Memory Access Analysis

Abstract

A data processing apparatus is provided that includes a memory access circuit configured to issue an access request to a memory system, an estimation circuit configured to estimate a statistical concentration count on a memory row address accessed by the access request, and a decay circuit configured to apply an exponential time-based decay during the estimation of the statistical concentration count.

Description

[Technical field]

[0001] The present technology relates to data processing and in particular memory access systems.

[0002] In a rowhammer attack, an attacker repeatedly accesses (or interferes with) a given memory row of cells of a physical memory unit in an attempt to flip stored bits of memory cells in adjacent rows. If the flipped bits are sensitive, this may lead to unwanted privilege escalation. It is desirable that such memory access patterns are detectable so that evasive action can be taken. However, it may be possible to spoof such access patterns, which means that no evasive action may occur.

[0003] Viewed from a first exemplary configuration, a data processing apparatus is provided comprising: a memory access circuit configured to issue an access request to a memory system; an estimation circuit configured to estimate a statistical concentration count on a memory row address accessed by the access request; and a decay circuit configured to apply an exponential time-based decay during estimation of the statistical concentration count.

[0004] Viewed from a second exemplary configuration, a data processing method is provided that includes issuing an access request to a memory system, estimating a statistical concentration count on a memory row address accessed by the access request, and applying an exponential time-based decay while estimating the statistical concentration count.

[0005] Viewed from a third exemplary configuration, there is provided a computer readable medium for storing computer readable code for manufacturing a data processing apparatus, the data processing apparatus comprising: a memory access circuit configured to issue an access request to a memory system; an estimation circuit configured to estimate a statistical concentration count on a memory row address accessed by the access request; and a decay circuit configured to apply an exponential time-based decay during estimation of the statistical concentration count. [Brief description of the drawings]

[0006] The present technology will now be further described, by way of example only, with reference to embodiments thereof illustrated in the accompanying drawings, in which: [Figure 1] FIG. 1 illustrates an example of a memory system implemented using several trench capacitors. [Diagram 2] FIG. 1 shows a schematic diagram of a data processing device; [Diagram 3] 4 shows an example of an estimation circuit and a damping circuit. [Figure 4] FIG. 13 is a flowchart illustrating a data processing method. [Diagram 5] FIG. 5 shows the source code (written in python) of an algorithm implementing the process illustrated by the flowchart of FIG. 4.

[0007] Before discussing the embodiments with reference to the accompanying drawings, certain embodiments and associated advantages are described below.

[0008] According to one exemplary configuration, a data processing apparatus is provided, comprising: a memory access circuit configured to issue an access request to a memory system; an estimation circuit configured to estimate a statistical concentration count on a memory row address accessed by the access request; and a decay circuit configured to apply an exponential time-based decay during estimation of the statistical concentration count.

[0009] A Rowhammer attack can theoretically be detected by considering the number of accesses to a unique row (i.e., memory row address) made over a period of time. If within that period a large number of accesses are made to the same memory row compared to other rows, it can be concluded that a Rowhammer attack is being performed. However, in practice, counting the number of accesses to each unique row address is prohibitively expensive in terms of memory requirements. Such a system would likely need to store a large number of bits of information in digital or analog form for each individual memory row of cells, i.e., for every row that can be stored in the system, several more bits would be needed to calculate the number of accesses to that row. Thus, such an approach is impractical at best. An alternative approach is to estimate the cardinality without actually recording each access request individually. However, simply knowing the cardinality is not sufficient, as this overlooks the time component. Rowhammer attacks rely on frequent accesses to a particular memory row in a short time interval (e.g., less than the refresh period of the underlying memory). It has been suggested to solve this problem by using a sliding window (e.g., by only considering access requests made within the last x milliseconds). However, such techniques may not be effective in practice because Rowhammer relies on the frequency of accesses, which may vary within a given sliding window and may not be adequately discriminated. Furthermore, if the window slides, it becomes necessary to track when several individual accesses were made, thus significantly increasing storage and processing requirements. The present technique overcomes these limitations by applying an exponential time-based decrease or decay. That is, the estimated statistical cardinality is adjusted according to how far apart particular accesses are. If accesses are far apart, their statistical cardinality estimates are weighted less than if the accesses are close together.As a result, Rowhammer attacks can be better measured than is possible using a sliding window, and the storage requirements for detecting such attacks can also be reduced.

[0010] In some examples, the data processing apparatus includes a limiting circuit configured to limit access requests in response to the statistical cardinality count. Limits can be placed on a pattern of access requests to reduce a frequency of row accesses below a critical frequency for a Row Hammer attack based on the estimated statistical cardinality count. As a result, the effectiveness of such attacks can be reduced based on access patterns that indicate a Row Hammer attack may be occurring.

[0011] In some examples, the limiting circuitry is configured to limit a rate at which access requests are issued to the memory system to at least some of the memory row addresses in response to the statistical concentration count, resulting in fewer accesses occurring in a short period of time and reducing the probability of bit flips occurring.

[0012] In some examples, the limiting circuitry is configured to limit access requests in response to a drop in the statistical concentration count. The drop in the statistical concentration count can be a drop to a predetermined value or a drop by an amount (either a drop by a specific amount or a percentage amount). A drop in the estimated statistical concentration count indicates a decrease in the number of unique row addresses being accessed, which can therefore indicate that a Row Hammer attack is occurring. This is because a high data throughput over a small number of memory rows implies high frequency accesses to at least some of these rows.

[0013] In some examples, the estimation circuit is configured to estimate the statistical concentration count on the memory row address using the longest seen pattern in the memory row address. The pattern can be a number of consecutive most significant zeros on the address. For example, if a first access request is to row address 1000 (e.g., address 8) and a second access request is to row address 1100 (e.g., address 12), then the maximum number of consecutive most significant zeros seen (i.e., suffixed zeros in big endian representation) is 3. Thus, for a long stream of accesses, the maximum number of consecutive most significant zeros seen is just enough to store all of the row addresses, and thus the maximum number of distinct possible addresses is 2 3 = 8. This estimate is a crude approximation and therefore may have a high variance (although this can be reduced by techniques described below). In these examples, the default starting value for the number of consecutive most significant zeros seen may be 0. In some embodiments (as described below), the row address may be hashed before the number of consecutive most significant leading zeros is counted.

[0014] In some examples, the data processing apparatus includes a separation circuit that estimates the statistical concentration count on a memory row address by separating the access requests into multiple substreams and estimating the statistical concentration count for each of the substreams. By separating the access requests into multiple substreams, it is possible to estimate the statistical concentration count by considering a number of "sample bins," estimating the statistical concentration count for each stream (or bin), and then combining these values ​​to determine an overall statistical concentration count.

[0015] While there are several ways to take the statistical concentration count on a memory row address by using the statistical concentration counts for each of the substreams, in some examples this is accomplished by performing a center bias function on the statistical concentration counts for each of the substreams. The center bias function can be a normalizing or averaging function, such as the harmonic mean. For example, if the statistical concentration counts of each of the four substreams are calculated as A, B, C, D, then the overall statistical concentration count on the memory address is ((A -1 +B -1 +C -1 +D -1 ) / 4) -1 The harmonic mean can be thought of as a pessimistic mean in that it tends towards the smaller values ​​in a set of values, so larger outliers are given less weight.

[0016] In some examples, the data processing apparatus includes a hash circuit that hashes each of the memory row addresses before they are provided to the estimation circuit. The estimation circuit therefore performs its estimation on at least a portion of the hashed row address, rather than its (raw) original address. The use of a hash algorithm allows the same input row address to provide the same output row address, thereby allowing repeated accesses to the same memory row address to be identified. However, the relationship between groups of row addresses is otherwise "randomized" such that adjacent input row addresses generate distributed output row addresses. This allows the estimated statistical cardinality count to be better distinguished from regular row accesses that may otherwise be statistically over-correlated. For example, when a program iterates over an array of integers, many memory row addresses are highly localized. This can interfere with estimated statistical cardinality counts that operate using leading zeros, since highly localized row addresses are more likely to have a similar number of leading zeros. However, when input addresses are hashed, the resulting hash has a lot of spreader distribution. As a result, the estimated statistical cardinality count is more likely to resemble the true cardinality count.

[0017] There are also many ways to separate access requests into substreams. However, in some examples, access requests are separated into multiple substreams based on certain bits of the memory row address after it hashed. The use of such a hashing algorithm can be expected to distribute row accesses equally among the substreams (e.g., bins). If some substreams have a statistical cardinality of 0, the access request can be considered suspicious since this indicates that only a small number of rows are being accessed.

[0018] In some instances, the hash is a cryptographic hash. In this way, a relatively even distribution of access requests (to rows) should occur between the substreams. In some cases, the hashing algorithm used to generate the hash produces an avalanche effect (butterfly effect), and in some cases, the hashing algorithm meets strict avalanche criteria. The avalanche effect means that even a change in a small portion of the input to the hash function (e.g., a single bit) will result in a large number of differences in the resulting hash. Again, this can be used to provide a good distribution of addresses across the substreams.

[0019] In some examples, the estimation circuitry is configured to estimate the statistical cardinality count of each substream by using the longest seen pattern in the memory row addresses of that substream for that substream. For example, the pattern may be the maximum number of consecutive most significant zeros in the memory row addresses belonging to that substream. The longest seen pattern in a substream can be used to provide a reasonable estimate with a high variance of the number of unique row addresses accessed in that substream. By calculating such a value for each "random" substream, it is possible to take several random samples of the longest seen unique patterns of row memory accesses and use this to determine whether there is a particular bias. For example, if the longest seen unique pattern for a particular substream is 0 (which is the default starting value), then no accesses have been seen in that substream. While this may simply be coincidence, if some substreams have an estimated statistical cardinality of 0, this suggests that a large number of accesses are being made to a small number of addresses (thereby preventing accesses from being seen for a substream), which is indicative of a Rowhammer attack.

[0020] In some examples, the estimation circuitry includes a storage circuit associated with each substream of the substreams that stores a time when a next most recent access request was seen among the access requests associated with that substream, and the attenuation circuitry is configured to adjust the statistical concentration count of each substream of the row memory address substreams based on the time between successive access requests among the access requests belonging to that substream. In this way, the statistical concentration count is reduced when a long time elapses between accesses belonging to the same substream. This is because accesses that occurred a long time ago in a particular substream are of little interest and are not part of a high frequency interference. Such accesses should not be given significant consideration in determining whether a Row Hammer attack is occurring.

[0021] In some examples, the exponential time-based decay is equal to a constant raised to the power of a time component, where the time component is based on the time between successive access requests of the substream. Thus, as the time between successive accesses of a substream increases, the difference increases and the estimated statistical concentration count decreases. The time component can also be referred to as a geometric decay factor over time.

[0022] In some instances, the constant is less than 1 and greater than 0. As a result, the exponential time-based decay has a damping effect.

[0023] In some examples, the decay circuit is configured to inhibit application of exponential time-based decay to the latest estimate of the statistical concentration count of the substream if the difference between the latest estimate and the previous estimate is positive, and to apply exponential time-based decay to the difference. If a small concentration is seen when a large concentration was previously seen, the large concentration is decreased since the large concentration was in the past. The current concentration is considered without decrease (decay) since it is currently estimated. For example, at time 4000000, zzz00000 is seen, so 2 5= 32 row activations are estimated and the length is recorded as 5. At time 4000100, zzzzzz00 is seen, so here 2 2 = 4. We estimate the activation of rows 100 time units ago, so we reduce the difference 32-4=28 by a reduction factor of 0.99 to 28 × (0.99 100 )=10.248, so the new estimate is 10.248+4=14.248. At time 4000100, if we got xx000000 instead, the estimate would be 2 6 = 64, and the previous estimate of 2 5 For =32 the difference is -32, not +4, and therefore negative. In that case, only the length 6 has been updated, since this corresponds to the cardinality currently being looked at.

[0024] In some examples, the decay circuit is configured to inhibit application of exponential time-based decay during estimation of the statistical concentration count when the statistical concentration count falls. Thus, decay is limited to situations where the statistical concentration appears to be decreasing, as this is a situation where a Rowhammer attack may be occurring. If the statistical concentration appears to be increasing (more consecutive top zeros are seen than before), then a Rowhammer attack is unlikely to be in progress as new addresses are being accessed.

[0025] In some examples, the decay circuit is configured to apply an exponential time-based decay to the statistical concentration count multiple times. In this way, even though certain data is stored for the statistical concentration count, the process can be considered "memoryless" with respect to whether decay has been applied previously or not. Indeed, if the number of consecutive most significant zeros in an address decreases from A to E, the technique is unaffected by whether this is done through intermediate values ​​B, C, D, or whether the number of consecutive most significant zeros proceeds directly from A to E.

[0026] In some examples, memory systems are configured to use multiple trench capacitors, each storing a single bit. Such memory systems may be susceptible to rowhammer attacks resulting from leakage of electrons between one (interfered) trench capacitor storing one bit and an adjacent trench capacitor storing another bit. If sufficient leakage occurs, the electrons in the trench capacitors rise to a level that causes the trench capacitors to be "refreshed" with an incorrect value during the refresh process.

[0027] Specific embodiments will now be described with reference to the drawings.

[0028] FIG. 1 illustrates an example of a memory system 160 implemented using several trench capacitors 300, 310, 320, 330, 340 (etc.). Each trench capacitor serves to store a single bit by storing (or not storing) electrons. Over time, electrons leak out of the trench capacitors 300, 310, 320, 330, 340. Thus, a "refresh" is performed every period. Here, a determination is made as to whether the charge on the capacitor is above or below a certain threshold, which is used to either drain the capacitor back to ground (e.g., to indicate storage of a "0") or to restore the charge on the capacitor to "full capacity" (e.g., to indicate storage of a "1"). Such a system 160 is susceptible to a so-called "row hammer" attack. Here, the circuitry associated with accessing a particular cell / capacitor 310 is repeatedly activated for short periods of time in order to leak electrons out of that capacitor 310 into the adjacent capacitors 300, 320. If sufficient leakage occurs, the total charge stored on adjacent capacitors exceeds a threshold, and in the next refresh cycle, the capacitors will charge, thereby storing a different value (e.g., a "1" instead of a "0"). If the capacitors 320, 300 with the changed values ​​store sensitive data, such as permissions, this may result in privilege escalation or access to other sensitive data. A row 350 of trench capacitors may correspond to a memory address, e.g., eight trench capacitors in that row form a byte to which the memory address points.

[0029] FIG. 2 is a schematic diagram of a data processing device 100. The data processing device 100 includes a load / store unit 110, which is an example of a claimed memory access circuit (another example could be a last level cache in a cache hierarchy that sends requests to a main memory backed by, for example, DRAM). It is responsible for receiving operations corresponding to instructions to access memory and asserting related signals to cause memory access requests to be issued to the memory system 160. An estimation circuit 120 is provided to provide an estimated statistical cardinality count. A decay circuit 130 is provided to selectively decay this estimate using an exponential time-based decay parameter. A limiting circuit 140 can then be used to limit memory access requests being sent to the memory system 160 based on this decayed statistical cardinality count. In this example, the estimation circuit 120 includes a separation circuit 150. This is so that the memory access requests can be "randomly" split into several streams and an estimated statistical cardinality count is calculated (and decayed) for each stream. An overall aggregation operation (e.g., harmonic mean) is performed on each of these values ​​to provide an overall estimate of the statistical cardinality count of the aggregate stream. By computing the cardinality counts of the aggregated stream, it is possible to more accurately find memory access patterns that correspond to Rowhammer attacks, i.e., memory access patterns in which a small number of locations in the memory system are accessed more frequently within a short period of time compared to other locations in the memory system.

[0030] FIG. 3 shows an example of the estimation circuit 120 and the decay circuit 130. The hash circuit 210 forms part of the separation circuit. In particular, it takes the row address of a memory access request (which may typically be for a row of trench capacitors in a physical memory system) and performs a hash on that address. The purpose of the hash is to "randomize" the address such that the same input address gives the same hashed (output) address, so that repeated accesses to the same address can be detected, but otherwise the relationship between the input address and the hashed (output) address is effectively random. Thus, the hash function performed by the hash unit 210 may be a cryptographic hash. In some embodiments, the hash function has an avalanche property (also known as a butterfly property) such that small changes in the input address produce large changes in the hashed (output) address, thereby providing a better distribution of the hashed (output) addresses. In this case, the hash algorithm produces a 64-bit output, which is separated into a first group of 52 bits (x) and a second group of 12 bits.

[0031] The 52 bits are passed to a find-first-set circuit 230, which is an example of a portion of the estimation circuit 120 that determines the number of consecutive most significant zeros in the row memory address (specifically, these 52 bits of the hashed memory address). The find-first-set operation is accomplished by an operation mathematically equivalent to max(log2(x[0:51]&-x[0:51])+1,0), which determines the position of the first bit in x that is equal to 1, and returns the length of the suffix as the logarithm in base 2 of that position (note that the use of x[0:51] means that the bits of x are inverted during the operation). The resulting number (b) is output to a reduced update circuit 240, which performs a decay function. Note that different patterns may also be detected and thus may not require inversion of the 52 bits. For example, if a pattern of most significant zeros is detected, then no bits need to be inverted.

[0032] The other 12 bits are used as an indication of the stream to which this access belongs. The 12 bits are used as a read address of memory 220, which is an example of the claimed storage circuit. Memory 220 stores the estimated statistical cardinality count in the form of observed length and timestamp for each stream, thus storing 4096 different (estimated statistical cardinality count, timestamp) pairs in this example. The read address is used to access the relevant entry in memory 220 and provide the stored value stored for stream (a). The result is then passed to reduced update circuit 240.

[0033] In the reduced update circuit 240, an exponential time-based decay / decay is applied. In particular, if the estimated statistical concentration count increases (the previously recorded value of a is less than b), no adjustment is made. Otherwise, the updated value is equal to the new value plus the difference between the old and new values ​​weighted to reduce their importance. The weighting is exponential and based on the time since the previous value was recorded. Thus, higher estimated statistical concentration counts seen a long time ago are given little weight, and new estimated statistical concentration counts are closer to the most recently calculated value. Previous high values ​​are not completely discarded (unless a very long time has passed). Also, note that if a truly random stream of addresses is passed (which is the case when the same addresses are not accessed repeatedly), since no adjustment is made when the estimated statistical concentration count increases, the estimated statistical concentration count is expected to generally remain high even with occasional small decreases.

[0034] There are several ways the weighting can be done, however in these examples the formula used to calculate the attenuation is: b+(ab)m t where b is the determined number of consecutive leading zeros calculated based on the current access address, a is the previously stored estimated statistical cardinality count, m is a constant (e.g., 0.9999), and t is the time (e.g., in nanoseconds) between this access and the most recent previous access in this stream.

[0035] Once the new value is determined, this new value is then stored in memory 220 for this particular stream along with the current timestamp.

[0036] A center bias function is performed by taking a harmonic mean of the individual statistical cardinality count values ​​in memory to determine an overall estimated statistical cardinality count (i.e., across the memory system 160). Other techniques for center biasing will be understood (such as those proposed in "HyperLogLog in Practice: Algorithmic Engineering of a State of The Art Cardinality Estimation Algorithm" by Stefan Heule et al. can be used).

[0037] The results of this operation can then be considered to determine whether evasive action should be taken (e.g., by a limiting circuit). There are several ways to do this. One way is to look for a sudden drop in the amount during a period when the total throughput of accesses to the memory is high, and if such a drop occurs, it can be concluded that a Rowhammer attack may be occurring. In another situation, it can be examined whether the estimated statistical cardinality count falls below a predetermined value during a period when the total throughput of accesses to the memory is high, and if so, it can be assumed that a Rowhammer attack may be occurring. Another option can be to compare the ratio of the previous value of the estimated statistical cardinality count to the new value. In either case, a drop in the estimated statistical cardinality count means that a smaller range of memory addresses is being accessed and therefore a Rowhammer attack may be occurring.

[0038] Note that which bits are used to determine the sub-stream number after the hash is performed is not particularly relevant as long as this remains consistent, and therefore this can be varied across measurements to prevent an attacker from devising adversarial patterns that invalidate a particular hash function and lead to erroneous cardinality estimates.

[0039] FIG. 4 shows a flow chart 400 illustrating a method for processing data. In step 405, an access request is received. In step 410, the stream to which the access is associated is identified by hashing the access address and using some of those bits to identify a stream number. The number of streams into which the access request is split is determined (as described above) based on the memory system's susceptibility to rowhammer attacks. In step 415, the number of "leading zeros" (consecutive most significant zeros) in at least a portion of the hashed address (e.g., not used for the stream identifier) ​​is counted as b. In step 420, previously stored data for stream (a) is retrieved (e.g., from memory 220). In step 425, a comparison is made between a and b. If b is greater than or equal to a, then in step 430, the value stored in memory 220 for the stream is simply equal to b. Otherwise, in step 435, the value stored in memory for the stream is simply equal to b+(aB)m t where m is a constant 0.9999 and t is the number of nanoseconds between the time of the current access and the time of the previous access stored as part of a. The value of m can of course vary, but is kept between 0 and 1 to provide a damping effect. The process continues at step 440 (further access requests are processed).

[0040] On a regular schedule, the harmonic mean of all estimated statistical cardinality counts is calculated in step 443. In step 445, it is determined whether the harmonic mean has dropped. If so, in step 450, the access rate of memory accesses is reduced such that rowhammer attacks are essentially suppressed. This limit may be for the address currently being accessed or may be across the entire memory system 160. If not, in step 455, the current access remains the same.

[0041] Note that in this example, the harmonic mean is calculated in response to every access request (step 440). In other embodiments, the harmonic mean is only calculated periodically, after a certain number of accesses have occurred, every period, or even possibly even after the statistical cardinality counts estimated for a single stream have decreased significantly.

[0042] Figure 5 illustrates source code (written in python) of an algorithm that implements the process illustrated by flowchart 400 in Figure 4. Class DiscountedHyperLogLog implements three methods. The first initialization method (__init__), as previously described, sets the decay constant (referred to above as "m") to 0.9999 and initializes memory so that each initial statistical concentration count value (for each stream) is 0. The size of array M is equal to the number of substreams. An internal counter (C) used to count time is also initialized to 0. This allows time to be measured as a number of memory accesses.

[0043] The second method (add) is used to add (or update) an estimated statistical cardinality count for a particular address (value). The value is first hashed (using SHA1 in this case). The variable "j" is used to identify the substream associated with the access (value). The variable "w" is used to store the portion of the hash value used to determine the estimated statistical cardinality count, and self.p indicates the division between the bits used to determine the stream identifier and the bits used to perform the estimated statistical cardinality count. The variable "b" again represents the length of the unique pattern (typically, in this case, all leading zeros) calculated for the hashed access. The variable C is then updated to account for elapsed time (as occurs with each call to "add"); unlike this example, this update can also consist of multiple units of time. The value of b is then compared to the currently stored value for the stream. If b is greater, the stored value is simply updated with the new, greater value. Otherwise, the value has a decay parameter applied as described above. Note that the stored value of M[j] is actually the base 2 logarithm of the estimated cardinality count. The value T indicates the time the stream was previously accessed. At the end of this, the access time for the current stream is updated with the current access time (C).

[0044] The third method (card) is used before determining the harmonic mean (via super().card()). It iterates through the entries stored in memory (M) and reapplies the decay directly to the values ​​stored for each stream. This is necessary because one substream may have last been updated long before card() was called and therefore needs to be decremented by the elapsed time. One can think of this as a virtual access with a unique prefix length of 0.

[0045] In this application, the term "configured to..." is used to mean that an element of an apparatus has a configuration capable of performing a defined operation. In this context, "configuration" refers to a method of arrangement or interconnection of hardware or software. For example, an apparatus may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to" does not imply that an apparatus element needs to be modified in any way to provide the defined operation.

[0046] Although exemplary embodiments of the invention have been described in detail herein with reference to the accompanying drawings, it will be understood that the invention is not limited to those precise embodiments, and that various changes, additions, and modifications may be made by those of ordinary skill in the art without departing from the scope and spirit of the invention as defined by the appended claims. For example, various combinations of the features of the following dependent claims may be made with the features of the independent claims without departing from the scope of the invention.

Claims

1. 1. A data processing device, comprising: a memory access circuit configured to issue access requests to a memory system; an estimation circuit configured to estimate a statistical concentration count on a memory row address accessed by the access request; a decay circuit configured to apply an exponential time-based decay during the estimation of said statistical concentration counts.

2. a limiting circuit configured to limit the access request in response to the statistical concentration count; 2. The data processing device according to claim 1.

3. the limiting circuitry is configured to limit, in response to the statistical concentration count, a rate at which the access requests are issued to the memory system to at least some of the memory row addresses.

3. A data processing device according to claim 1 or 2.

4. the limiting circuitry is configured to limit the access request in response to a decrease in the statistical concentration count.

3. The data processing device according to claim 2.

5. the estimation circuitry is configured to estimate the statistical concentration count on the memory row address using a longest observed pattern on the memory row address; 3. A data processing device according to claim 1 or 2.

6. a separation circuit for estimating the statistical cardinality count on the memory row address by separating the access request into a plurality of substreams and estimating a statistical cardinality count for each of the substreams; 2. The data processing device according to claim 1.

7. the statistical cardinality counts of the memory row addresses are calculated by performing a center bias function on the statistical cardinality counts for each of the sub-streams.

7. The data processing device according to claim 6.

8. a hashing circuit for hashing each of the memory row addresses before providing it to the estimation circuit; 7. The data processing device according to claim 6.

9. the access requests are separated into the plurality of sub-streams based on predetermined bits of the memory row address after hashing; 9. A data processing device according to claim 8.

10. the hash is a cryptographic hash, 10. A data processing device according to claim 8 or 9.

11. the estimation circuitry is configured to estimate, for each substream within the substreams, the statistical cardinality count for that substream by using a longest observed pattern in the memory row addresses of that substream; 6. A data processing device according to claim 5.

12. the estimation circuitry comprises, associated with each substream of the substreams, a storage circuit for storing a time at which a next most recent one of the access requests associated with that substream was seen; the attenuation circuit is configured to adjust the statistical cardinality count for each of the substreams based on a time between successive access requests of the access requests belonging to that substream.

6. A data processing device according to claim 5.

13. the exponential time-based decay is equal to a constant raised to the power of the time component; the time component is based on the time between successive access requests of the sub-stream; 13. A data processing apparatus according to claim 12.

14. the constant is less than 1 and greater than 0, 14. A data processing apparatus according to claim 13.

15. the decay circuit is configured to inhibit application of the exponential time-based decay to a most recent estimate of the statistical concentration count of a substream if the difference between the most recent estimate and a previous estimate is positive, and to apply the exponential time-based decay to the difference.

7. The data processing device according to claim 6.

16. the decay circuit is configured to inhibit application of the exponential time-based decay during estimation of the statistical concentration count when the statistical concentration count decreases.

3. A data processing device according to claim 1 or 2.

17. the decay circuit is configured to apply the exponential time-based decay to the statistical concentration counts multiple times.

3. A data processing device according to claim 1 or 2.

18. the memory system is configured to use multiple trench capacitors, each storing a single bit; 3. A data processing device according to claim 1 or 2.

19. 1. A data processing method comprising: Issuing an access request to a memory system; estimating a statistical cardinality count on a memory row address accessed by said access request; applying an exponential time-based decay during the estimation of said statistical concentration counts.

20. 1. A computer readable medium for storing computer readable code for manufacturing a data processing apparatus, comprising: a memory access circuit configured to issue access requests to a memory system; an estimation circuit configured to estimate a statistical concentration count on a memory row address accessed by the access request; a decay circuit configured to apply an exponential time-based decay during estimation of the statistical concentration counts.

Images