SALT: Track-and-Mitigate Subarrays, Not Rows, for Blast-Radius-Free Rowhammer Defense

Typical in-DRAM Rowhammer mitigation operates
by identifying aggressor rows and refreshing a limited number
of victim rows on either side of the aggressor row. The number
of victim rows is specified by the Blast Radius. JEDEC recently
introduced state-of-the-art Rowhammer defense, which includes
Per-Row-Activation-Counting (PRAC) to identify aggressor rows
and Alert-Back-Off (ABO) to allow the DRAM chip to obtain
time to refresh two victim rows on either side of the aggressor
row. The implicit assumption in PRAC is that charge loss beyond
the two victim rows is negligibly small and does not represent a
threat to the security of PRAC. In this paper, we develop Blast-
Radius Attack (BR-Attacks) that can amplify even a small amount
of leakage in distant rows to cause charge loss equivalent to 3x-
78x the activations tolerated by PRAC for the given threshold.
The goal of our paper is to develop an in-DRAM mitigation that
tolerates Rowhammer without relying on the Blast Radius.
We observe that as subarrays are spatially isolated from
each other, activity in one subarray does not cause charge
leakage in rows of another subarray. To develop Blast-Radius-
Free Rowhammer mitigation, we propose SALT (Subarray-Level
Tracking and Mitigation). SALT tracks activation counts per
subarray and when the count exceeds a specified value, it
triggers ABO to obtain time for refreshing a portion of the
subarray. SALT bounds the maximum number of activations to
the subarray before all rows are guaranteed to be refreshed,
thus providing Blast-Radius-Free Rowhammer mitigation. To
reduce the slowdown from ABO, SALT-C coordinates the demand
refresh operations such that ABO is not required if the activations
to the subarray are below what can be handled by the demand
refresh, thus reducing ABO by 48x. SALT-C not only provides
stronger security guarantees than PRAC due to Blast-Radius-
Freedom, but also has 38x lower storage overheads than PRAC,
and incurs lower slowdown (0.3% vs 1.7%) than PRAC.