Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Revisiting DRAM Read Disturbance: Identifying Inconsistencies Between Experimental Characterization and Device-Level Studies

Haocong Luo, İsmail Emir Yüksel, Ataberk Olgun, A. Giray Yağlıkçı, Onur Mutlu

TL;DR

This paper cross-validates real-chip DRAM read-disturbance characterization with state-of-the-art device-level mechanisms for RowHammer and RowPress, revealing fundamental inconsistencies in bitflip directions and data/access-pattern dependence. By testing 96 COTS DDR4 DRAM chips under patterns aligned with device-level studies, it demonstrates that double-sided RowHammer can produce both flip directions and that 0→1 flips can occur at lower hammer counts than predicted, while single-sided RowPress overwhelmingly yields 1→0 flips. The authors hypothesize that existing device-level models may omit important leakage mechanisms or fail to capture modern DDR4 architectures, and they offer potential explanations rooted in trap dynamics, layout interactions, and sensing circuitry. These results motivate a more comprehensive, hardware-aware understanding of DRAM read disturbance and are complemented by open-source tooling to enable future research and reproducibility.

Abstract

Modern DRAM is vulnerable to read disturbance (e.g., RowHammer and RowPress) that significantly undermines the robust operation of the system. Repeatedly opening and closing a DRAM row (RowHammer) or keeping a DRAM row open for a long period of time (RowPress) induces bitflips in nearby unaccessed DRAM rows. Prior works on DRAM read disturbance either 1) perform experimental characterization using commercial-off-the-shelf (COTS) DRAM chips to demonstrate the high-level characteristics of the read disturbance bitflips, or 2) perform device-level simulations to understand the low-level error mechanisms of the read disturbance bitflips. In this paper, we attempt to align and cross-validate the real-chip experimental characterization results and state-of-the-art device-level studies of DRAM read disturbance. To do so, we first identify and extract the key bitflip characteristics of RowHammer and RowPress from the device-level error mechanisms studied in prior works. Then, we perform experimental characterization on 96 COTS DDR4 DRAM chips that directly match the data and access patterns studied in the device-level works. Through our experiments, we identify fundamental inconsistencies in the RowHammer and RowPress bitflip directions and access pattern dependence between experimental characterization results and the device-level error mechanisms. Based on our results, we hypothesize that either 1) the retention failure based DRAM architecture reverse-engineering methodologies do not fully work on modern DDR4 DRAM chips, or 2) existing device-level works do not fully uncover all the major read disturbance error mechanisms. We hope our findings inspire and enable future works to build a more fundamental and comprehensive understanding of DRAM read disturbance.

Revisiting DRAM Read Disturbance: Identifying Inconsistencies Between Experimental Characterization and Device-Level Studies

TL;DR

This paper cross-validates real-chip DRAM read-disturbance characterization with state-of-the-art device-level mechanisms for RowHammer and RowPress, revealing fundamental inconsistencies in bitflip directions and data/access-pattern dependence. By testing 96 COTS DDR4 DRAM chips under patterns aligned with device-level studies, it demonstrates that double-sided RowHammer can produce both flip directions and that 0→1 flips can occur at lower hammer counts than predicted, while single-sided RowPress overwhelmingly yields 1→0 flips. The authors hypothesize that existing device-level models may omit important leakage mechanisms or fail to capture modern DDR4 architectures, and they offer potential explanations rooted in trap dynamics, layout interactions, and sensing circuitry. These results motivate a more comprehensive, hardware-aware understanding of DRAM read disturbance and are complemented by open-source tooling to enable future research and reproducibility.

Abstract

Modern DRAM is vulnerable to read disturbance (e.g., RowHammer and RowPress) that significantly undermines the robust operation of the system. Repeatedly opening and closing a DRAM row (RowHammer) or keeping a DRAM row open for a long period of time (RowPress) induces bitflips in nearby unaccessed DRAM rows. Prior works on DRAM read disturbance either 1) perform experimental characterization using commercial-off-the-shelf (COTS) DRAM chips to demonstrate the high-level characteristics of the read disturbance bitflips, or 2) perform device-level simulations to understand the low-level error mechanisms of the read disturbance bitflips. In this paper, we attempt to align and cross-validate the real-chip experimental characterization results and state-of-the-art device-level studies of DRAM read disturbance. To do so, we first identify and extract the key bitflip characteristics of RowHammer and RowPress from the device-level error mechanisms studied in prior works. Then, we perform experimental characterization on 96 COTS DDR4 DRAM chips that directly match the data and access patterns studied in the device-level works. Through our experiments, we identify fundamental inconsistencies in the RowHammer and RowPress bitflip directions and access pattern dependence between experimental characterization results and the device-level error mechanisms. Based on our results, we hypothesize that either 1) the retention failure based DRAM architecture reverse-engineering methodologies do not fully work on modern DDR4 DRAM chips, or 2) existing device-level works do not fully uncover all the major read disturbance error mechanisms. We hope our findings inspire and enable future works to build a more fundamental and comprehensive understanding of DRAM read disturbance.

Paper Structure

This paper contains 21 sections, 5 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Background
  3. DRAM-Based Main Memory
  4. Physical DRAM Cell Structure
  5. DRAM Read Disturbance
  6. Device-Level Mechanisms from Prior Works
  7. Key Error Mechanisms of RowHammer
  8. Key Error Mechanisms of RowPress
  9. Experimental Testing Methodology
  10. COTS DDR4 DRAM Testing Infrastructure
  11. Reverse Engineering DRAM Array Architecture and Layout
  12. COTS DDR4 DRAM Chips Tested
  13. Experimental Characterization Results
  14. HCFirst with Double-Sided RowHammer
  15. Bitflip Count with Double-Sided RowHammer
  16. ...and 6 more sections

Figures (5)

  • Figure 1: Logical organization of modern DRAM-based main memory. Reproduced from Luo2023RowPress.
  • Figure 2: Physical layout and structure of DRAM cell.
  • Figure 3: HCFirst distribution of "0" to "1" and "1" to "0" bitflips (Double-Sided RowHammer).
  • Figure 4: The distribution of the number of "0" to "1" and "1" to "0" bitflips per victim row (Double-Sided RowHammer).
  • Figure 5: The distribution of the number of "0" to "1" and "1" to "0" bitflips per victim row (Single-Sided RowPress).