SALT: Track-and-Mitigate Subarrays, Not Rows, for Blast-Radius-Free Rowhammer Defense

Typical in-DRAM Rowhammer mitigation operates by identifying aggressor rows and refreshing a limited number of victim rows on either side of the aggressor row. The number of victim rows is specified by the Blast Radius. JEDEC recently introduced state-of-the-art Rowhammer defense, which includes Per-Row-Activation-Counting (PRAC) to identify aggressor rows and Alert-Back-Off (ABO) to allow the DRAM chip to obtain time to refresh two victim rows on either side of the aggressor row. The implicit assumption in PRAC is that charge loss beyond the two victim rows is negligibly small and does not represent a threat to the security of PRAC. In this paper, we develop Ripple Attack that can amplify even a small amount of leakage in distant rows to cause charge loss equivalent to$\mathbf{3 x} \boldsymbol{-} \mathbf{7 8 x}$the activations tolerated by PRAC for the given threshold. The goal of our paper is to develop an in-DRAM mitigation that tolerates Rowhammer without relying on a pre-defined Blast Radius. We observe that as subarrays are spatially isolated from each other, activity in one subarray does not cause charge leakage in rows of another subarray. To develop Blast-RadiusFree Rowhammer mitigation, we propose SALT (Subarray-Level Tracking and Mitigation). SALT tracks activation counts per subarray, and when the count exceeds a specified value, it triggers ABO to obtain time for refreshing a portion of the subarray. SALT bounds the maximum number of activations to the subarray before all rows are guaranteed to be refreshed, thus providing Blast-Radius-Free Rowhammer mitigation. To reduce the slowdown from ABO, SALT-C coordinates the demand refresh operations such that ABO is not required if the activations to the subarray are below what can be handled by the demand refresh, thus reducing ABO by 48x. SALT-C not only provides stronger security guarantees than PRAC due to Blast-RadiusFreedom, but also has 38x lower storage overhead than PRAC, and incurs lower slowdown (0.3 % vs 1.7 %) than PRAC.