Source-linked AI summary
Revisiting RowHammer: An Experimental Analysis of Modern DRAM Devices and Mitigation Techniques
Jeremie S. Kim, Minesh Patel, A. Giray Yaglikci, Hasan Hassan, Roknoddin Azizi, Lois Orosa, Onur Mutlu
TL;DR
RowHammer threatens DRAM reliability and security, while rigorous evidence on its scaling across modern technologies has been limited. The paper experimentally characterizes 1580 chips and uses cycle-accurate simulation to evaluate five mitigations against measured and projected vulnerability. Newer, smaller-node chips require fewer activations to flip bits, and existing mitigations do not scale well to future devices.
Problem
Rigorous experimental evidence was lacking on how RowHammer’s minimum activation count and other characteristics scale across modern DRAM technology generations.
Method
The paper characterizes 1580 DDR3, DDR4, and LPDDR4 chips across manufacturers and technology nodes, then simulates five mitigations using experimental vulnerability data.
Results
HCfirst decreases from 69.2k to 22.4k in DDR3, 17.5k to 10k in DDR4, and 16.8k to 4.8k in LPDDR4 from older to newer chips.
Takeaways & Limitations
Existing RowHammer mitigations have prohibitively large overheads at projected future vulnerability levels, motivating scalable, low-overhead approaches.
Takeaways & Limitations
The study cannot disable on-die ECC in LPDDR4 and does not definitively know the exact technology nodes of its DDR3 and DDR4 chips.
Abstract
from arXiv · showhide
In order to shed more light on how RowHammer affects modern and future devices at the circuit-level, we first present an experimental characterization of RowHammer on 1580 DRAM chips (408x DDR3, 652x DDR4, and 520x LPDDR4) from 300 DRAM modules (60x DDR3, 110x DDR4, and 130x LPDDR4) with RowHammer protection mechanisms disabled, spanning multiple different technology nodes from across each of the three major DRAM manufacturers. Our studies definitively show that newer DRAM chips are more vulnerable to RowHammer: as device feature size reduces, the number of activations needed to induce a RowHammer bit flip also reduces, to as few as 9.6k (4.8k to two rows each) in the most vulnerable chip we tested. We evaluate five state-of-the-art RowHammer mitigation mechanisms using cycle-accurate simulation in the context of real data taken from our chips to study how the mitigation mechanisms scale with chip vulnerability. We find that existing mechanisms either are not scalable or suffer from prohibitively large performance overheads in projected future devices given our observed trends of RowHammer vulnerability. Thus, it is critical to research more effective solutions to RowHammer.
1. Introduction
RowHammer is a scaling-related DRAM vulnerability that can flip bits in physically nearby rows, yet rigorous evidence across modern technologies has been lacking. This work characterizes 1580 chips and evaluates whether existing mitigations scale with worsening vulnerability.
- Problem: RowHammer repeatedly activates one row to disturb values in adjacent rows, enabling an attacker to modify physically nearby data at a different location.The affected addresses must reside in different, physically proximate DRAM rows.
- Motivation: Rigorous experimental evidence was missing on how minimum activations for the first bit flip scale across modern DRAM technology generations.Prior work speculated that newer chips are more vulnerable but had not demonstrated the trend comprehensively.
- Approach: 1580 DRAM chips from 300 modules across DDR3, DDR4, and LPDDR4, manufacturers, and technology generations were experimentally characterized with accessible protections disabled.The study varies hammer count and stored data pattern while examining aggregate and individual-cell failures.
- Findings: HCfirst falls from 69.2k to 22.4k in DDR3, 17.5k to 10k in DDR4, and 16.8k to 4.8k in LPDDR4 from older to newer chips.The results identify substantially greater vulnerability in newer chips with smaller technology nodes.
- Mitigation Evaluation: Five state-of-the-art mitigations were evaluated with cycle-accurate simulation using experimental vulnerability data.An ideal selective-refresh mechanism was also used as a comparison point.
- Implications: Existing mitigations have reasonably small overheads today but prohibitively large overheads at projected future vulnerability levels.Even ideal selective refresh significantly affects performance at very low HCfirst values, motivating better approaches.
2. DRAM Background
DRAM stores bits in capacitor-based cells organized into rows, banks, chips, ranks, and channels, with activation, access, and periodic refresh operations. RowHammer arises when rapid accesses disturb nearby rows, especially as cells become smaller and closer.
- DRAM Organization: A DRAM-based system contains channels, ranks, chips, and banks connected through shared buses and organized for parallel operation.A rank comprises chips operating in lockstep, while chips contain multiple banks sharing internal buses.
- DRAM Organization: A DRAM chip contains billions of single-bit cells organized hierarchically into banks, subarrays, rows, and columns.Cells connected to the same wordline form a DRAM row.
- DRAM Cell: Each DRAM cell uses an access transistor and capacitor, with stored data represented by the capacitor’s charge level.Charge leakage over time necessitates refresh operations.
- DRAM Operation: An ACT command opens a row by copying its data into a row buffer, after which READ or WRITE accesses the buffered data.These commands form the basic memory-controller access sequence.
- DRAM Refresh: Refresh commands periodically restore capacitor charge because cells have varying retention times and can otherwise experience bit flips.Refresh intervals are typically 32 or 64 ms according to DRAM specifications.
- RowHammer: RowHammer is a disturbance error in which high-rate accesses to one row unintentionally flip cells in nearby rows.The phenomenon is exacerbated when process scaling makes adjacent cells smaller and closer.
- Security Implications: RowHammer can enable privilege escalation, confidential-data leakage, and denial-of-service attacks, requiring system protection.Prior defenses operate at both hardware and software levels, including in-DRAM Target Row Refresh.
3. Motivation and Goal
The paper addresses missing rigorous evidence on how RowHammer vulnerability changes with DRAM scaling. It characterizes multiple DRAM types and technology nodes, projects future vulnerability, and evaluates mitigation effectiveness.
- Motivation: Existing literature lacked rigorous experimental data showing how RowHammer vulnerability changes with advancing DRAM designs and process technologies.This gap limits practical understanding of how vulnerability may scale as density increases and technology nodes shrink.
- Goal and Approach: The study characterizes DDR3, DDR4, and LPDDR4 chips from three manufacturers and at least two process technology nodes per DRAM type.It compares type-node configurations and projects vulnerability under further technology-node reduction.
- Goal and Approach: The paper uses observed and projected vulnerability data to assess the effectiveness of existing RowHammer mitigation mechanisms.This connects device-level characterization with future system-level mitigation analysis.
4. Experimental Methodology
The study experimentally characterizes RowHammer across diverse DRAM chips and testing infrastructures under controlled, worst-case circuit-level conditions. It accounts for technology generations, temperature, address remapping, and interference sources when measuring vulnerability.
- Tested Devices and Infrastructure: 1580 DRAM chips across DDR3, DDR4, and LPDDR4 are characterized using SoftMC and an in-house LPDDR4 testing infrastructure.The chips span three major manufacturers and multiple technology-node generations.
- Controlled Testing Conditions: The experiments disable DRAM refresh and accessible RowHammer mitigations to expose circuit-level effects directly.The testing routines are designed to minimize external interference during characterization.
- Worst-Case Access Pattern: Double-sided RowHammer repeatedly activates both physically adjacent aggressor rows to create worst-case conditions for a victim row.The methodology relies on identifying physical neighbors despite undocumented logical-to-physical row remapping.
- Address Remapping: LPDDR4-1x testing from Manufacturer B compensates for paired-row remapping by accessing physical rows N – 2 and N + 2.Accessing consecutive logical rows produced no flips within those rows and similar flips in four surrounding rows.
- Testing Scope and Conditions: LPDDR4 experiments use a stable ambient temperature of 50◦C, while device generations are compared using relative node sizes within manufacturers.External LPDDR4 node labels are not standardized across manufacturers, and some manufacturer-node combinations are unavailable.
1. Hammer count (HC).
The methodology varies hammer count and data pattern to measure how activation intensity and initialized DRAM contents affect RowHammer characterization.
- Hammer count (HC): Hammer count sweeps from 2k to 150k, corresponding to 4k to 300k activations, while keeping each test under 32ms.Each hammer consists of one activation to each of the two neighboring aggressor rows.
- Hammer count (HC): Hammer Count counts each paired activation to the two neighboring rows as one hammer.For victim row N, one hammer activates rows N – 1 and N + 1 once each.
- Data pattern (DP).: The study tests Solid0, Solid1, Colstripe0, Colstripe1, Checkered0, Checkered1, Rowstripe0, and Rowstripe1 data patterns.These patterns vary uniform, alternating-byte, and alternating-row initialization values.
2. Data pattern (DP).
The characterization algorithm writes each data pattern, sweeps hammer counts across every row, records induced bit flips, and restores the original contents.
- 2. Data pattern (DP).: The algorithm writes each data pattern into all DRAM cells before testing every row as a victim.For each victim, the adjacent rows are selected as aggressors.
- 1. Hammer count (HC).: For every hammer-count setting, the test disables refresh, refreshes the victim row, and repeatedly activates both aggressor rows.The core loop performs one activation to each aggressor per iteration.
- 2. Data pattern (DP).: After hammering, the procedure enables refresh, records RowHammer bit flips, and restores flipped values.This closes each characterization trial before the next parameter combination.
5. RowHammer Characterization
Characterization across 1580 DRAM chips shows that RowHammer vulnerability generally increases with newer technology nodes, while data patterns, spatial distance, ECC, and hammer count shape observed failures.
- 5.1. RowHammer Vulnerability: All tested chips except many DDR3 chips exhibited RowHammer bit flips when hammer count ranged from 2K to 150K.The double-sided test corresponded to 4k–300k activations.
- 5.1. RowHammer Vulnerability: Newer DRAM chips generally appear more vulnerable, with increasing RowHammerable fractions from DDR3-old to DDR3-new chips of manufacturers B and C.Manufacturer A is an exception, with very low observed bit-flip counts in its RowHammerable chips.
- 5.2. Data Pattern Dependence: No individual data pattern achieves full RowHammer bit-flip coverage, so testing multiple patterns is essential for comprehensive identification.The worst-case pattern is consistent across chips sharing a manufacturer and DRAM type-node configuration.
- 5.3. Hammer Count (HC) Effects: The log of RowHammer bit flips varies linearly with the log of hammer count, while newer DDR4 nodes show higher bit-flip rates at the same hammer count and at lower counts.The bit-flip-rate curve shifts upward and leftward from DDR4-old to DDR4-new chips.
- 5.4. RowHammer Spatial Effects: Newer technology nodes can produce bit flips in more rows and farther from the victim row, while bit-flip counts decrease with distance.LPDDR4-1y chips showed flips as far as six rows away, whereas DDR3 and DDR4 chips reached two rows.
- 5.4. RowHammer Spatial Effects: At a RowHammer bit-flip rate of 10^-6, one 64-bit value can contain up to four bit flips, motivating stronger ECC than single-error correction.The cited discussion identifies 4-bit error-correcting codes as an example, with high hardware overhead.
- 5.4. RowHammer Spatial Effects: LPDDR4 has substantially more words with two or three bit flips than DDR3 and DDR4, which the authors attribute to on-die ECC masking many single-bit failures.DDR3 and DDR4 show exponential decay in bit-flip density, with most words containing one bit flip.
- 5.5. First RowHammer Bit Flips: HCfirst decreases across newer generations in several configurations, with some LPDDR4-1y manufacturer-A chips failing after only 4800 hammers.The authors relate the broader trend to reduced cell capacitance and increased cell density from process scaling, while noting exceptions.
6. Implications for Future Systems
The evaluation examines whether RowHammer mitigations remain scalable and performant as DRAM vulnerability increases. Existing mechanisms generally fail to scale or impose substantial overheads, motivating cross-layer and profile-guided alternatives.
- Evaluation Scope: The study evaluates mitigation mechanisms against design scalability and system performance overhead for increasingly vulnerable DRAM chips.The evaluation uses cycle-accurate simulation and considers a strong attacker capable of precise row activations.
- Evaluation Scope: Six mechanisms are evaluated, including five hardware proposals and one ideal refresh-based mechanism, under a strong RowHammer threat model.Software mechanisms are excluded because many cannot track all DRAM activations and are vulnerable to carefully crafted attacks.
- Evaluation Methodology: Normalized system performance is measured alongside DRAM bandwidth overhead, using weighted speedup normalized to a 100% baseline.Bandwidth overhead captures mitigation-generated DRAM traffic, while normalized weighted speedup represents multicore job throughput.
- Evaluation Results: Only 6% performance loss occurs for the ideal refresh-based mechanism at HCfirst = 128, whereas existing mechanisms either cannot scale or cause severe penalties when scaled.The ideal mechanism inserts the minimum possible additional refreshes needed to prevent RowHammer bit flips.
- Future Directions: Future mitigation research should combine DRAM-system cooperation with profile-guided mechanisms to seek scalable, low-overhead protection.The paper argues that addressing DRAM-rooted failures and system-level effects together may provide protection at lower cost than either domain alone.
- Future Directions: Production or online RowHammer profiling remains infeasible with the naïve approach: testing an 8GB module can require over 17 hours for one refresh window.The paper identifies fast and effective profiling as a key research challenge.
7. Related Work
Prior RowHammer research includes experimental failure studies, device-level simulations, and numerous mitigation proposals. This work addresses gaps in modern-device characterization and in understanding mitigation scalability across future DRAM generations.
- Real Chip Studies: Only three prior works provide detailed experimental RowHammer failure characterization, and they examine older DDR3 devices.These studies do not show how activation counts change across modern DRAM types and generations.
- Real Chip Studies: This work provides the first rigorous experimental study of how RowHammer characteristics scale across different DRAM generations.Its characterization spans multiple modern DRAM types rather than only DDR3 devices.
- Simulation Studies: Device-level simulations identify a likely RowHammer failure mechanism but lack experimental data from real devices to support their conclusions.The related simulation work therefore differs from this paper’s real-chip characterization approach.
- RowHammer Mitigation Mechanisms: Prior mitigation proposals do not analyze how their solutions scale to future DRAM generations or provide detailed modern-device failure characterization.This paper evaluates mitigation scaling using failure data from modern DRAM devices.
8. Conclusion
The study characterizes RowHammer vulnerability across modern DRAM generations and technology nodes, then evaluates existing mitigation mechanisms against projected future vulnerability. It finds that current mechanisms face scalability or performance limits, motivating low-overhead solutions.
- 1580 real DDR3, DDR4, and LPDDR4 chips establish how RowHammer vulnerability scales across generations and technology nodes.The chips came from 300 modules and the three major DRAM manufacturers.
- Smaller process technology nodes make modern DRAM chips significantly more vulnerable to RowHammer than older chips.
- Existing RowHammer mitigations suffer prohibitively large performance overheads at projected future hammer counts.
- Existing mechanisms remain far from an ideal selective-refresh-based RowHammer mitigation mechanism.
- The findings motivate scalable, low-overhead RowHammer solutions and identify two promising research directions.
A. Appendix Tables
The appendix tables describe sample populations of DDR3 and DDR4 DRAM modules, categorized by manufacturer and sorted by manufacturing date.
- 60 DDR3 DRAM modules are categorized by manufacturer and sorted by manufacturing date.
- 110 DDR4 DRAM modules are categorized by manufacturer and sorted by manufacturing date.