[Paper Review] Understanding the Security Benefits and Overheads of Emerging Industry Solutions to DRAM Read Disturbance

Oğuzhan Canpolat, A. Giray Yağlıkçı+4 more|arXiv (Cornell University)|Jun 27, 2024

Advanced Data Storage Technologies4 citations

TL;DR

This paper presents the first rigorous analysis of Per Row Activation Counting (PRAC), a DRAM row-level mitigation for read disturbance in DDR5. PRAC reduces performance overhead by using a back-off signal to trigger refreshes only when needed, but incurs up to 63.2% performance overhead on future DRAM chips and can be exploited for memory performance attacks, while remaining secure for $N_{RH} \geq 10$.

ABSTRACT

We present the first rigorous security, performance, energy, and cost analyses of the state-of-the-art on-DRAM-die read disturbance mitigation method, Per Row Activation Counting (PRAC), described in JEDEC DDR5 specification's April 2024 update. Unlike prior state-of-the-art that advises the memory controller to periodically issue refresh management (RFM) commands, which provides the DRAM chip with time to perform refreshes, PRAC introduces a new back-off signal. PRAC's back-off signal propagates from the DRAM chip to the memory controller and forces the memory controller to 1) stop serving requests and 2) issue RFM commands. As a result, RFM commands are issued when needed as opposed to periodically, reducing RFM's overheads. We analyze PRAC in four steps. First, we define an adversarial access pattern that represents the worst-case for PRAC's security. Second, we investigate PRAC's configurations and security implications. Our analyses show that PRAC can be configured for secure operation as long as no bitflip occurs before accessing a memory location 10 times. Third, we evaluate the performance impact of PRAC and compare it against prior works using Ramulator 2.0. Our analysis shows that while PRAC incurs less than 13% performance overhead for today's DRAM chips, its performance overheads can reach up to 94% for future DRAM chips that are more vulnerable to read disturbance bitflips. Fourth, we define an availability adversarial access pattern that exacerbates PRAC's performance overhead to perform a memory performance attack, demonstrating that such an adversarial pattern can hog up to 94% of DRAM throughput and degrade system throughput by up to 95%. We discuss PRAC's implications on future systems and foreshadow future research directions. To aid future research, we open-source our implementations and scripts at https://github.com/CMU-SAFARI/ramulator2.

Motivation & Objective

• To analyze the security, performance, energy, and cost implications of PRAC, the state-of-the-art DRAM read disturbance mitigation in DDR5.
• To evaluate PRAC's effectiveness in preventing bitflips under adversarial access patterns that maximize row activation counts.
• To quantify the performance and energy overheads of PRAC across modern and future DRAM technologies.
• To investigate whether PRAC can be exploited as a vector for memory performance attacks.
• To identify research directions for improving PRAC’s efficiency and resilience against adversarial use.

Proposed method

• Proposes a security-oriented adversarial access pattern to maximize row activation counts under PRAC, simulating worst-case threat scenarios.
• Employs cycle-accurate simulation using Ramulator 2.0 extended with DRAMPower to evaluate performance and energy overheads across 60 multi-workload mixes.
• Introduces an availability-oriented adversarial pattern to stress-test PRAC’s performance under high activation rates.
• Analyzes PRAC’s back-off signal mechanism, which triggers memory controller intervention only when activation counts reach a critical threshold.
• Evaluates PRAC’s security by determining the minimum $N_{RH}$ (minimum hammer count) for which bitflips are prevented.
• Uses open-source simulation infrastructure (available at https://github.com/CMU-SAFARI/ramulator2) to ensure reproducibility and enable future research.

Figure 1 : Maximum activations to a row allowed by (a) PRFM and (b) PRAC -N

Experimental results

Research questions

• RQ1 What is the maximum activation count a DRAM row can reach under PRAC’s protection, and how does it vary with different PRAC configurations?
• RQ2 What is the performance and energy overhead of PRAC on modern and future DRAM chips, especially under benign and adversarial workloads?
• RQ3 Can PRAC be exploited to launch memory performance attacks by exhausting DRAM throughput?
• RQ4 For what minimum $N_{RH}$ value is PRAC secure against bitflips under adversarial row hammering?
• RQ5 What system-level optimizations can mitigate PRAC’s performance and energy overheads, and how can it be hardened against abuse?

Key findings

• PRAC can be securely configured to prevent bitflips as long as no bitflip occurs before a memory row is accessed 10 times, ensuring security for $N_{RH} \geq 10$.
• On modern DRAM chips, PRAC incurs a maximum of 13.4% system performance overhead and 23.0% DRAM energy overhead under benign workloads.
• For future DRAM chips with higher read disturbance vulnerability, PRAC’s average performance overhead rises to 48.5% (maximum 63.2%) across 60 workloads.
• An adversarial access pattern can exploit PRAC to consume up to 79% of DRAM throughput and degrade system throughput by up to 65% (53% average), demonstrating its potential as a performance attack vector.
• The increased $t_{RP}$ and $t_{RC}$ timing parameters due to PRAC introduce non-negligible performance overheads even at high $N_{RH}$ values, indicating a need for circuit-level optimization.
• PRAC’s back-off mechanism reduces unnecessary refreshes compared to periodic RFM, but its reliance on controller intervention creates new attack surfaces and performance bottlenecks.

Figure 2 : Performance impact of evaluated read disturbance mitigation mechanisms on 60 benign four-core workloads