DRAMScope: Uncovering DRAM Microarchitecture and Characteristics by Issuing Memory Commands

TL;DR

This work tackles the opacity of modern DRAM microarchitecture by introducing DRAMScope, a cross-validated reverse-engineering framework using AIBs, RowCopy, and retention tests to reveal macro- and micro-level DRAM structures. It uncovers hidden internal features such as data swizzling, MAT and subarray configurations, edge subarrays, and coupled-row activation, along with $6F^2$-based AIB patterns and adversarial data patterns that affect $H_{ ext{cnt}}$ and BER. The findings motivate simple yet effective protections, including data masking/scrambling and in-DRAM mitigations like DRFM, and have significant implications for AIB defenses, TRR design, and processing-in-memory reliability. Overall, the work provides a rigorous, reproducible methodology and concrete DRAM microarchitectural insights that can drive secure, reliable memory system design in the presence of complex AIB dynamics.

Abstract

The demand for precise information on DRAM microarchitectures and error characteristics has surged, driven by the need to explore processing in memory, enhance reliability, and mitigate security vulnerability. Nonetheless, DRAM manufacturers have disclosed only a limited amount of information, making it difficult to find specific information on their DRAM microarchitectures. This paper addresses this gap by presenting more rigorous findings on the microarchitectures of commodity DRAM chips and their impacts on the characteristics of activate-induced bitflips (AIBs), such as RowHammer and RowPress. The previous studies have also attempted to understand the DRAM microarchitectures and associated behaviors, but we have found some of their results to be misled by inaccurate address mapping and internal data swizzling, or lack of a deeper understanding of the modern DRAM cell structure. For accurate and efficient reverse-engineering, we use three tools: AIBs, retention time test, and RowCopy, which can be cross-validated. With these three tools, we first take a macroscopic view of modern DRAM chips to uncover the size, structure, and operation of their subarrays, memory array tiles (MATs), and rows. Then, we analyze AIB characteristics based on the microscopic view of the DRAM microarchitecture, such as 6F^2 cell layout, through which we rectify misunderstandings regarding AIBs and discover a new data pattern that accelerates AIBs. Lastly, based on our findings at both macroscopic and microscopic levels, we identify previously unknown AIB vulnerabilities and propose a simple yet effective protection solution.

Figures (17)

• Figure 1: Conventional DRAM organization.
• Figure 2: (a) DRAM $\text{6F}^\text{2}$ cell structure and (b) the cross-section schematic of a saddle-fin transistor.
• Figure 3: Mechanisms of activate-induced bitflips. PG and NG denote the passing gate and the neighboring gate, respectively.
• Figure 4: Test infrastructure for DDR4 DIMM and HBM2.
• Figure 5: Identified DRAM mapping for reverse-engineering.