiment of the present technology.

[0008] Figure 2 is a block diagram of a system having a memory device configured in accordance with an embodiment of the present technology.

[0009] Figure 3 is a block diagram of an example environment in which devices in accordance with embodiments of the present technology may operate.

[0010] Figure 4 is a flow chart illustrating a process for mitigating attacks on a row hammer mitigation circuit in accordance with an embodiment of the present technology.

[0011] Figure 5 is a schematic diagram of a system including devices according to an embodiment of the present technology. DETAILED DESCRIPTION

[0012] High data reliability, high-speed memory access, and reduced chip size are features required of semiconductor memories. Some semiconductor memory devices, such as DRAM, store information as charge accumulated in cell capacitors, which is susceptible to leakage and therefore requires periodic refresh operations to prevent information loss. In addition to charge leakage, information may also be lost or degraded due to bit errors caused by interference mechanisms such as row hammering (e.g., repeated access to the same storage location or row within a threshold duration). Row hammering affects memory cells coupled to unselected word lines adjacent to a selected word line that is repeatedly driven to an active level within a short period of time. Unless a refresh operation is performed to refresh the charge in the memory cells, activity on the selected word line may cause charge changes in cells adjacent to the unselected word lines, thereby putting the information stored therein at risk. As described in more detail below, the technology disclosed herein relates to an apparatus (e.g., for a memory system) for mitigating a class of attacks that utilize the row hammering effect (referred to herein as waterfall attacks), a system having a memory device, related methods, and the like.

[0013] In some memory devices, an automatic refresh (AREF) command indicating a refresh operation is periodically issued from a control device (e.g., a host or a controller) operably coupled to the memory device. The AREF command is provided from the control device at a certain frequency so that all word lines will be refreshed once in one refresh cycle. However, since the refresh address according to the AREF command is determined by a refresh counter provided in the DRAM, the refresh operation in response to the AREF command may not prevent bit errors due to the row hammering effect. Therefore, the memory device may include an additional capability to address the row hammering effect.

[0014] A method for addressing row hammering effects involves providing a memory device having circuitry for redirecting or diverting a portion of available refresh opportunities (e.g., regularly scheduled refresh commands received from a host device) to specific victim rows where hammering activity has been detected (e.g., adjacent to rows where a large number of activate commands have been executed). For example, the row hammering mitigation circuitry may count the number of times a row has been activated since a previous refresh of an adjacent victim row. If the row activation count exceeds a threshold number, the row hammering mitigation circuitry may initiate a refresh of the adjacent victim rows to address the row hammering effects on those rows. For example, the row hammering mitigation circuitry may add the row address of the victim row to a queue for refresh operations (also referred to as a mitigation queue) so that the victim row is refreshed.

[0015] In conventional memory devices, the threshold used to determine whether to refresh a victim row may be fixed and / or statically configured (e.g., based on memory device characteristics and the sensitivity of neighboring victim rows to row hammering effects). As a result, the memory device and row hammering mitigation circuitry may have deterministic behavior, where refresh operations are predictably generated for the victim row after a sufficient number of activations of neighboring rows. Furthermore, as the geometry of memory arrays continues to decrease and the sensitivity to row hammering effects correspondingly increases, the threshold number of neighboring row activation commands that may be allowed to occur before a victim row is refreshed continues to decrease. These factors may enable hostile actors to exploit the row hammering effect and the deterministic operation of the row hammering mitigation circuitry to intentionally overwhelm a memory device with row hammering activity targeted for deleterious effects (e.g., data degradation in the memory array).

[0016] In one such attack, commonly referred to as a waterfall attack, multiple victim rows in an array are marked by row hammering activity (e.g., activation commands directed to one or more rows adjacent to the victim rows) to make the count of adjacent row activations close to but still below the threshold number that will trigger the target refresh of the victim rows. Once a sufficiently large number of such victim rows have been prepared in this way, the attack involves the target activation of adjacent rows, thereby quickly causing a large number of victim rows to exceed the threshold number. In a conventional memory device, the memory device so attacked will respond by adding all victim rows to a queue (e.g., a mitigation queue) for refresh operations. Doing so may result in any of several undesirable results. For example, if the number of victim row addresses to be added to the mitigation queue exceeds the capacity of the mitigation queue, then once the queue capacity is reached, the memory device may omit adding the victim row address to the mitigation queue. In this scenario, the victim rows omitted from the mitigation queue may experience a change in value (e.g., a bit flip in the data may occur), resulting in a memory device error. As a further example of what may happen when the number of victim row addresses to be added to the mitigation queue exceeds the capacity of the mitigation queue, the memory device may stop operating until a sufficient number of entries from the mitigation queue have been drained. This may result in performance loss and / or a denial of service attack. As a still further example, even if the mitigation queue has capacity for all victim rows to be added, additional activation commands may continue to hammer the same set of victim rows during the time it takes to complete corresponding refresh operations for all victim row addresses in the mitigation queue, such that their contents may be degraded (e.g., due to their position in the mitigation queue) before being refreshed.

[0017] Furthermore, it has been observed that row hammering and waterfall attacks typically use a greater number of reads to activate rows in a memory device than writes. Row hammering and waterfall attack patterns favor the use of reads over writes because a greater number of read commands can be executed (and more rows activated) in a given period of time. For example, the row cycle time (tRC), which characterizes the minimum time interval between consecutive activation commands, is shorter for read commands than for write commands. Because these attack patterns primarily use read commands, thereby taking advantage of shorter read tRC values ​​compared to writes, the ratio of reads to writes received by a memory device during a waterfall attack typically exhibits an imbalance that is not seen under normal operating loads. Therefore, it would be advantageous to detect when the ratio of reads to writes indicates a possible waterfall attack and respond appropriately.

[0018] Therefore, embodiments of the present technology relate to memory devices, systems including memory devices, and methods of operating memory devices, wherein waterfall attacks are detected and mitigated based on a ratio of reads to writes. Compared to conventional devices, the apparatus described herein includes a waterfall attack mitigation mechanism. The waterfall attack mitigation mechanism may include one or more read counters and one or more write counters updated based on read commands and write commands received by the memory device. If the waterfall attack mitigation mechanism detects that the ratio of received read commands to received write commands (as indicated by the read counter and the write counter, respectively) exceeds the expected ratio, then the waterfall attack mitigation mechanism may determine that the memory device is the target of a waterfall attack. As described herein, in some embodiments, the expected ratio of reads to writes may be based on information from an operating system (OS), a system basic input / output system (BIOS), or other system components. In some embodiments, the OS and / or BIOS may configure one or more mode registers of a memory device used by the waterfall attack detection mechanism with an expected ratio of reads to writes. For example, an OS running on a system may configure an expected ratio mode register based on an analysis of current and / or past software workloads executed on the system. In some embodiments, the expected ratio of reads to writes may be a fixed and / or configurable parameter specified (eg, as part of an initial system configuration).

[0019] If the waterfall attack mitigation mechanism determines that the memory device is marked by a waterfall attack, the waterfall attack mitigation mechanism can initiate one or more mitigation actions. The mitigation actions can include, for example, stopping the memory device, reporting the waterfall attack to a system component (e.g., a host and / or controller operably coupled to the memory device), and / or changing the configuration of a row hammer mitigation circuit within the memory device (e.g., lowering a threshold used to determine whether to refresh a victim row). Thus, the apparatus can dynamically respond when marked by a waterfall attack (e.g., adjusting a threshold parameter used by the row hammer mitigation circuit).

[0020] Instance environment

[0021] Figure 1 is a block diagram of an apparatus 100 (eg, a semiconductor die assembly, including a three-dimensional integration (3DI) device or a die stack package) according to an embodiment of the present technology. For example, the apparatus 100 may include a DRAM or a portion thereof including one or more dies / chips.

[0022] The apparatus 100 may include an array of memory cells, such as the memory array 150. The memory array 150 may include a plurality of banks (e.g., banks 0 to 15), and each bank may include a plurality of word lines (WL), a plurality of bit lines (BL), and a plurality of memory cells arranged at the intersections of the word lines and the bit lines. The memory cells may include any of a number of different memory media types, including capacitive, magnetoresistive, ferroelectric, phase change, or the like. The selection of the word lines WL may be performed by a row decoder 140, and the selection of the bit lines BL may be performed by a column decoder 145. A sense amplifier (SAMP) may be provided for a corresponding bit line BL and connected to at least one corresponding local input / output (IO) line pair (LIOT / B), which in turn may be coupled to at least one corresponding main IO line pair (MIOT / B) via a transfer gate (TG), which may act as a switch. The sense amplifiers and transfer gates may operate based on control signals from decoder circuitry, which may include command decoder 115, row decoder 140, column decoder 145, any control circuitry of memory array 150, or any combination thereof. Memory array 150 may also include plate lines and corresponding circuitry for managing their operation.

[0023] The device 100 may employ a plurality of external terminals including command and address terminals coupled to a command bus and an address bus to receive a command signal (CMD) and an address signal (ADDR), respectively. The device 100 may further include a chip select terminal for receiving a chip select signal (CS), a clock terminal for receiving clock signals CK and CKF, a data clock terminal for receiving data clock signals WCK and WCKF, data terminals DQ, RDQS, DBI and DMI, and power supply terminals VDD, VSS and VDDQ.

[0024] Address signals and bank address signals can be supplied to the command terminal and address terminal from the outside ( Figure 1 140). The address signal supplied to the address terminal and the memory bank address signal may be transmitted to the address decoder 110 via the command / address input circuit 105. The address decoder 110 may receive the address signal and supply the decoded row address signal (XADD) to the row decoder 140 and supply the decoded column address signal (YADD) to the column decoder 145. The address decoder 110 may also receive the memory bank address signal and supply the memory bank address signal to the row decoder 140 and the column decoder 145.

[0025] A command signal (CMD), an address signal (ADDR), and a chip select signal (CS) may be supplied to the command and address terminals from a memory controller and / or a chipset. The command signal may represent various memory commands (e.g., including access commands, which may include read commands and write commands) from a memory controller. The chip select signal may be used to select the device 100 to respond to the command and address provided to the command and address terminals. When a valid chip select signal is provided to the device 100, the command and address may be decoded, and a memory operation may be performed. The command signal may be provided to the command decoder 115 as an internal command signal ICMD via the command / address input circuit 105. The command decoder 115 may include a circuit for decoding the internal command signal ICMD to generate various internal signals and commands for performing memory operations, such as a row command signal for selecting a word line and a column command signal for selecting a bit line. The command decoder 115 may further include one or more registers for tracking various counts or values ​​(e.g., a refresh command received by the device 100 or a count of a self-refresh operation performed by the device 100).

[0026] The read data may be read from a memory cell specified by a row address (e.g., an address provided with an activation command) and a column address (e.g., an address provided with a read command) in the memory array 150. The read command may be received by the command decoder 115, which may provide an internal command to the input / output circuit 160 so that the read data may be output from the data terminals DQ, RDQS, DBI, and DMI via the read / write amplifier 155 and the input / output circuit 160 according to the RDQS clock signal. The read data may be provided at a time defined by the read delay RL information, which may be programmed in the device 100, for example, in the mode register ( Figure 1 The read delay RL information may be defined according to the clock cycle of the CK clock signal. For example, the read delay RL information may be the number of clock cycles of the CK signal when the associated read data is provided after the read command is received by the device 100.

[0027] The write data may be supplied to the data terminals DQ, DBI and DMI according to the WCK and WCKF clock signals. The write command may be received by the command decoder 115, which may provide an internal command to the input / output circuit 160 so that the write data may be received by the data receiver in the input / output circuit 160 and supplied to the memory array 150 via the input / output circuit 160 and the read / write amplifier 155. The write data may be written in the memory cell specified by the row address and the column address. The write data may be provided to the data terminal at a time defined by the write delay WL information. The write delay WL information may be programmed in the device 100, such as in a mode register. The write delay WL information may be defined according to the clock cycle of the CK clock signal. For example, the write delay information WL may be the number of clock cycles of the CK signal when the associated write data is received by the device 100 after receiving the write command.

[0028] Power supply potentials VDD and VSS may be supplied to the power supply terminals. These power supply potentials VDD and VSS may be supplied to the internal voltage generator circuit 170. The internal voltage generator circuit 170 may generate various internal potentials VPP, VOD, VARY, VPERI, and the like based on the power supply potentials VDD and VSS. The internal potential VPP may be used in the row decoder 140, the internal potentials VOD and VARY may be used in the sense amplifiers included in the memory array 150, and the internal potential VPERI may be used in many other circuit blocks.

[0029] A power supply potential VDDQ may also be supplied to the power supply terminal. The power supply potential VDDQ may be supplied to the input / output circuit 160 together with the power supply potential VSS. In an embodiment of the present technology, the power supply potential VDDQ may be the same potential as the power supply potential VSS. In another embodiment of the present technology, the power supply potential VDDQ may be a different potential from the power supply potential VDD. However, a dedicated power supply potential VDDQ may be used for the input / output circuit 160 so that power supply noise generated by the input / output circuit 160 does not propagate to other circuit blocks.

[0030] An external clock signal and a complementary external clock signal may be supplied to the clock terminal and the data clock terminal. The external clock signals CK, CKF, WCK, and WCKF may be supplied to the clock input circuit 120. The CK and CKF signals may be complementary, and the WCK and WCKF signals may also be complementary. The complementary clock signals may have opposite clock levels and simultaneously transition between opposite clock levels. For example, when the clock signal is at a low clock level, the complementary clock signal is at a high clock level, and when the clock signal is at a high clock level, the complementary clock signal is at a low clock level. In addition, when the clock signal transitions from a low clock level to a high clock level, the complementary clock signal transitions from a high clock level to a low clock level, and when the clock signal transitions from a high clock level to a low clock level, the complementary clock signal transitions from a low clock level to a high clock level.

[0031] The input buffer included in the clock input circuit 120 may receive an external clock signal. For example, when enabled by a clock / enable signal from the command decoder 115, the input buffer may receive a clock / enable signal. The clock input circuit 120 may receive an external clock signal to generate an internal clock signal ICLK. The internal clock signal ICLK may be supplied to the internal clock circuit 130. The internal clock circuit 130 may generate an internal clock signal ICLK based on the received internal clock signal ICLK and the clock enable signal ( Figure 1 110 ) provides various phase and frequency controlled internal clock signals. For example, the internal clock circuit 130 may include a clock path ( ) that receives the internal clock signal ICLK and provides various clock signals to the command decoder 115. Figure 1 100). The internal clock circuit 130 may further provide an input / output (IO) clock signal. The IO clock signal may be supplied to the input / output circuit 160 and may be used as a timing signal for determining the output timing of read data and / or the input timing of write data. The IO clock signal may be provided at multiple clock frequencies so that data may be output from and input to the device 100 at different data rates. When high memory speed is desired, a higher clock frequency may be desired. When lower power consumption is desired, a lower clock frequency may be desired. The internal clock signal ICLK may also be supplied to the timing generator 135 and various internal clock signals may be generated accordingly.

[0032] The device 100 may be connected to any of a number of electronic devices or components thereof that are capable of utilizing memory to temporarily or permanently store information. For example, the host device of the device 100 may be a computing device (e.g., a desktop or portable computer, a server, a handheld device (e.g., a mobile phone, a tablet computer, a digital reader, a digital media player)) or a component thereof (e.g., a central processing unit, a coprocessor, a dedicated memory controller, etc.). The host device may be a networking device (e.g., a switch, a router, etc.) or a digital image, audio and / or video recorder, a vehicle, an appliance, a toy, or any of a number of other products. In one embodiment, the host device may be directly connected to the device 100; however, in other embodiments, the host device may be indirectly connected to the memory device (e.g., through a networking connection or through an intermediate device).

[0033] The device 100 may include circuits implementing mechanisms to detect and mitigate attacks on the device, such as a row hammer mitigation circuit 190 and / or a waterfall attack mitigation circuit 192. The device may additionally include one or more mode registers 194 that may be programmed with data to be used by the row hammer mitigation circuit 190 and / or the waterfall attack mitigation circuit 192.

[0034] The row hammer mitigation circuit 190 may be configured to determine when the device 100 is the target of a row hammer attack by determining that a victim row has been subjected to too many disturbance effects caused by neighboring row activate commands since the last refresh operation at the victim row. In some embodiments, the row hammer mitigation circuit 190 maintains, for each row in the memory array 150, a count of activate commands targeting the row since its last refresh operation (e.g., from which the amount of row hammer disturbance effects imparted to neighboring rows can be determined). In some embodiments, the row hammer mitigation circuit 190 maintains, for each row in the memory array 150, a count of activate commands directed to neighboring rows (e.g., rows that are immediately adjacent and / or within a predetermined physical distance of the tracked row) since the last time the tracked row was refreshed. Based on these maintained counts, the row hammer mitigation circuit 190 may determine when a row should be refreshed to mitigate the row hammer effect. To this end, row hammer mitigation circuitry 190 may monitor the maintained counts, determine whether the count for any row exceeds a row hammer mitigation threshold, and initiate a refresh operation for the row whose count exceeds the threshold (eg, add the address of the row to a mitigation queue).

[0035] The row hammer mitigation threshold may be configured based on characteristics of the device 100. For example, if a row in the memory array 150 will likely experience one or more bit flips if 100,000 activations of a nominal neighboring row occur before the row is refreshed, the row hammer mitigation threshold may be configured to be 50,000 activations (e.g., once the row's neighbors are activated more than 50,000 times before the row is refreshed, the row hammer mitigation circuit 190 adds the row to the mitigation queue). Furthermore, the row hammer mitigation threshold may be changed during operation of the device 100. For example, and as further described herein, the waterfall attack mitigation circuit 192 may change the row hammer mitigation threshold in response to detecting a waterfall attack. The row hammer mitigation threshold may be maintained in a mode register (e.g., one of the mode registers 194) and modified by overwriting the value in the mode register with a different value, depending on the desired sensitivity to the attack, the various operating requirements of the memory device, and / or the detected waterfall attack.

[0036] The waterfall attack mitigation circuit 192 can be configured to detect and mitigate waterfall attacks (e.g., attacks intended to exploit row hammer mitigation mechanisms such as those implemented by the row hammer mitigation circuit 190) based on an observed ratio of read commands to write commands. The waterfall attack mitigation circuit 192 includes one or more read counters and one or more write counters. In some embodiments, the waterfall attack mitigation circuit 192 includes one read counter and one write counter corresponding to the memory array 150. In some embodiments, the waterfall attack mitigation circuit 192 includes a plurality of read counters and a plurality of write counters, each of which corresponds to a subset of the memory array 150 (e.g., one read counter and one write counter for each bank of the memory array 150). When the waterfall attack mitigation circuit 192 detects a read or write command to the memory array 150, it increments the corresponding counter (e.g., it increments the read counter when it detects a read command and increments the write counter when it detects a write command). For example, in an embodiment of the device 100 where the waterfall attack mitigation circuit 192 maintains read and write counters for each bank of the memory array 150, the waterfall attack mitigation circuit 192 increments a counter corresponding to the bank in which the target address of the read or write command is located. As a further example, in an embodiment of the device 100 where the waterfall attack mitigation circuit 192 maintains a single read counter and a single write counter for the entire memory array 150, the waterfall attack mitigation circuit 192 updates the appropriate counter for all addresses found in the memory array 150 (depending on whether it is a read or a write detected). The waterfall attack mitigation circuit 192 can determine the type of command (e.g., read, write, or other) and the location (e.g., bank) corresponding to the address associated with the command based on one or more control signals input to or generated by the command decoder 115, the address decoder 110, and / or the row decoder 140.

[0037] The waterfall attack mitigation circuit 192 evaluates the values ​​in the read counter and the write counter to determine a ratio of read commands to write commands received by the device 100. For example, if the read counter has a value of x and the associated write counter (e.g., associated with the same memory array 150 and / or a subset of the memory array 150 associated with the read counter) has a value of y, then the waterfall attack mitigation circuit 192 may determine that the device 100 has received an x:y ratio of read commands to write commands. In embodiments where the waterfall attack mitigation circuit 192 includes a plurality of read and write counters (e.g., read and write counters associated with each memory bank of the memory array 150), the waterfall attack mitigation circuit 192 may determine a read to write ratio for each set of read and write counters (e.g., characterizing a ratio of read commands to write commands addressing each memory bank). As further described below, in some embodiments, the waterfall attack mitigation circuit 192 will reset the read counter and the write counter to initial values ​​(e.g., zero) at certain times (e.g., periodically) so that the ratio calculated based on the counters represents the read commands and write commands received by the device 100 during a certain time window (e.g., in the middle of the counter resets).

[0038] The waterfall attack mitigation circuit 192 evaluates the ratio of received read commands to received write commands (e.g., as calculated based on one or more read counters and one or more write counters), and determines whether the detected ratio exceeds an expected ratio of read commands to write commands. In some embodiments, the expected ratio is a static value specified by an implementation of the waterfall attack mitigation circuit 192 (e.g., based on a logic gate designed to compare the detected ratio to a fixed value). In some embodiments, the expected ratio is a configurable value maintained in a mode register (e.g., one of the mode registers 194), and is modified by overwriting the value in the mode register with a different value. For example, during device initialization, one of the mode registers 194 may be configured to the expected value. For example, the initial value of the expected ratio may be based on one or more device parameters, such as sensitivity to row hammering and waterfall attacks. In some embodiments, the expected ratio (e.g., maintained in one of the mode registers 194) may be modified during operation of the device 100. For example, an OS and / or BIOS executing on a host operably coupled to device 100 may update the expected ratio value in mode register 194 based on an analysis of a workload executed on the host. For example, a typical workload of the system may be characterized to obtain an expected threshold value, which may be used as the expected ratio value. It has been observed that a typical workload typically exhibits a 2:1 read to write ratio (i.e., the workload typically includes 2 read commands for every 1 write command), with occasional periods having a 3:1 read to write ratio. In some embodiments, the expected threshold value is set to an initial value greater than 3:1 (e.g., during initialization of device 100 and / or based on an implementation of waterfall attack mitigation circuit 192). For example, the expected threshold value may have an initial value of 3.5:1, 4:1, and / or 10:1. However, as discussed above, based on the configuration of the expected value mode register by the OS and / or BIOS, the expected threshold value may change (e.g., increase and / or decrease) during operation.

[0039] If the waterfall attack mitigation circuit 192 determines that the detected ratio of read commands to write commands (e.g., based on one or more read counters and one or more write counters) exceeds the expected ratio of read commands to write commands (e.g., based on the expected ratio value in the mode register 194), then the waterfall attack mitigation circuit 192 may initiate one or more mitigation actions. The mitigation actions may include, for example, stopping the device 100, and / or reporting the waterfall attack to a host and / or controller operably coupled to the device 100. The host may use the indication of the waterfall attack to, for example, shut down a corresponding software thread and / or reduce the priority of sending memory accesses to an affected area (e.g., a certain memory bank) of the device 100. As a further example, the mitigation action may include lowering a row hammer mitigation threshold used by the row hammer mitigation circuit 190, for example, by updating the mode register 194 in which the row hammer mitigation threshold is stored. By lowering the row hammer mitigation threshold, the row hammer mitigation circuit 190 may more aggressively combat the row hammer effect by refreshing the victim row more frequently. By refreshing the victim rows more frequently, the device 100 can mitigate the row hammering effect before the impact caused by the ongoing waterfall attack can cause a bit flip in the memory array 150. As a further example, the mitigation action may include flushing certain storage structures in the device 100 or operably coupled components. For example, the system may refresh entries in a content addressable memory (CAM) or other structure that stores the row addresses that need to be mitigated (e.g., refreshed). The CAM may be part of the memory device 100 or other memory system components coupled to the memory device, such as a compute fast link (CXL) controller. In some embodiments, the mitigation action may include mitigating (e.g., refreshing) rows and / or row neighbors addressed by the CAM entries, thereby draining the corresponding entries from the CAM. In some embodiments, the mitigation of rows and / or row neighbors triggered by the mitigation action can be performed at a higher priority than typical row hammering mitigation. For example, conventionally performed mitigation may be performed opportunistically (e.g., by stealing a refresh cycle), and the mitigation triggered by the mitigation action is performed outside of the refresh cycle. In embodiments where the waterfall attack mitigation circuit 192 determines multiple read-to-write ratios that are each associated with a subset of the memory array 150 (e.g., each associated with a different memory bank), the waterfall attack mitigation circuit 192 may initiate a mitigation action if any of the ratios exceeds an expected threshold.

[0040] The waterfall attack mitigation circuit 192 may be configured to initialize and / or reset the read counter and the write counter to an initial value (e.g., zero). For example, when the device 100 is initialized, the waterfall attack mitigation circuit 192 may reset the read and write counters to initial values. In some embodiments, the waterfall attack mitigation circuit 192 resets the read and write counters periodically during operation. For example, the waterfall attack mitigation circuit 192 may reset the read and write counters every 1 ms, every 2 ms, etc. That is, the read and write counters may reflect the count of read and write commands received during a time period of a certain duration (e.g., every 1 ms, every 2 ms, etc.). In some embodiments, the waterfall attack mitigation circuit 192 resets the read and write counters when certain events occur. For example, the waterfall attack mitigation circuit 192 may reset the read and write counters when it detects a waterfall attack and / or performs mitigation actions in response.

[0041] As described above, the apparatus 100 may include one or more mode registers 194 for storing various data (e.g., row hammer mitigation thresholds, expected ratios of read commands to write commands, device status information, etc.). The mode registers 194 may include read-only bits, read-write bits, write-only bits, or any combination thereof. In some embodiments, the mode registers 194 may be arranged in addressable portions of a byte size, wherein each individual addressable mode register contains 8 bits. The mode register bits may be written in response to a mode register write (MRW) command in which data to be written is provided through the CA interface, and the mode register bits may be read in response to a mode register read (MRR) command in which stored data is output through the DQ data terminals. The mode registers 194 may also be read and written internally by various components of the apparatus 100 (e.g., row hammer mitigation circuit 190 and / or waterfall attack mitigation circuit 192) (e.g., filling read-only mode register bits with device status or configuration information, determining the state of write-only mode register bits, determining thresholds, determining expected ratios, etc.), but without exchanging data with the terminals of the memory device.

[0042] although Figure 1 An embodiment of the apparatus 100 is described in which the row hammer mitigation circuit 190, the waterfall attack mitigation circuit 192, and the mode register 194 are described as distinct components, but in some embodiments, one or more of the aforementioned circuits and / or registers may be combined. For example, in some embodiments, the row hammer mitigation circuit 190 and the waterfall attack mitigation circuit 192 are a single circuit that performs both row hammer and waterfall detection and mitigation functions.

[0043] Figure 2 is a block diagram of a system 201 having a memory device 200 configured according to an embodiment of the present technology. The memory device 200 may be a reference Figure 1Examples of memory devices described herein or including aspects thereof. As shown, memory device 200 includes a main memory 202 (e.g., DRAM, NAND flash memory, NOR flash memory, FeRAM, phase change memory (PCM), etc.) and control circuitry 206 operably coupled to a host device 208 (e.g., an upstream central processing unit (CPU), a memory controller). Control circuitry 206 may include reference Figure 1 Aspects of the various components described. For example, control circuitry 206 may include aspects of command / address input circuit 105, address decoder 110, and command decoder 115, among others.

[0044] The main memory 202 includes a plurality of memory units 220, each of which includes a plurality of memory cells. The memory units 220 may be individual memory dies, memory planes in a single memory die, a stack of memory dies connected vertically with through-silicon vias (TSVs), or the like. For example, in one embodiment, each of the memory units 220 may be formed from a semiconductor die and arranged in a single device package with other memory unit dies. In other embodiments, the plurality of memory units 220 may be co-located on a single die and / or distributed across multiple device packages. In some embodiments, the memory units 220 may also be subdivided into memory regions 228 (e.g., banks, rows, channels, blocks, pages, etc.).

[0045] The memory cells may include, for example, floating gate, charge trap, phase change, capacitor, ferroelectric, magnetoresistive storage elements, and / or other suitable storage elements configured to store data permanently or semi-permanently. The main memory 202 and / or individual memory units 220 may also include other circuit components for accessing and / or programming (e.g., writing) memory cells and other functions (e.g., for processing information and / or communicating with the control circuit system 206 or the host device 208), such as multiplexers, decoders, buffers, read / write drivers, address registers, data output / data input registers, etc. Although shown in the illustrated embodiment as having a certain number of memory cells, rows, columns, regions, and memory units for illustrative purposes, the number of memory cells, rows, columns, regions, and memory units may vary and in other embodiments may be larger or smaller in size than the number shown in the illustrated example. For example, in some embodiments, the memory device 200 may include only one memory unit 220. Alternatively, the memory device 200 may include two, three, four, eight, ten, or more (eg, 16, 32, 64, or more) memory units 220. Although the memory units 220 are Figure 22. The memory units 220 are shown as each including four memory regions 228, but in other embodiments, each memory unit 220 may include one, two, three, eight, or more (eg, 16, 32, 64, 100, 128, 256, or more) memory regions.

[0046] In one embodiment, the control circuit system 206 may be disposed on the same die as the main memory 202 (e.g., including command / address / clock input circuit systems, decoders, voltage and timing generators, IO circuit systems, etc.). In another embodiment, the control circuit system 206 may be a microcontroller, a dedicated logic circuit system (e.g., a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a control circuit system on a memory die, etc.), or other suitable processor. In one embodiment, the control circuit system 206 may include a processor configured to execute instructions stored in a memory to perform various processes, logic flows, and routines for controlling the operation of the memory device 200 (including managing the main memory 202 and handling communications between the memory device 200 and the host device 208). In some embodiments, the control circuit system 206 may include an embedded memory having memory registers for storing (e.g., memory addresses, row counters, bank counters, memory pointers, fetched data, etc.). In another embodiment of the present technology, memory device 200 may not include control circuitry, but may rely on external control (eg, provided by host device 208, or by a processor or controller separate from memory device 200).

[0047] The host device 208 may be any of a number of electronic devices or components thereof that are capable of utilizing memory to temporarily or permanently store information. For example, the host device 208 may be a computing device (e.g., a desktop or portable computer, a server, a handheld device (e.g., a mobile phone, a tablet computer, a digital reader, a digital media player)) or a component thereof (e.g., a central processing unit, a coprocessor, a dedicated memory controller, etc.). The host device 208 may be a networking device (e.g., a switch, a router, etc.) or a digital image, audio and / or video recorder, a vehicle, an appliance, a toy, or any of a number of other products. In one embodiment, the host device 208 may be directly connected to the memory device 200, but in other embodiments, the host device 208 may be indirectly connected to the memory device 200 (e.g., through a networking connection or through an intermediate device).

[0048] In operation, the control circuit system 206 may directly write or otherwise program (e.g., erase) various memory areas of the main memory 202. The control circuit system 206 communicates with the host device 208 through a host device bus or interface 210. In some embodiments, the host device 208 and the control circuit system 206 may communicate through a dedicated memory bus (e.g., a DRAM bus). In other embodiments, the host device 208 and the control circuit system 206 may communicate through a serial interface (e.g., a serial attached SCSI (SAS), a serial AT attachment (SATA) interface, a peripheral component interconnect express (PCIe), or other suitable interface (e.g., a parallel interface)). The host device 208 may send various requests (e.g., in the form of packets or packet streams) to the control circuit system 206. The requests may include commands to read, write, erase, return information, and / or perform specific operations (e.g., refresh operations, TRIM operations, precharge operations, activate operations, wear leveling operations, garbage collection operations, etc.).

[0049] Figure 3 3 is a block diagram of an example environment 300 in which a compute express link (CXL) card 305 may operate according to an embodiment of the present technology. The example environment 300 may correspond to a computing device or system. The CXL card 305 may include a memory 310 (e.g., Figure 1 The memory 310 may include a volatile memory, a non-volatile memory, or a combination device / system. For example, the memory 310 may include a DRAM.

[0050] The memory 310 may be electrically coupled to a controller 315 (e.g., a memory controller such as a CXL controller, a buffer, a repeater device such as an RCD, etc.), a host 320 (e.g., a set of processors), and an operating system 325. Some example operating environments may include a computing system having a central processing unit (CPU) as the host 320 that interacts with the memory controller to write data to and read data from the DRAM. The host 320 may operate according to the operating system 325 and send operational communications (e.g., read / write commands, write data, addresses, etc.) to the memory controller. The CXL card 305 may also send read data back to the system controller (not shown) as an operational communication. The controller 315 may manage the flow of data to or from the CXL card 305 according to the address and / or operation. The memory 310 and the controller 315 may be electrically coupled together to form the CXL card 305. The controller 315 may track the data entering the CXL card 305 and initiate mitigation steps.

[0051] The controller 315 and / or the memory 310 may include Figure 1. For example, the controller 315 may have and maintain a read counter and a write counter, based on which the controller 315 may determine a ratio of read commands to write commands received by the CXL card 305. As described herein, the controller 315 may compare the ratio of read commands to write commands (based on the counters) to an expected ratio, and detect a waterfall attack (e.g., there are a greater number of reads and writes than expected) when the ratio based on the counters exceeds the expected ratio. When the controller 315 detects a waterfall attack, it may notify the host 320 or the operating system 325 that the memory 310 (or a region thereof) is experiencing a waterfall attack.

[0052] The operating system 325 may evaluate different operating conditions of the environment 300 and determine an expected read-to-write ratio during operation. In some embodiments, the operating system 325 determines the expected read-to-write ratio based on a lookup table. In some embodiments, the lookup table includes the expected read-to-write ratio of software operating on the host 320, a typical workload running on the host, etc. For example, the operating system 325 may evaluate characteristics of other software (not shown) operating on the host 320. The operating system 325 may configure the CXL card 305 based on the expected read-to-write ratio via a main data bus or a sideband bus operably coupled to the CXL card 305. For example, the operating system 325 may program a mode register (not shown) in the CXL card 305 with the expected ratio of read commands to write commands.

[0053] Process for Cascade Attack Detection and Mitigation

[0054] Figure 4 4 is a flow chart illustrating a process 400 for mitigating attacks on a row hammer mitigation circuit according to an embodiment of the present technology. Aspects of the process 400 may be performed, for example, by Figure 1 The device 100 (including the row hammer mitigation circuit 190, the waterfall attack mitigation circuit 192 and / or the mode register 194), Figure 3 The CXL card 305 or a combination thereof may be used to perform.

[0055] Process 400 begins at block 405 where the process determines an expected read-to-write ratio. As described herein, the expected read-to-write ratio characterizes the number of read commands and write commands expected to be executed in a workload and the relative frequency of one command relative to the other. The expected read-to-write ratio may be obtained from a value in a mode register, where the mode register has been programmed and / or configured by an OS, BIOS, or other system component.

[0056] At block 410, process 400 initializes one or more read counters and one or more write counters to initial values ​​(e.g., zero). In some embodiments, there is one read counter and one write counter (associated with the entire memory array) to be initialized by process 400. In some embodiments, there are multiple read counters and multiple write counters (where individual read counters and individual write counters are associated with subsets of the memory array (e.g., banks of the memory array)), all of which are initialized by the process.

[0057] At block 415, the process 400 updates a read counter or a write counter corresponding to a received command (e.g., a command issued from a host to a memory array). That is, the read counter is updated when the process detects a read command, and the write counter is updated when the process detects a write command. The update may be an increment by one (i.e., incrementing the current value in the counter to be updated by one). In embodiments having multiple read counters and multiple write counters each associated with a subset of the memory array, the process 400 updates the counter corresponding to the subset of the memory array being read or written. For example, if the read and write counters are associated with individual banks of the memory array (e.g., banks 0 to 15), the process 400 updates the counter corresponding to the bank being read or written.

[0058] At block 420, process 400 calculates a read-to-write ratio of received read commands and write commands. Process 400 may calculate the read-to-write ratio based on a read counter and a write counter. For example, if a read counter has recorded 3,300 read commands and a corresponding write counter has recorded 1,100 write commands, process 400 may calculate a ratio of detected read commands to write commands of 3:1. In embodiments having multiple read counters and multiple write counters (e.g., each pair of read counters and write counters corresponding to a subset of a memory array), process 400 may calculate the ratio of all pairs of read counters to write counters.

[0059] At decision block 425, process 400 determines whether the calculated read-to-write ratio of the received command exceeds the expected read-to-write ratio. For example, if the expected read-to-write ratio is 3:1, and process 400 has calculated a read-to-write ratio of 10:1 based on the received command, then the calculated read-to-write ratio exceeds the expected read-to-write ratio (e.g., detected read commands are more prevalent than expected relative to detected write commands). If process 400 determines that the calculated read-to-write ratio does not exceed the expected read-to-write ratio, then the process continues to decision block 430. If process 400 determines that the calculated read-to-write ratio exceeds the expected read-to-write ratio (which indicates a waterfall attack), then the process continues to block 435. In embodiments with more than one calculated read-to-write ratio, each corresponding to a subset of the memory array, if any of the ratios exceeds the expected read-to-write ratio, then process 400 may continue to block 435.

[0060] At decision block 430, process 400 determines whether to reset the read counter and the write counter. In some embodiments, process 400 determines to reset the read and write counters after a threshold amount of time has passed since the last counter reset (e.g., every 1 ms or 2 ms). In some embodiments, process 400 determines to reset the read and write counters when certain events occur (e.g., when a waterfall attack is detected). If process 400 determines to reset the read and write counters, process 400 returns to block 410 to reset the counters to initial values ​​(e.g., zero). If process 400 determines not to reset the read and write counters, process 400 returns to block 415 to continue updating the read and write counters in response to detected read and write commands. In embodiments with multiple read counters and multiple write counters, process 400 may make different determinations for different read and write counters at decision block 430. For example, a pair of read and write counters corresponding to one bank of the memory array may be ready to be reset (based on the time elapsed since the last reset), while another pair of read and write counters corresponding to another bank of the memory array may not be ready to be reset.

[0061] If, at decision block 425, process 400 determines that the calculated read-to-write ratio exceeds the expected read-to-write ratio (which may indicate a waterfall attack), then at block 435, process 400 may perform one or more mitigation actions in response. For example, process 400 may stop the memory device (as illustrated by block 440). As an additional example, process 400 may report the ongoing waterfall attack to a host to which the memory device is operably coupled (as illustrated by block 445). As a further example, process 400 may adjust parameters used by the memory device to mitigate row hammering effects. For example, process 400 may reduce the number of rows hammered by a row hammering mitigation mechanism (e.g., Figure 1 The row hammer mitigation circuit 190 described in ) is used to determine the threshold when to refresh the victim row. The described mitigation actions and other mitigation actions can be performed alone or in combination. The process 400 then returns to block 410 to reset the read counter and the write counter.

[0062] Although Figure 4 An embodiment of process 400 that evaluates all read counters and write counters is described, but in some embodiments, process 400 evaluates a single pair of read counters and write counters, and (e.g., by Figure 1 The device 100 and / or Figure 3 The CXL card 305 of the memory array 400 performs the process 400 in parallel for each of the read counter and write counter pairs. For example, in an embodiment where there are multiple read counter and write counter pairs each associated with a subset of the memory array, the process 400 can be performed in parallel for each of the counter pairs. That is, for example, the process 400 can be performed to update the counters, calculate the ratio, and perform mitigation actions on a first bank of the memory array in conjunction with the read and write commands, and the process 400 can be performed separately to perform mitigation actions on a second bank of the memory array in conjunction with the read and write commands.

[0063] Figure 5 is a schematic diagram of a system 500 including a device according to an embodiment of the present technology. Figures 1 to 4 Any of the foregoing apparatus described (eg, memory devices, CXL cards, etc.) may be incorporated into any of a myriad of larger and / or more complex systems, a representative example of which is Figure 5 5. The system 500 may include a memory device 505, a power supply 510, a driver 515, a processor 520, and / or other subsystems or components 525. The memory device 505 may include the same components as those described above. Figures 1 to 4The system 500 may include features similar to those of the devices described herein, and thus may include various features for detecting and mitigating waterfall attacks. The resulting system 500 may perform any of a variety of functions, such as memory storage, data processing, and / or other suitable functions. Thus, the representative system 500 may include, but is not limited to, handheld devices (e.g., mobile phones, tablet computers, digital readers, and digital audio players), computers, vehicles, appliances, and other products. The components of the system 500 may be housed in a single unit or distributed over multiple interconnected units (e.g., via a communication network). The components of the system 500 may also include any of a variety of computer-readable media and remote devices.

[0064] It should be noted that the methods described above describe possible implementations, and that operations and steps may be rearranged or modified, and other implementations are possible. Furthermore, embodiments from two or more methods may be combined.

[0065] Although in the foregoing example embodiments, the memory modules and devices have been illustrated and described with respect to DRAM devices, embodiments of the present technology may be applicable to other memory technologies, including SRAM, SDRAM, NAND and / or NOR flash memory, PCM, magnetic RAM (MRAM), ferroelectric RAM (FeRAM), etc. Furthermore, although the memory module has been illustrated and described as a dual in-line memory module (DIMM) having nine memory devices, embodiments of the present disclosure may include more or fewer memory devices, and / or involve other memory modules or packaging formats (e.g., single in-line memory module (SIMM), small outline DIMM (SODIMM), single in-line pin package (SIPP), custom memory packages, etc.).

[0066] The information and signals described herein may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, or chips that may be referenced throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof. Some figures may illustrate a signal as a single signal; however, one of ordinary skill in the art will understand that a signal may represent a signal bus, where the bus may have a variety of bit widths.

[0067] The devices discussed herein, including memory arrays, may be formed on a semiconductor substrate, such as silicon, germanium, silicon-germanium alloys, gallium arsenide, gallium nitride, etc. In some cases, the substrate is a semiconductor wafer. In some other cases, the substrate may be a silicon-on-insulator (SOI) substrate, such as silicon-on-glass (SOG) or silicon-on-sapphire (SOP), or an epitaxial layer of semiconductor material on another substrate. The conductivity of the substrate or a sub-region of the substrate may be controlled by doping with various chemical species including, but not limited to, phosphorus, boron, or arsenic. Doping may be performed during the initial formation or growth of the substrate by ion implantation or any other doping means.

[0068] The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. Other examples and implementations are within the scope of the present disclosure and the appended claims. Features implementing the functions may also be physically located at various locations, including being distributed so that parts of the functions are implemented at different physical locations.

[0069] As used herein (including in the claims), "or" as used in a list of items (e.g., a list of items beginning with a phrase such as "at least one of" or "one or more of") indicates an inclusive list, so that a list such as at least one of A, B, or C means A or B or C or AB or AC or BC or ABC (i.e., A and B and C). Moreover, as used herein, the phrase "based on" should not be interpreted as a reference to a closed set of conditions. For example, an example step described as "based on condition A" may be based on both condition A and condition B without departing from the scope of the present disclosure. In other words, as used herein, the phrase "based on" should be interpreted in the same manner as the phrase "based at least in part on".

[0070] It will be appreciated from the foregoing that specific embodiments of the present invention have been described herein for illustrative purposes, but various modifications may be made without departing from the scope of the present invention. On the contrary, in the foregoing description, numerous specific details are discussed to provide a comprehensive and feasible description of embodiments of the present technology. However, those skilled in the relevant art will recognize that the present disclosure may be implemented without one or more of the specific details. In other examples, well-known structures or operations typically associated with memory systems and devices are not shown or described in detail to avoid obscuring other aspects of the present technology. In general, it should be understood that various other devices, systems and methods other than those specific embodiments disclosed herein may also be within the scope of the present technology.

Claims

1. A memory device, comprising: a memory array comprising a plurality of rows of memory cells; A hammer mitigation circuit is provided, which is configured to: determining whether a first row of the plurality of rows has accumulated an activation count that exceeds a row hammer mitigation threshold, and initiating a row hammer mitigation action in response to determining that the first row has accumulated an activation count that exceeds the row hammer mitigation threshold; and A waterfall attack mitigation circuit configured to: calculating a read-to-write ratio characterizing a plurality of commands received by the memory device, determining whether the calculated read-to-write ratio exceeds an expected read-to-write ratio, and A waterfall mitigation action is initiated in response to determining that the calculated read-to-write ratio exceeds the expected read-to-write ratio. 2 . The memory device of claim 1 , wherein activation counts characterize activations directed to rows adjacent to the first row.

3. The memory device of claim 1, wherein the row hammer mitigation action comprises refreshing rows adjacent to the first row.

4. The memory device of claim 1 , wherein calculating the read-to-write ratio comprises: maintaining a count of read commands received by the memory device; maintaining a count of write commands received by the memory device; detecting a command received by the memory device; determining whether the received command is a read command or a write command; updating the count of read commands or the count of write commands based on the determination whether the received command is a read command or a write command; and The read-to-write ratio is generated based on the count of read commands and the count of write commands. 5 . The memory device of claim 4 , wherein calculating the read-to-write ratio further comprises resetting the count of read commands to 0 after a threshold time has passed, and resetting the count of write commands to 0. The memory device of claim 5 , wherein the threshold time is between 1 ms and 2 ms.

7. The memory device of claim 1, wherein the calculated read-to-write ratio is based on commands received by the memory device during a 1 ms time period.

8. The memory device of claim 1, further comprising: A mode register is configured to maintain the expected read to write ratio.

9. The memory device of claim 8, wherein the expected read-to-write ratio in the mode register is programmed by a host operably coupled to the memory device.

10. The memory device of claim 1, wherein: The memory array comprises a plurality of memory banks, each memory bank comprising a subset of the plurality of rows of memory cells; and The waterfall attack mitigation circuit is further configured to: maintaining a plurality of read counters and write counters, wherein each of the read counters and the write counters is associated with a memory bank; detecting a command received by the memory device, the command being associated with a memory bank; updating the read counter or write counter associated with the memory bank associated with the received command; and Wherein the calculated read-to-write ratio is associated with the memory bank and is calculated based on the read counter and the write counter associated with the memory bank.

11. The memory device of claim 1, wherein the waterfall mitigation action comprises stopping the memory device.

12. The memory device of claim 1, wherein the waterfall mitigation action comprises lowering the row hammer mitigation threshold.

13. The memory device of claim 1, wherein the memory array is a DRAM array.

14. A computing express link CXL card, comprising: Memory array; and A controller configured to: calculating a read-to-write ratio characterizing a plurality of commands received by the CXL card, determining whether the calculated read-to-write ratio exceeds an expected read-to-write ratio, and A waterfall mitigation action is initiated in response to determining that the calculated read-to-write ratio exceeds the expected read-to-write ratio.

15. The CXL card of claim 14, wherein the waterfall mitigation action comprises adjusting a row hammer mitigation threshold based on which a subset of the memory array is refreshed.

16. The CXL card of claim 14, wherein calculating the read-to-write ratio comprises: maintaining a count of read commands received by the CXL card; maintaining a count of write commands received by the CXL card; detecting a command received by the CXL card; determining whether the received command is a read command or a write command; updating the count of read commands or the count of write commands based on the determination whether the received command is a read command or a write command; and The read-to-write ratio is generated based on the count of read commands and the count of write commands. 17 . The CXL card of claim 16 , wherein calculating the read-to-write ratio further comprises resetting the count of read commands to 0 and resetting the count of write commands to 0 after a threshold time has elapsed.

18. The CXL card of claim 14, wherein the expected read-to-write ratio is configured by a host operatively coupled to the CXL card.

19. An apparatus comprising: Memory array; Line hammer relief circuit; and A waterfall attack mitigation circuit configured to: determining a waterfall attack targeting the memory array based on a plurality of commands addressing the memory array, and A configuration of the row hammer mitigation circuit is adjusted based on the determination that the memory array is calibrated for a waterfall attack.

20. The apparatus of claim 19, wherein the configuration of the row hammer mitigation circuit includes an activation threshold based on which a subset of a memory array is refreshed.

Images