Storage device and electronic device
By using a counter with a random initial value in DRAM memory, the problem of insufficient defense against row hammer attacks is solved, and the row hammer attack is effectively prevented, reducing the probability of a successful attack.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHANGXIN MINKE STORAGE TECH (SHANGHAI) CO LTD
- Filing Date
- 2026-05-12
- Publication Date
- 2026-06-12
AI Technical Summary
In existing technologies, DRAM memory has limited defense capabilities against row hammer attacks, especially in the case of two-sided attacks, where attackers can easily guess which row to protect, making it difficult to effectively prevent row hammer attacks.
The initial value of the counter is a random number. The initial value is configured during the initialization phase by the row hammer management circuit and the initial value of the counter is reset during the row hammer refresh operation. The random number is used to reduce the probability of attackers guessing the actual row to be protected and to reduce the number of times the target row is activated.
It effectively prevents row hammering by using random numbers to cause attackers to incorrectly distribute their attacks across the rows to be protected, reducing the number of times the target row is activated and improving the security of the storage device.
Smart Images
Figure CN122201374A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of semiconductor technology, and in particular to a storage device and an electronic device. Background Technology
[0002] Semiconductor memories are classified into volatile memories such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM) and non-volatile memories such as Flash memory, Phase Change Material Random Access Memory (PRAM), Magnetic Random Access Memory (MRAM), Resistive Random-access Memory (RRAM), or Ferroelectric Random Access Memory (FRAM). Volatile memories lose the data stored in them when power is off, while non-volatile memories retain the data stored in them even when power is off.
[0003] DRAM memory is a common type of volatile memory. DRAM memory works by storing charge in the capacitors of memory cells to write data to the memory, and by reading the charge from the capacitors of memory cells to read data from the memory.
[0004] Row hammering can occur when a specific word line is aggressively accessed, in which data stored in memory cells connected to word lines adjacent to the corresponding word line is lost. Therefore, a memory device capable of effectively preventing row hammering is needed. Summary of the Invention
[0005] This application provides a storage device and an electronic device that can at least effectively prevent hammering.
[0006] This application provides a storage device, comprising: a storage body including multiple rows, each row corresponding to multiple storage units and a counter, the counter being configured to acquire a count value related to the number of times each row is activated, and the count value being obtained by counting based on an initial value; and a row hammer management circuit configured to configure the initial value during an initialization phase, and, during a row hammer management phase, reset the initial value of the counter corresponding to the attack row in response to a row hammer refresh operation, wherein the attack row is the row among the multiple rows related to the row in which the row hammer refresh operation is performed, and the initial value is a random number.
[0007] Optionally, the random number is generated by a linear feedback shift register.
[0008] Optionally, the row hammer management circuit includes: a configuration circuit configured to receive a seed and generate the random number based on the seed.
[0009] Optionally, the storage device stores configuration values corresponding to the storage body, and the seed is obtained based on the configuration values during the initialization phase.
[0010] Optionally, during the row hammer management phase, if the number of consecutive row hammer refresh operations reaches a preset value, the seed is obtained based on the refresh row address corresponding to the row in the previous row hammer refresh operation.
[0011] Optionally, during the row hammer management phase, if the number of consecutive row hammer refresh operations does not reach the preset value, the seed is not updated, and the initial value corresponding to the current row hammer refresh operation is obtained based on the initial value corresponding to the previous row hammer refresh operation.
[0012] Optionally, the configuration circuit includes: a seed controller, configured to receive a seed and output the seed and an update control signal; and a random number generator, configured to receive the seed output by the seed controller and generate and output the random number in response to the update control signal; wherein the seed controller is further configured to receive a first seed, and in the initialization phase, output the first seed as the seed; and in the row hammer management phase, if the number of consecutive row hammer refresh operations is less than a preset value, then the seed is not updated; if the number of consecutive row hammer refresh operations is equal to the preset value, then a second seed is received and the seed is updated to the second seed.
[0013] Optionally, the preset value is n, where n is a positive integer greater than 1, and the second seed is obtained based on the refresh row address corresponding to the row in the (n-1)th row hammer refresh operation.
[0014] Optionally, the seed controller includes: a processing unit configured to determine whether the number of consecutively executed row hammer refresh operations is equal to a preset value; if so, outputting a first control signal; if not, outputting a second control signal; a latching unit configured to receive and output the first seed during the initialization phase, receive the second seed during the row hammer management phase, not updating the seed if the first control signal is not received, and outputting the second seed as the seed in response to the first control signal if the first control signal is received; and a control unit configured to generate and output the update control signal in response to the second control signal.
[0015] Optionally, the row hammer management circuit further includes: an arithmetic unit configured to receive an initial seed and perform logical operations on the initial seed to provide the seed to the configuration circuit so that the seed is in a valid state.
[0016] Optionally, the row hammer management circuit further includes: a selector configured to, during the initialization phase, output the configuration value stored in the storage device as the seed, and during the row hammer management phase, output the refresh row address corresponding to the row that previously performed the row hammer refresh operation as the seed.
[0017] Optionally, the storage device further includes: a refresh control circuit configured to execute the row hammer refresh operation based on a row hammer refresh command, and to output a refresh row address corresponding to the row in which the row hammer refresh operation is executed, based on the row hammer refresh command; wherein the row hammer management circuit is configured to reset the initial value of the counter of the attack row associated with the refresh row address based on the refresh row address.
[0018] Optionally, the storage device further includes: a register configured to store the address of at least one of the plurality of rows and a corresponding count value; the row hammer management circuit is further configured to update the register by using the address corresponding to the target row in the access request and the modified count value.
[0019] Optionally, the row hammer management circuit is further configured to update the register based on a comparison between the modified count value corresponding to the target row and the count value of at least one row stored in the register.
[0020] Optionally, the row hammer management circuit is further configured to replace the entry in the register corresponding to the minimum count value with the address of the target row and the modified count value if the modified count value corresponding to the target row is greater than the minimum count value, where the minimum count value is the smallest count value among the count values of at least one row stored in the register.
[0021] This application also provides an electronic device including any of the storage devices described in the preceding claims.
[0022] The technical solution provided in this application has at least the following advantages: This application provides a storage device with superior structural performance, including a storage bank and a row hammer management circuit. The storage bank includes multiple rows, each row including multiple storage cells and a counter. The counter is configured to acquire a count value related to the number of times each row is activated, and the count value is obtained by counting based on an initial value. The row hammer management circuit is configured to configure the initial value during an initialization phase, and during the row hammer management phase, to reset the initial value of the counter corresponding to the attacking row in response to a row hammer refresh operation, wherein the attacking row is the row among the multiple rows associated with the row that performs the row hammer refresh operation, and the initial value is a random number. By setting the initial value of the counter to a random number, the probability of an attacker correctly guessing the row to be protected can be reduced, thereby effectively preventing row hammer phenomena. Attached Figure Description
[0023] One or more embodiments are illustrated by way of example with corresponding pictures in the accompanying drawings. These illustrative descriptions do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings represent similar elements. Unless otherwise stated, the figures in the drawings do not constitute a limitation on scale. In order to more clearly illustrate the technical solutions in the embodiments of this application or in the conventional art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0024] Figure 1 A functional block diagram of a storage device provided in some embodiments of this application; Figure 2 for Figure 1 An architecture diagram of a medium storage unit; Figure 3 Another functional block diagram of a storage device provided in some embodiments of this application; Figure 4 Another functional block diagram of a storage device provided in some embodiments of this application; Figure 5 This is a schematic diagram illustrating a victim row in a storage device subjected to a one-sided attack. Figure 6 A schematic diagram illustrating a victim row in a storage device subjected to a two-sided attack. Figure 7A functional block diagram of a hammer management circuit in a storage device provided in some embodiments of this application; Figure 8 for Figure 7 A schematic diagram of a circuit configuration in the middle; Figure 9 Another functional block diagram of the row hammer management circuit in a storage device provided in some embodiments of this application; Figure 10 for Figure 8 A schematic diagram of a seed controller; Figure 11 A block diagram of an electronic device provided in an embodiment of this application.
[0025] Explanation of reference numerals in the attached figures: 100. Storage device; 101. Storage cell; 102. Row hammer management circuit; MC. Storage unit; 11. Counter; 10. Storage array; 111. Counting area; 103. Register; 104. Refresh control circuit; 112. Configuration circuit; SEED. Seed; lfsrdata. Random number; 21. Seed controller; 22. Random number generator; lfsr_update. Update control signal; SEED1. First seed; SEED2. Second seed; 23. Arithmetic unit; SEED0. Initial seed; 24. Selector; 201. Processing unit; 202. Latch unit; 203. Control unit; C1. First control signal; C2. Second control signal.
[0026] 401. Processor. Detailed Implementation
[0027] As can be seen from the background art, there is an existing need to provide a storage device that can effectively prevent the hammer effect.
[0028] In related technologies, a Row Activation Count (PRAC) is used to count the number of times a target row is activated. During storage device initialization and after row refresh management, the initial count for the target row's activation count is 0, meaning the count starts from 0. Each time the target row is activated, the count is incremented by 1. During storage device operation, the largest number of counts are cached in a Data Utility Unit (DLUT). For example, the six largest counts are cached in the DLUT. The row corresponding to the largest count is designated as the attack row, and surrounding victim rows are protected. If the DLUT is full and a new count is greater than the minimum count in the DLUT, the new count replaces the minimum. When the minimum count in the DLUT exceeds a threshold, an alert is triggered to notify the host. Upon receiving the alert, the host issues a refresh command to refresh and protect the victim rows, i.e., it performs row refresh management on the victim rows.
[0029] However, the above-mentioned defense mechanisms have limited ability to defend against row hammer attacks. In particular, if the attack on the victim row is a two-sided attack, the attacker can easily obtain the protection mechanism of the storage device and accurately know which row needs to be protected each time. Therefore, the attacker can easily avoid the row to be protected and accumulate the activation count to the remaining rows, eventually causing the final target row to exceed the threshold. As a result, the victim row adjacent to the target row is subjected to row hammer attacks.
[0030] Analysis revealed that the count values always started from 0, which made it easy for attackers to guess the line that was actually being protected.
[0031] To address or improve the aforementioned technical problems, this application provides a storage device in which the initial value of a counter is a random number. Even if an attacker knows the protection mechanism of the storage device, the presence of the random number causes a difference between the row that the storage device actually protects and the attacker's expectation. This results in the attacker's attack being incorrectly distributed across the rows to be protected, ultimately reducing the number of times the target row is activated, thereby effectively preventing row hammering.
[0032] The embodiments of this application will now be described in detail with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been provided in the embodiments of this application to facilitate a better understanding of the embodiments. However, the technical solutions claimed in the embodiments of this application can be implemented even without these technical details and various variations and modifications based on the following embodiments.
[0033] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined. Similarly, "multiple sets" refers to two or more sets (including two sets), and "multiple pieces" refers to two or more pieces (including two pieces).
[0034] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.
[0035] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A exists, A and B exist simultaneously, and B exists. In addition, the character " / " in this document generally indicates that the related objects before and after it have an "or" relationship.
[0036] In the description of the embodiments of this application, the technical terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the embodiments of this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the embodiments of this application. For example, if the device or element in the illustration is inverted, then the element described as "below," "under," "below," or "bottom" of other elements or features will be oriented "above" or "top" of said other elements or features. Therefore, the term "below" may cover both above and below orientation depending on the context in which the term is used, which will be obvious to those skilled in the art. Materials may be oriented in other ways (e.g., rotated 90 degrees, inverted, flipped), and the spatial relative descriptive terms used herein may be interpreted accordingly.
[0037] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.
[0038] In the description of embodiments of this application, the terms "about," "approximately," "roughly," or "about" for a numerical value referring to a specific parameter include the numerical value, and those skilled in the art will understand that the deviation from the numerical value is within the acceptable tolerance of the specific parameter. For example, "about" or "about" for a numerical value may include additional numerical values that are in the range of 90.0% to 110.0% of the numerical value, such as in the range of 95.0% to 105.0%, 97.5% to 102.5%, 99.0% to 101.0%, 99.5% to 100.5%, or 99.9% to 100.1%.
[0039] In the accompanying drawings corresponding to the embodiments of this application, the thickness and / or area of layers, films, panels, regions, etc., are enlarged for better understanding and ease of description. Throughout the specification, the same reference numerals denote the same elements. Furthermore, when describing a component as being "generally" formed on another component, it means that the component is not formed on the entire surface (or front surface) of the other component, nor is it formed on a portion of the edge of the entire surface.
[0040] In the description of embodiments of this application, when a component "includes" another component, other components are not excluded unless otherwise stated, and may be further included. When describing a component (such as a layer, film, region, or substrate) on or on the surface of another component, the component may be "directly" located on the surface of the other component, or there may be an intermediate component between the two components. Conversely, when describing a component on the surface of another component, or a component "directly" on another component, or a component surface on which another component is formed or disposed, it indicates that there is no intermediate component between the two components. For simplicity and clarity, various components may be drawn at any scale. In the drawings, some components may be omitted for simplicity.
[0041] The terminology used in the description of the various embodiments herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used in the description of the various embodiments and the appended claims, the term "the component" is also intended to include the plural form unless the context clearly indicates otherwise.
[0042] The aforementioned components can refer to layers, films, regions, parts, structures, or plates, etc.
[0043] Figure 1 This is a functional block diagram of a storage device provided in some embodiments of this application. Figure 2 for Figure 1 An architecture diagram of a storage medium.
[0044] refer to Figure 1 and Figure 2 The storage device 100 includes a storage bank 101 and a row hammer management circuit 102. The storage bank 101 includes multiple rows, each row corresponding to multiple storage cells MC and a counter 11. The counter 11 is configured to acquire a count value related to the number of times each row is activated, and the count value is obtained by counting based on an initial value.
[0045] The row hammer management circuit 102 is configured to configure an initial value during the initialization phase, and during the row hammer management phase, to reset the initial value of the counter corresponding to the attack row in response to the row hammer refresh operation, wherein the attack row is the row associated with the row that performs the row hammer refresh operation among a plurality of rows, and the initial value is a random number.
[0046] The counter in this storage device is initialized with a random number. Even if an attacker knows the storage device's protection mechanism, the presence of the random number causes a discrepancy between the row the storage device actually protects and the attacker's expectation. This results in the attacker's attack being incorrectly distributed across the rows to be protected, ultimately reducing the number of times the target row is activated and effectively preventing row hammer attacks.
[0047] Different storage banks can also have different random numbers, which helps to further reduce the risk of guessing the random number, thereby further reducing the risk of guessing the actual row to be protected.
[0048] The storage device provided in the embodiments of this application will be described in more detail below with reference to the accompanying drawings.
[0049] In some embodiments, storage device 100 may be a storage device including volatile memory cells. For example, storage device 100 may include various dynamic random access memories (DRAMs), such as Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), DDR2 SDRAM, DDR3 SDRAM, DDR4 SDRAM, DDR5 SDRAM, DDR6 SDRAM, or Low Power Double Data Rate SDRAM (LPDDRSDRAM).
[0050] In some embodiments, the storage device 100 may be a stacked storage device with stacked DRMA dies, such as a high-bandwidth memory. The storage device 100 may also be a storage module, such as a dual-inline-memory module (DIMM) or a single-inline-memory module (SIMM).
[0051] In other embodiments, the storage device 100 includes, in addition to volatile memory cells, non-volatile memory cells such as SRAM, NAND flash memory, NOR flash memory, RRAM, FRAM, PRAM, TRAM, or MRAM.
[0052] Storage device 100 can be connected to a controller, which can send commands and / or addresses to storage device 100, and can also send data to or receive data from storage device 100. The controller is also called a memory controller.
[0053] The storage device 100 can receive data from the controller and store the received data. In response to a request from the controller, the storage device 100 can also read the stored data and send the read data to the controller.
[0054] Storage device 100 may include storage array 10. Storage array 10 may be a storage block MAT (memory array tile). Each storage block includes multiple storage cells MC, and the location of the storage cells MC is accessed through corresponding rows (i.e., word lines) and columns (i.e., bit lines). In some examples, the storage cells MC may be DRAM cells. It should be noted that the embodiments of this application do not limit the type of storage cells MC; for example, storage cells MC may also be any other non-volatile storage cells besides DRAM cells.
[0055] The storage array 10 can also be a storage section, each of which includes multiple storage blocks.
[0056] The storage array 10 may also include one or more storage banks 101, each storage bank 101 including multiple storage units. Different storage banks 101 may be implemented to include the same type of storage cells MC or to include different types of storage cells MC.
[0057] Multiple storage banks 101 can be divided into multiple storage groups (BGs) according to operational needs, with each storage group comprising a number of storage banks. For example, a storage device 100 comprising 32 storage banks can be divided into 8 storage groups, with each storage group comprising 4 storage banks. As another example, a storage device 100 comprising 16 storage banks 101 can be divided into 4 storage groups, with each storage area comprising 4 storage banks 101.
[0058] In some embodiments, a row can be configured as a wire extending along a row direction and electrically connected to multiple memory cells (MCs). For example, a row can be defined as a word line extending along a row direction. Multiple rows are identified as Row1 to Rowj, where j is a positive integer greater than 1.
[0059] The storage bank 101 may also include multiple columns, which can be configured as wires extending along the column direction and electrically connected to multiple storage cells MC. For example, a column can be defined as a bit line extending along the column direction. The multiple columns are identified as Col1 to Col1, where i is a positive integer greater than 1. A counter 11 corresponding to each row can store the number of accesses (i.e., the number of times it is activated) of the corresponding row as a count value. For example, when a target row is accessed, the count value can be read from the counter 11 corresponding to the target row that is in an active state. The read count value can then be modified, and the modified count value can be written back to the counter 11 corresponding to the target row. The number of accesses for each row in the multiple rows can be stored in the corresponding counter 11 through a read-modify-write (RMW) operation. The count value stored in the counter 11 can be referred to as "row activation count data" or "PRAC data". Understandably, in some examples, some memory cells MC connected to a row can be used as counters 11, and correspondingly, a portion of the memory bank 101 is a counting region 111, which includes counters 11 corresponding to each of the multiple rows.
[0060] The row hammer management circuit 102 can manage the count value of each row in the memory bank 101. For example, the row hammer management circuit 102 manages the count value in the following ways: configuring the initial value, generating the count value, modifying the count value, resetting the initial value, etc. The row hammer management circuit 102 can count the number of accesses to a target row based on commands received from the controller, and can store the counted access counts in counter 11. For example, when a word line is activated according to an ACT (active) command received from the controller, the row hammer management circuit 102 can count the number of accesses to the target row corresponding to the activated word line. Then, the row hammer management circuit 102 can store the count value as the number of accesses in counter 11 associated with the corresponding target row. However, this is only an example; for example, the row hammer management circuit can count the number of accesses to a target row based on a PRE (precharge) command.
[0061] According to some implementations, the row hammer management circuit 102 can perform an RMW operation to manage the count value of each of the multiple rows. For example, when an activation command is applied from the controller for a target row, the row hammer management circuit 102 can perform the RMW operation by: reading the count value from the counter 11 of the target row; generating a modified count value by incrementing the read count value by "1"; and writing the modified count value back to the counter 11 of the target row.
[0062] Furthermore, the row hammer management circuit 102 can reset the count value. In this case, resetting can refer to an operation that changes or sets the count value to an initial value. For example, the row hammer management circuit 102 can reset the count value corresponding to the managed attack row based on a row hammer refresh operation. A row hammer refresh operation can refer to an operation that refreshes the victim row independently of a normal refresh operation.
[0063] The initial value can be any random number from 1 to 63. It should be noted that the embodiments of this application do not limit the actual value of the initial value. The initial value is any random number from 1 to 63, which helps to reduce the counting capacity required by the counter 11.
[0064] Figure 3 Another functional block diagram of a storage device provided for some embodiments of this application.
[0065] refer to Figure 3 The storage device 100 may also include a register 103, which can be used to manage the data stored in the counter 11 (see reference 103). Figure 2The register 103 stores the counter values within the memory bank 101. It can be understood that there is a one-to-one correspondence between register 103 and memory bank 101, meaning each register 103 stores the counter values for multiple rows of counters within a corresponding memory bank 101. Alternatively, there can be a one-to-many correspondence between register 103 and memory bank 101, meaning each register 103 can store the counter values for each row of counters within multiple memory banks 101.
[0066] For example, register 103 is configured to store the address of at least one of the multiple rows and the corresponding count value.
[0067] Register 103 can store the row addresses and corresponding count values associated with rows having large count values from multiple rows. It is understood that the number of count values that register 103 can store is related to its storage capacity; the corresponding number of row addresses and their corresponding count values can be determined and stored in register 103 based on its storage capacity. For example, during the operation of storage device 100, the k largest count values among all count values corresponding to all rows in the memory are retrieved, and these k count values, along with their corresponding row addresses, are stored in register 103. k can be any positive integer, such as 5, 6, or 10.
[0068] It is understandable that the "largest k count values" mentioned above refer to the k count values that are ranked in the last k positions when sorted in ascending order among all count values.
[0069] The row hammer management circuit 102 is also configured to update register 103 using the address corresponding to the target row in the access request and the modified count value. The access request can be an activation operation request or a precharge operation request. If the address corresponding to the target row in the access request is already stored in register 103, the count value corresponding to the target row stored in register 103 is updated to the modified count value; if the address corresponding to the target row in the access request is not stored in register 103, the address corresponding to the target row and the count value are stored in register 103.
[0070] In other words, the row hammer management circuit 102 is also configured to update register 103 based on a comparison between the modified count value corresponding to the target row and the count value of at least one row stored in register 103.
[0071] The row hammer management circuit 102 is also configured to replace the minimum count value with the modified count value if the modified count value corresponding to the target row is greater than the minimum count value in at least one row of count values stored in register 103.
[0072] If the minimum count value in register 103 is greater than or equal to the preset threshold, an alarm message is triggered and provided to the host. The host can issue a refresh (REF) command through the controller to refresh the affected row, thereby protecting the affected row.
[0073] The address associated with a row managed in register 103 and the counter can be referred to as an entry in register 103. The row hammer management circuit 102 is also configured to replace the entry in register 103 corresponding to the minimum count value with the address of the target row and the modified count value if the modified count value corresponding to the target row is greater than the minimum count value, which is the minimum count value among the count values of at least one row stored in register 103.
[0074] For example, when storage device 100 has a row hammer refresh opportunity, storage device 100 can perform a row hammer refresh operation. In this document, a row hammer refresh opportunity may include the case where a row refresh (REF) command is issued from the host or a row refresh management (RFM) command is issued from the host. However, this application is not limited to this. For example, storage device 100 may perform a row hammer refresh operation in an idle state or while performing background operations.
[0075] Figure 4 Another functional block diagram of a storage device provided in some embodiments of this application.
[0076] refer to Figure 4 The storage device 100 may further include a refresh control circuit 104. The refresh control circuit 104 is configured to perform a row hammer refresh operation based on a row hammer refresh command, and to output a refresh row address corresponding to the row for which the row hammer refresh operation is performed, based on the row hammer refresh command. The row hammer management circuit 102 is also configured to reset the counter 11 (see reference) of the attack row associated with the refresh row address based on the refresh row address. Figure 2 The initial value of ).
[0077] It is understood that, unless otherwise specified, the "row that performs the row hammer refresh operation" mentioned in the embodiments of this application is the victim row.
[0078] In some embodiments, the storage device 100 may be based on a plurality of counters 11 (reference 11). Figure 2 The storage device 100 uses the count values stored in multiple counters to perform a row hammer refresh operation. For example, the storage device 100 can select the management attack row from multiple rows based on the count values stored in multiple counters. According to some embodiments, the storage device 100 can select the row corresponding to the count value with a relatively large value from multiple rows as the attack row, but this application is not limited to this. Therefore, the storage device 100 can perform a row hammer refresh operation on the victim row that is physically adjacent to the attack row.
[0079] After performing a row hammer refresh operation, since the risk of a row hammer occurring at the victim row due to accessing a management attack row has been eliminated, the row hammer management circuit 102 can reset the initial value of the counter 11 corresponding to the management attack row. Furthermore, the row hammer management circuit 102 can also reset the counter value corresponding to the row that underwent a normal refresh operation; for example, corresponding to a normal refresh operation on one of multiple rows, the row hammer management circuit 102 can reset the initial value of the counter corresponding to that row.
[0080] Figure 5 This is a diagram illustrating a victim row in a storage device subjected to a one-sided attack. Figure 6 This is a schematic diagram illustrating a victim row in a storage device subjected to a two-sided attack.
[0081] like Figure 5 and Figure 6 As shown, rows A1 to AK in the memory are arranged in physically adjacent rows. A row hammer attack refers to the phenomenon where repeatedly activating or accessing a row (the aggressor row) interferes with the storage cells of physically adjacent rows, causing data flipping in the storage cells of the physically adjacent rows (the victim rows), i.e., data corruption in the storage cells of the victim rows. Row hammer attacks include two types: single-side attacks and double-side attacks (also known as parallel attacks).
[0082] like Figure 5 The image shows a one-sided attack, where the attacking row on the victim's side is activated multiple times. For example... Figure 6 The diagram illustrates a two-sided attack, where the attacking rows on either side of the victim row are activated multiple times, accelerating charge leakage in the memory cells of the victim row to speed up data flipping. Compared to a one-sided attack, a two-sided attack requires fewer activations. For example, a one-sided attack requires 1024 activations to induce data flipping in the memory cells of the victim row, while a two-sided attack only requires 512 activations on each of the upper and lower rows to achieve the same effect.
[0083] The above analysis clearly shows that two-sided attacks are more likely to cause data flipping in the memory cells of the victim row. If the initial value of the counter is fixed, such as 0, the attacker knows the entire protection mechanism of the storage device against row hammer attacks and can easily guess the row that the storage device is protecting (i.e., the protected row) based on the known protection mechanism. Based on this, the attacker can take measures to avoid the actual protected row and accumulate the activation count to the remaining rows. This results in the target row adjacent to the actual protected row being activated more than the threshold, causing data flipping in the memory cells of the protected row adjacent to the target row, thus the protected row is attacked by the attacker. Therefore, designing the initial value of the counter to be a random number means that even if the attacker knows the existence of the random number, because the actual protected row of the storage device differs from the attacker's expectation, the attacker's attack is spread evenly across the actual protected row, ultimately reducing the number of times the target row adjacent to the actual protected row is activated, thereby avoiding the row hammer effect, preventing the actual protected row from being attacked, and ensuring that the data in the memory cells corresponding to the actual protected row will not be flipped.
[0084] In some embodiments, random numbers can be generated by a linear feedback shift register. Using a linear shift register to generate random numbers makes the random numbers more random, further hindering attackers from guessing them.
[0085] Figure 7 This is a functional block diagram of a hammer management circuit in a storage device provided in some embodiments of this application.
[0086] refer to Figure 7 The hammer management circuit 102 includes a configuration circuit 112. The configuration circuit 112 is configured to receive a seed SEED and generate a random number lfsr data based on the seed SEED.
[0087] In some examples, the storage device stores configuration values corresponding to the storage blocks. During the initialization phase, the seed (SEED) is obtained based on these configuration values. During the row hammer management phase, the seed can be obtained based on the refresh row address of the row that underwent the row hammer refresh. Since the seed is based on the address of the previously protected victim row during the row hammer management phase, this further reduces the probability of an attacker guessing the correct random number. During the row hammer management phase, if the number of consecutive row hammer refresh operations reaches a preset value, the seed is obtained based on the refresh row address corresponding to the row that underwent the previous row hammer refresh operation. Thus, during the row hammer management phase, a new seed is reseeded, and the random number is obtained based on this new seed. This further enhances the randomness of the random number, thereby further reducing the probability of the random number being guessed, i.e., further reducing the probability of an attacker guessing the row that is actually being protected.
[0088] The preset value can be any value greater than 1. For example, taking a preset value of 4, after four consecutive row hammer refresh operations, the seed is obtained based on the refresh row address corresponding to the row in the fourth row hammer refresh operation. For example, the refresh row address of the fourth row hammer refresh operation can be used as the seed, or the refresh row address of the fourth row hammer refresh operation can be logically operated on to obtain the seed. It should be noted that the embodiments of this application do not limit the preset value; for example, the preset value can also be 2, 3, or 6, etc.
[0089] In some cases, during the hammer management phase, if the number of consecutive hammer refresh operations does not reach a preset value, the seed is not updated, and the initial value for the current hammer refresh operation is obtained based on the initial value corresponding to the previous hammer refresh operation. Not updating the seed after a certain number of hammer refresh operations helps improve the non-linearity between the random number and the seed, further enhancing the randomness of the random number.
[0090] Understandably, in some other examples, the preset value can be 1, meaning that as long as a row hammer refresh operation is performed once, the seed is obtained based on the refresh row address corresponding to the row in the previous row hammer refresh operation. For example, the refresh row address of the previous row hammer refresh can be used as the seed, or the refresh row address can be processed by logical operations and then used as the seed.
[0091] Figure 8 for Figure 7 A schematic diagram of a circuit configuration.
[0092] refer to Figure 8 The configuration circuit 112 includes a seed controller 21 and a random number generator 22. The seed controller 21 is configured to receive a seed SEED and output the seed SEED and an update control signal lfsr_update. The random number generator 22 is configured to receive the seed SEED output by the seed controller 21 and generate and output a random number lfsr_data in response to the update control signal lfsr_update.
[0093] The seed controller 21 is further configured to receive a first seed SEED1, output the first seed SEED1 as the seed SEED during the initialization phase, and during the row hammer management phase, if the number of consecutive row hammer refresh operations is less than a preset value, the seed SEED is not updated; if the number of consecutive row hammer refresh operations is equal to the preset value, the second seed SEED2 is received and the seed is updated to the second seed SEED2. The preset value is n, where n is a positive integer greater than 1, and the second seed SEED2 is obtained based on the refresh row address corresponding to the row in the (n-1)th row hammer refresh operation.
[0094] Understandably, if the random number generator 22 does not receive the update control signal lfsr_update, or in other words, the update control signal lfsr_update received by the random number generator 22 is invalid, then the seed SEED received by the random number generator 22 for generating the random number lfsr data remains unchanged. When the random number generator 22 receives the update control signal lfsr_update or the update control signal lfsr_update is valid, then the seed SEED received by the random number generator 22 for generating the random number lfsr data is updated.
[0095] The first seed, SEED1, can be obtained based on the configuration value corresponding to the storage bank stored in the storage device. The second seed, SEED2, is the refresh row address corresponding to the row in the (n-1)th row hammer refresh operation, or it is the seed obtained by performing logical operations on the refresh row address corresponding to the row in the (n-1)th row hammer refresh operation.
[0096] As discussed above, n can be 2, and correspondingly, the seed is updated to the second seed SEED2 after each row hammer refresh operation. In other examples, n can also be greater than 2, and correspondingly, the seed SEED is updated to the second seed SEED2 only after n-1 consecutive row hammer refresh operations, while the seed SEED received by the random number generator 22 remains unchanged before the n-1th row hammer refresh operation. n being greater than 2 helps reduce the linear relationship between the random number lfsr data output by the random number generator 22 and the output itself, resulting in a higher degree of randomness in the random number lfsr data. Therefore, the probability of an attacker guessing the protection mechanism within the storage device is lower, which further improves the row hammer protection effect.
[0097] Figure 9 This is another functional block diagram of the hammer management circuit in a storage device.
[0098] refer to Figure 9 The hammer management circuit 102 may also include an arithmetic unit 23. The arithmetic unit 23 is configured to receive an initial seed SEED0 and perform logical operations on the initial seed SEED0 to provide a seed to the configuration circuit 112 so that the seed SEED is in a valid state.
[0099] The function of the operation unit 23 includes performing logical operations on the initial seed SEED0 to ensure that the resulting seed SEED does not contain all "0"s, thus enabling the random number generator 22 to generate valid random numbers. It should be noted that this embodiment does not limit the specific logical operation method of the operation unit 23, as long as it ensures that the seed does not contain all "0"s after the logical operation.
[0100] As an example, the logical operation method of the arithmetic unit 23 can be as follows: perform a NAND operation on every two bits of the initial seed SEED0 to obtain multiple replacement bits, and replace the corresponding bits in the initial seed SEED0 with the corresponding replacement bits to obtain the seed. For example, perform a NAND operation on the 0th and 1st bits of the initial seed SEED0 to obtain the 0th replacement bit, perform a NAND operation on the 2nd and 3rd bits of the initial seed SEED0 to obtain the 1st replacement bit, perform a NAND operation on the 4th and 5th bits of the initial seed to obtain the 2nd replacement bit, and then replace the 0th, 1st, and 2nd bits of the initial seed SEED0 with the 0th, 1st, and 2nd replacement bits respectively to obtain the seed.
[0101] Continue to refer to Figure 9 The row hammer management circuit may also include a selector 24. The selector 24 is configured to output the configuration value stored in the storage device as a seed SEED during the initialization phase, and to output the refresh row address corresponding to the row that previously performed the row hammer refresh operation as a seed SEED during the row hammer management phase.
[0102] The arithmetic unit 23 is connected between the selector 24 and the configuration circuit 112, and the seed output by the selector 24 is used as the initial seed SEED0.
[0103] It is understandable that the aforementioned seed controller 21 (refer to...) Figure 8 The first seed received (see reference) Figure 8 The first seed (SEED1) can be obtained after logical operation processing by the arithmetic unit 23, and the second seed (SEED2) can be received by the seed controller 21 (see reference). Figure 8 () can be the second seed SEED2 obtained after logical operation processing by the arithmetic unit 23.
[0104] Figure 10 for Figure 8 A schematic diagram of a seed controller.
[0105] refer to Figure 10The seed controller 21 may include a processing unit 201, a latching unit 202, and a control unit 203. The processing unit 201 is configured to determine whether the number of consecutively executed row hammer refresh operations equals a preset value; if so, it outputs a first control signal C1; otherwise, it outputs a second control signal C2. The latching unit 202 is configured to receive and output a first seed SEED1 during the initialization phase, and receive a second seed SEED2 during the row hammer management phase. If the first control signal C1 is not received, the seed SEED is not updated; if the first control signal C1 is received, the second seed is output as the seed SEED in response to the first control signal C1. The control unit 203 is configured to generate and output an update control signal lfsr_update in response to the second control signal C2.
[0106] The storage device may further include a hammer counting unit for acquiring the number of consecutively executed hammer refresh operations. The processing unit 201 is connected to the corresponding hammer counting unit and is used to acquire the number of consecutively executed hammer refresh operations. The processing unit 201 also has a comparison function for comparing the number of consecutively executed hammer refresh operations with a preset value. If the number of consecutively executed hammer refresh operations is less than the preset value, a second control signal C2 is output; if the number of consecutively executed hammer refresh operations is equal to the preset value, a first control signal C1 is output.
[0107] During the initialization phase, latch unit 202 receives the first seed SEED1 and outputs the first seed SEED1 as the seed SEED (see reference). Figure 8 Random number generator 22 (reference) Figure 8 Random numbers are generated based on this seed.
[0108] During the hammer management phase, latch unit 202 receives the second seed SEED2. If latch unit 202 does not receive the first control signal C1, the seed output by latch unit 202 remains unchanged, i.e., it is still the first seed SEED1; if latch unit 202 receives the first control signal C1, it updates the second seed SEED2 to the seed SEED (see reference). Figure 8 It's understandable that the second seed SEED2 at this point can be the refresh row address of the previous row hammer refresh operation. After each row hammer refresh, the second seed SEED2 will be updated to the refresh row address of the previous row hammer refresh operation.
[0109] After receiving the second control signal C2, the control unit 203 generates and outputs an update control signal lfsr_update. The random number generator 22 updates the seed used to generate random numbers based on the update control signal lfsr_update to the seed updated by the latch unit 202 last time, that is, the refresh row address corresponding to the row in the (n-1)th row hammer refresh operation is used as the update seed.
[0110] It is understandable that the updated seed can be processed by logical operations through the aforementioned operation unit 23 to ensure that the updated seed does not contain all "0"s.
[0111] In the above technical solution, since the initial value of the counter is a random number, and the initial value of each counter is not exactly the same, the attacker cannot accurately know the actual row to be protected. The greater the probability that the attacker guesses the wrong row to be protected, the stronger the storage device's ability to prevent row hammering. Therefore, the storage device provided by the above technical solution can effectively prevent row hammering.
[0112] Accordingly, this application also provides an electronic device including the storage device as described in any of the foregoing embodiments. Therefore, the content described in the foregoing embodiments is also applicable to the embodiments of the following electronic devices.
[0113] Figure 11 A block diagram of an electronic device provided in an embodiment of this application.
[0114] refer to Figure 11 The electronic device includes a processor 401 and a storage device 100, the storage device 100 being coupled to the processor 401, and the storage device 100 including the storage device provided in any of the foregoing embodiments.
[0115] The processor 401 described above can refer to one or more processors. For example, processor 401 may include one or more central processing units (CPUs), or it may include a CPU and a graphics processing unit (GPU), or it may include an application processor and a coprocessor (e.g., a microcontroller unit or neural network processor). When processor 401 includes multiple processors, these multiple processors may be integrated on the same chip or may be independent chips. A processor may include one or more physical cores, where a physical core is the smallest processing module.
[0116] As illustrated, the processor 401 can be implemented in at least one of the following hardware forms: Digital Signal Processing (DSP), Field Programmable Gate Array (FPGA), and Programmable Logic Array (PLA).
[0117] Processor 401 may integrate one or more of the following: a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Electronic devices may include one or more of the following: for example, smartphones, personal computers (PCs), mobile phones, video phones, e-book readers, desktop PCs, laptop PCs, netbooks, workstations, servers, personal digital assistants (PDAs), portable media players (PMPs), MPEG 1 audio layer 3 (Moving Picture Experts Group Audio Layer III) players, mobile medical devices, cameras, home appliances, medical devices, Internet of Things (IoT) devices, and wearable devices. Wearable devices may be accessory-type, fabric or clothing-type, body-attached type, or implantable circuit type. Accessory-type wearable devices may include, for example, watches, rings, bracelets, anklets, necklaces, glasses, contact lenses, or head-mounted displays (HMDs). This electronic device can also be used in large servers, such as data centers or AI computers.
[0118] Those skilled in the art will understand that the above-described embodiments are specific examples of implementing this application, and in practical applications, various changes can be made in form and detail without departing from the spirit and scope of the embodiments of this application. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the embodiments of this application; therefore, the scope of protection of the embodiments of this application should be determined by the scope defined in the claims.
Claims
1. A storage device, characterized in that, include: The storage unit includes multiple rows, each row corresponding to multiple storage units and a counter, the counter being configured to acquire a count value related to the number of times each row is activated, and the count value is obtained by counting based on an initial value; A row hammer management circuit is configured to configure the initial value during an initialization phase, and, during a row hammer management phase, reset the initial value of the counter corresponding to the attack row in response to a row hammer refresh operation, wherein the attack row is the row among the plurality of rows associated with the row in which the row hammer refresh operation is performed, and the initial value is a random number.
2. The storage device according to claim 1, characterized in that, The random number is generated by a linear feedback shift register.
3. The storage device according to claim 1, characterized in that, The hammer management circuit includes: The configuration circuit is configured to receive a seed and generate the random number based on the seed.
4. The storage device according to claim 3, characterized in that, The storage device stores configuration values corresponding to the storage body, and the seed is obtained based on the configuration values during the initialization phase.
5. The storage device according to claim 3 or 4, characterized in that, During the row hammer management phase, if the number of consecutive row hammer refresh operations reaches a preset value, the seed is obtained based on the refresh row address corresponding to the row in the previous row hammer refresh operation.
6. The storage device according to claim 5, characterized in that, During the row hammer management phase, if the number of consecutive row hammer refresh operations does not reach the preset value, the seed is not updated, and the initial value corresponding to the current row hammer refresh operation is obtained based on the initial value corresponding to the previous row hammer refresh operation.
7. The storage device according to claim 3, characterized in that, The configuration circuit includes: A seed controller is configured to receive a seed and output the seed as well as an update control signal; A random number generator is configured to receive the seed output by the seed controller and generate and output the random number in response to the update control signal; The seed controller is further configured to receive a first seed, output the first seed as the seed during the initialization phase, and during the row hammer management phase, if the number of consecutive row hammer refresh operations is less than a preset value, then the seed is not updated; if the number of consecutive row hammer refresh operations is equal to the preset value, then a second seed is received and the seed is updated to the second seed.
8. The storage device according to claim 7, characterized in that, The preset value is n, where n is a positive integer greater than 1. The second seed is obtained based on the refresh row address corresponding to the row in the (n-1)th row hammer refresh operation.
9. The storage device according to claim 7, characterized in that, The seed controller includes: The processing unit is configured to determine whether the number of consecutively executed row hammer refresh operations is equal to a preset value. If yes, it outputs a first control signal; otherwise, it outputs a second control signal. The latching unit is configured to receive and output the first seed during the initialization phase, receive the second seed during the row hammer management phase, and not update the seed if the first control signal is not received, and output the second seed as the seed in response to the first control signal if the first control signal is received. The control unit is configured to generate and output the updated control signal in response to the second control signal.
10. The storage device according to claim 3, characterized in that, The hammer management circuit also includes: The arithmetic unit is configured to receive an initial seed and perform logical operations on the initial seed to provide the seed to the configuration circuit so that the seed is in a valid state.
11. The storage device according to claim 3 or 10, characterized in that, The hammer management circuit also includes: The selector is configured to, during the initialization phase, output the configuration value stored in the storage device as the seed, and during the row hammer management phase, output the refresh row address corresponding to the row that previously performed the row hammer refresh operation as the seed.
12. The storage device according to claim 1, characterized in that, The storage device further includes: The refresh control circuit is configured to execute the row hammer refresh operation based on the row hammer refresh command, and output the refresh row address corresponding to the row in which the row hammer refresh operation is executed based on the row hammer refresh command. The row hammer management circuit is configured to reset the initial value of the counter for the attack row associated with the refresh row address based on the refresh row address.
13. The storage device according to claim 12, characterized in that, The storage device further includes: A register, configured to store the address of at least one of the plurality of rows and the corresponding count value; The row hammer management circuit is also configured to update the register by using the address corresponding to the target row in the access request and the modified count value.
14. The storage device according to claim 13, characterized in that, The row hammer management circuit is further configured to update the register based on a comparison between the modified count value corresponding to the target row and the count value of at least one row stored in the register.
15. The storage device according to claim 14, characterized in that, The row hammer management circuit is further configured to replace the entry in the register corresponding to the minimum count value with the address of the target row and the modified count value if the modified count value corresponding to the target row is greater than the minimum count value, where the minimum count value is the minimum count value among at least one row of count values stored in the register.
16. An electronic device, characterized in that, Includes the storage device as described in any one of claims 1 to 15.