DRAMScope：通过发送内存命令揭示DRAM微架构与特性
DRAMScope: Uncovering DRAM Microarchitecture and Characteristics by Issuing Memory Commands
AI总结：
本文提出DRAMScope，利用AIBs、保留时间测试和RowCopy三种交叉验证工具，从宏观和微观层面逆向工程商用DRAM芯片微架构，纠正AIBs误解、发现新数据模式及未知漏洞，并提出有效防护方案。
摘要：
由于探索内存内处理、增强可靠性以及缓解安全漏洞的需求，对DRAM微架构和错误特性的精确信息需求急剧增长。然而，DRAM制造商仅披露了有限的信息，这使得查找其DRAM微架构的具体信息变得困难。本文通过提出关于商用DRAM芯片微架构及其对激活诱导位翻转（AIBs，如RowHammer和RowPress）特性影响的更严谨发现，来填补这一空白。此前的研究也尝试理解DRAM微架构及相关行为，但我们发现其中一些结果因不准确的地址映射和内部数据交换而受到误导，或缺乏对现代DRAM单元结构的深入理解。为了实现准确且高效的反向工程，我们使用了三种工具：AIBs、保留时间测试和RowCopy，它们可以相互交叉验证。借助这三种工具，我们首先从宏观视角观察现代DRAM芯片，以揭示其子阵列、内存阵列块（MATs）和行的大小、结构及操作。然后，我们基于DRAM微架构的微观视角（如6F^2单元布局）分析AIB特性，借此纠正关于AIBs的误解，并发现一种加速AIBs的新数据模式。最后，基于我们在宏观和微观层面的发现，我们识别出此前未知的AIB漏洞，并提出一种简单而有效的防护方案。
英文摘要：
The demand for precise information on DRAM microarchitectures and error characteristics has surged, driven by the need to explore processing in memory, enhance reliability, and mitigate security vulnerability. Nonetheless, DRAM manufacturers have disclosed only a limited amount of information, making it difficult to find specific information on their DRAM microarchitectures. This paper addresses this gap by presenting more rigorous findings on the microarchitectures of commodity DRAM chips and their impacts on the characteristics of activate-induced bitflips (AIBs), such as RowHammer and RowPress. The previous studies have also attempted to understand the DRAM microarchitectures and associated behaviors, but we have found some of their results to be misled by inaccurate address mapping and internal data swizzling, or lack of a deeper understanding of the modern DRAM cell structure. For accurate and efficient reverse-engineering, we use three tools: AIBs, retention time test, and RowCopy, which can be cross-validated. With these three tools, we first take a macroscopic view of modern DRAM chips to uncover the size, structure, and operation of their subarrays, memory array tiles (MATs), and rows. Then, we analyze AIB characteristics based on the microscopic view of the DRAM microarchitecture, such as 6F^2 cell layout, through which we rectify misunderstandings regarding AIBs and discover a new data pattern that accelerates AIBs. Lastly, based on our findings at both macroscopic and microscopic levels, we identify previously unknown AIB vulnerabilities and propose a simple yet effective protection solution.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
