Abstract
Modern computer memories have shown reliability issues.The main memory is the target of a security threat called Rowhammer, which takes advantage of cell-to-cell disturbance between DRAM rows to cause bit-flips in adjacent victim cells of repeatedly activated aggressor rows.Moreover, as DRAM manufacturers keep increasing the memory density to improve efficiency and reduce cost, the disturbance between cells gets more important over the years, worsening the threat.The abundant research on this subject led to the development of numerous countermeasures.Each proposal comes with pros and cons in terms of modularity, performance cost, silicon area, and energy overheads, with implementation in software, hardware or both.The development of hardware-based mitigation techniques can be made easier with a computer architecture simulator such as gem5, which facilitates the development of computer architectures that integrate new hardware components with existing and future memories or other elements.However, existing architecture simulators are not suitable for Rowhammer mitigation development, as they cannot simulate the memory corruption from Rowhammer attacks, which makes verifying mitigation techniques more difficult.In this work, we first improve the open-source simulator gem5 to make it a complete tool for Rowhammer mitigation development.We add a memory corruption module that is able to simulate the bit-flips caused by Rowhammer attacks, with various parameters to adapt it to mature and future memories, and utility functions to facilitate the integration and evaluation of mitigation techniques into the architecture.Then, we study how changing the counting granularity of counter-based Rowhammer mitigation proposals could reduce their storage requirements.Some of the most efficient proposals rely on row activation counters, using for example Counting Bloom Filters or the Misra-Gries algorithm.We demonstrate that those proposals can have their storage requirements reduced by 40% to 50% without impacting the protection level, by changing their counting granularity from bank-level to rank-level.Additionally, we propose two new Rowhammer detection mechanisms.We show that by including hardware event traces inside the architecture, a machine-learning algorithm implemented in the hardware can classify traces from these counters to detect Rowhammer attacks.We also propose a new detection mechanism that evaluates the activation frequency of every DRAM row to accurately detect aggressor rows and prevent the corruption, with an adaptive energy consumption.As a line of research, we explore the vulnerabilities of emerging non-volatile memories to variations of the Rowhammer attack.Through power consumption analysis, we retro-engineer the internal architecture of commercial Toggle-MRAM and STT-MRAM to design attacks that are susceptible to produce bit-flips in the memory, and execute these attacks to check if they can corrupt the memory.