Patent Description:
Dynamic random access memory (DRAM) is a type of random-access semiconductor memory that stores each bit of data in a memory cell. Systems using semiconductor chips use DRAM as main memory or working memory of the system to store data or instructions used by a host and/or to perform computational operations. In general, DRAM writes data or reads data under the control of a host. When a computational operation is performed, a host retrieves instructions and/or data from DRAM, executes the instructions, and/or uses the data to perform the computational operation. When there is a result of the computational operation, the host writes the result to the DRAM.

In order to boost the capacity and the integration of DRAM, a cell size of the DRAM has decreased. Some DRAM-based systems experience intermittent failures occasionally due to a heavy workload. The failures may happen due to repeated accesses to a single memory row, for example, a row hammer event. Data corruption may occur because memory cells adjacent to the repeatedly accessed memory cell rows are disturbed due to the row hammer condition. Memory cells affected by the row hammer condition may be refreshed by a target refresh operation.

In order to manage the row hammer condition, DRAM may monitor hammer addresses intensively accessed among access addresses during a preset time. The DRAM may store hammer addresses in a limited number of registers of an address storage, generate hammer refresh addresses indicating addresses of memory cell rows physically adjacent to memory cell rows corresponding to the hammer addresses, and target-refresh memory cells connected to memory cell rows corresponding to the hammer refresh addresses.

However, an aggressor may use decoy row hammer addresses for the purpose of interfering with a row hammer management operation of the DRAM. As access addresses including the decoy row hammer addresses are newly stored in an address storage, a row hammer address stored in the address storage may be evicted from the address storage and monitored row hammer information may be lost. There is a problem in that the evicted hammer address is vulnerable to a row hammer.

Accordingly, there is a need for a countermeasure against a hacker-pattern row hammer aggression that maliciously evicts a row hammer address from an address storage to cause row hammer information to be lost.

<CIT> discloses: A memory device may include a memory cell array including a plurality of memory cell rows; a row hammer handler that is configured to determine whether to perform a row hammer handling operation to refresh adjacent memory cell rows adjacent to a first row that is being intensively accessed from among the memory cell rows, resulting in a determination result; and a refresh manager configured to perform either a normal refresh operation for sequentially refreshing the memory cell rows or the row hammer handling operation, based on the determination result of the row hammer handler.

<CIT> discloses: Steering logic circuitry includes bit-flipping logic that determines a first neighboring redundant word line adjacent to a redundant word line of a memory bank, which also includes normal word lines. Redundant word lines include main word lines, each of which includes paired word lines. Each paired word line includes two redundant word lines. The steering logic circuitry also includes border determination logic that determines whether the redundant word line is on a border between the redundant word lines and an end of the memory bank or the normal word lines. The steering logic circuitry further includes main word line steering logic that determines a neighboring main word line that a second neighboring redundant word line adjacent to the redundant word line is disposed in, and paired word line steering logic that determines a neighboring paired word line that the second neighboring redundant word line is disposed in.

<CIT> discloses: Embedded refresh controllers included in memory devices and memory devices including the embedded refresh controllers. The embedded refresh controllers may include a refresh counter and an address generator. The refresh counter may generate a counter refresh address signal in response to a counter refresh signal such that the counter refresh address signal may represent a sequentially changing address. The address generator may store information with respect to a hammer address that is accessed intensively and may generates a hammer refresh address signal in response to a hammer refresh signal such that the hammer refresh address signal may represent an address of a row that is physically adjacent to a row of the hammer address. Loss of cell data may be reduced and performance of the memory device may be enhanced by detecting the intensively-accessed hammer address and performing the refresh operation based on the detected hammer address efficiently.

Specific embodiments are defined in the dependent claims.

The disclosure provides a memory device including a control logic circuit for preventing a hacker-pattern row hammer aggression that maliciously evicts an intensively accessed row hammer address from an address storage to cause row hammer information to be lost and a method of operating the memory device.

According to an embodiment, a memory device includes a memory cell array including a plurality of memory cell rows. A control logic circuit is configured to monitor a row address with respect to a memory cell row from among the plurality of memory cell rows during a row hammer monitoring time frame and store the row address as an address entry in an address table in which an access number of the address entry is stored. A refresh control circuit is configured to refresh a memory cell row physically adjacent to another memory cell row corresponding to an address entry having a greatest access number stored in the address table during the row hammer monitoring time frame. The control logic circuit performs a counter-based flattening operation and a random swap operation on the address entry stored in the address table.

According to another embodiment, a control logic circuit includes a logic circuit indicating a correlation between a row address accessed during a row hammer monitoring time frame and an access number. An address table stores a first address entry corresponding to a first row address and a first access number. A first swap circuit is configured to select a second address entry having a second access number, which is the smallest access number in the address table, from the address table and perform a first swap operation of swapping the first address entry with the second address entry. A second swap circuit is configured to select a third address entry having a third access number from the address table and perform a second swap operation related to the first address entry and the third address entry. The third access number is not the greatest value in the address table.

Embodiments of the disclosure will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings in which:.

<FIG> is a diagram illustrating a system including a memory device for controlling a row hammer, according to example embodiments of the disclosure.

Referring to <FIG>, a system <NUM> may include a host device <NUM> and a memory device <NUM>. The host device <NUM> may be communicatively connected to the memory device <NUM> through memory buses <NUM>.

The host device <NUM> may include, for example, a computing system such as a computer, a notebook computer, a server, a workstation, a portable communication terminal, a personal digital assistant (PDA), a portable multimedia player (PMP), a smartphone, or a wearable device. Alternatively, the host device <NUM> may include some components included in the computing system, such as a graphics card.

The host device <NUM> may be a functional block to perform general computational operations in the system <NUM> and may correspond to a central processing unit (CPU), a digital signal processor (DSP), a graphics processing unit (GPU), or an application processor (AP). The host device <NUM> may include a memory controller <NUM> that manages data transmission and reception to and from the memory device <NUM>.

The memory controller <NUM> may access the memory device <NUM> according to a memory request of the host device <NUM>. The memory controller <NUM> may include a memory physical layer interface (memory PHY) for performing interfacing operations with the memory device <NUM>, such as selecting rows and columns corresponding to a memory location, writing data to the memory location, or reading the written data. The memory PHY may include a physical or electrical layer and a logical layer provided for signals, frequencies, timing, driving, detailed operating parameters, and functionality required for efficient communication between the memory controller <NUM> and the memory device <NUM>. The memory PHY may support the double data rate (DDR) and/or low power double data rate (LPDDR) protocol characteristics according to the joint electron device engineering council (JEDEC) standard.

The memory controller <NUM> may be connected to the memory device <NUM> through the memory buses <NUM>. For the brevity of the drawings, a clock signal CK, a command/address signal CA, data DQ, and a chip select signal CS are illustrated to be each provided through one signal line of the memory buses <NUM> between the memory controller <NUM> and the memory device <NUM>, but may each be provided actually through a plurality of signal lines or buses. Signal lines between the memory controller <NUM> and the memory device <NUM> may be connected to connectors thereof. The connectors may include pins, balls, signal lines, or other hardware components.

The clock signal CK may be transmitted from the memory controller <NUM> to the memory device <NUM> through a clock signal line of the memory buses <NUM>. The command/address signal CA may be transmitted from the memory controller <NUM> to the memory device <NUM> through a command/address bus among the memory buses <NUM>. The chip select signal CS may be transmitted from the memory controller <NUM> to the memory device <NUM> through a chip select line among the memory buses <NUM>. For example, a signal transmitted through the command/address bus when the chip select signal CS is activated to a logic high level may indicate a command signal. The data DQ may be transmitted from the memory controller <NUM> to the memory device <NUM> or from the memory device <NUM> to the memory controller <NUM> through a data bus of the memory buses <NUM> composed of bidirectional signal lines.

The memory device <NUM> may write the data DQ thereto or read the data DQ therefrom and perform a refresh operation under the control by the memory controller <NUM>. For example, the memory device <NUM> may include a double data rate synchronous dynamic random access memory (DDR SDRAM) device. However, the scope of the disclosure is not limited thereto and the memory device <NUM> may include any one of volatile memory devices such as LPDDR SDRAM, wide input/output (I/O) dynamic random access memory (DRAM), high bandwidth memory (HBM), and hybrid memory cube (HMC). The memory device <NUM> may include a memory cell array <NUM> and a row hammer control circuit <NUM>.

The memory cell array <NUM> may include a plurality of word lines, a plurality of bit lines, and a plurality of memory cells formed at intersections of the plurality of word lines and the plurality of bit lines. Memory cells of the memory cell array <NUM> may include volatile memory cells, for example, DRAM cells.

The row hammer control circuit <NUM> may control a row hammer of a hacker pattern which disturbs row hammer information to be lost from an address table storing at least one row hammer address for the memory cell array <NUM>. The row hammer control circuit <NUM> may perform a flattening operation and a random selection operation on the row hammer addresses stored in the address table to prevent a row hammer address having a small access number from being evicted from registers. The flattening operation and the random selection operation are randomly performed on the row hammer addresses by the row hammer control circuit <NUM>, and thus, an attacker may not determine how the row hammer is controlled by the memory device <NUM>. Because of randomness of a row hammer control operation, a hacker-pattern row hammer attack may not be easily performed. Accordingly, the row hammer control circuit <NUM> may prevent row hammer information from being lost and prevent a hacker-pattern row hammer attack from being easily performed.

<FIG> is a block diagram illustrating a memory device according to embodiments of the disclosure. <FIG> illustrates the memory device <NUM> of <FIG> implemented as DRAM. It may be noted that a configuration of the DRAM illustrated in <FIG> is an example and is not a configuration of actual DRAM. In addition, the disclosure is not limited by the example configuration of the DRAM illustrated in <FIG>.

Referring to <FIG> and <FIG>, the memory device <NUM> may include the memory cell array <NUM>, a row decoder <NUM>, a column decoder <NUM>, an input/output gating circuit <NUM>, a control logic circuit <NUM>, an address buffer <NUM>, a refresh control circuit <NUM>, a data input buffer <NUM>, and a data output buffer <NUM>. Although not illustrated in <FIG>, the memory device <NUM> may further include a clock buffer, a mode register set (MRS), a bank control logic, a voltage generation circuit, and so on.

The address buffer <NUM> may receive an address ADDR including a bank address, a row address ROW_ADDR, and a column address COL_ADDR from the memory controller <NUM>. The address buffer <NUM> may provide the received bank address to the bank control logic, the received row address ROW_ADDR to the row decoder <NUM>, and the received column address COL_ADDR to the column decoder <NUM>.

The memory cell array <NUM> may include a plurality of memory cells arranged in rows and columns in a matrix. The memory cell array <NUM> may include a plurality of word lines WL and a plurality of bit lines BL connected to the plurality of memory cells. The plurality of word lines WL may be connected to rows of the plurality of memory cells, and the plurality of bit lines BL may be connected to columns of the plurality of memory cells. Data of memory cells connected to an activated word line WL may be sensed and amplified by sense amplifiers connected to the plurality of bit lines BL.

The memory cell array <NUM> may include first to fourth banks BANK1 to BANK4. The bank control logic may generate bank control signals in response to a bank address, and in response to the bank control signals, the row decoder <NUM> and the column decoder <NUM> of a bank corresponding to the bank address among the first to fourth banks BANK1 to BANK4 may be activated. Although the present embodiment illustrates an example of the memory device <NUM> including four banks, the memory device <NUM> may include any number of banks depending on embodiments.

The row decoder <NUM> and the column decoder <NUM> may be arranged to correspond to each of the first to fourth banks BANK1 to BANK4, and the row decoder <NUM> and the column decoder <NUM> connected to the bank corresponding to the bank address may be activated. The row decoder <NUM> may decode the row address ROW_ADDR received from the address buffer <NUM> to select a word line WL corresponding to the row address ROW_ADDR from among the plurality of word lines WL and may connect the selected word line WL to a word line driver that activates the plurality of word lines WL.

The column decoder <NUM> may select certain bit lines BL from among the plurality of bit lines BL of the memory cell array <NUM>. The column decoder <NUM> may decode a burst address gradually increased by +<NUM> based on the column address COL_ADDR in a burst mode to generate a column select signal and may connect the bit lines BL selected by the column select signal to the input/output gating circuit <NUM>. Burst addresses refer to addresses of column locations that may be accessed in terms of a burst length BL for a read and/or write command.

The input/output gating circuit <NUM> may include read data latches for storing read data of the bit lines BL selected by the column select signal and a write driver for writing write data into the memory cell array <NUM>. Read data stored in the read data latches of the input/output gating circuit <NUM> may be provided to a data bus through the data output buffer <NUM> and output as data DQ to the host device <NUM>. Write data output from the host device as data DQ may be written to the memory cell array <NUM> through the data input buffer <NUM> connected to the data bus and through a write driver of the input/output gating circuit <NUM>.

The control logic circuit <NUM> may receive the clock signal CK and the command CMD and generate control signals for controlling an operation timing and/or a memory operation of the memory device <NUM>. The control logic circuit <NUM> may provide control signals to circuits of the memory device <NUM> to operate as set in operations and control parameters stored by the MRS. The control logic circuit <NUM> may read data from and write data to the memory cell array <NUM> by using the control signals. Although the control logic circuit <NUM> and the address buffer <NUM> are illustrated as separate components in <FIG>, the control logic circuit <NUM> and the address buffer <NUM> may be implemented as one inseparable component. In addition, although the command CMD and the address ADDR are illustrated as separate signals in <FIG>, the address may be regarded as included in the command as suggested in the LPDDR standard or so on.

The control logic circuit <NUM> may be configured to detect a row hammer address that is intensively accessed during a row hammer monitoring time frame and perform a target-refresh operation of a memory cell row physically adjacent to a memory cell row corresponding to the row hammer address. The control logic circuit <NUM> may store access addresses in the address table and may perform a flattening operation and a random selection operation on an address entry stored in the address table.

The control logic circuit <NUM> may randomly perform a flattening operation and a random selection operation on the address entry of the address table to prevent an address entry having a small access number from being evicted from the address table. The control logic circuit <NUM> may prevent a hacker-pattern row hammer aggression, in which a hacker attempts to maliciously evict a row hammer address from an address storage, from being easily performed due to randomness of a flattening operation and a random selection operation performed on the address entry during each row hammer monitoring time frame.

The control logic circuit <NUM> may include a row hammer control circuit <NUM> for controlling a decoy row hammer of a hacker pattern during a row hammer monitoring time frame. The row hammer control circuit <NUM> is described below with reference to <FIG>. In the following embodiments, it is described that the row hammer control circuit <NUM> controls a decoy row hammer of a hacker pattern, but embodiments of the disclosure are not limited thereto. For example, the row hammer control circuit <NUM> may be described as corresponding to a configuration provided in the control logic circuit <NUM> and the control logic circuit <NUM> may be described as controlling a decoy row hammer of a hacker pattern.

The control logic circuit <NUM> may control, in response to the refresh command CMD, the refresh control circuit <NUM> to perform a normal refresh operation by increasing a refresh counter value by +<NUM>. In addition, the control logic circuit <NUM> may control the refresh control circuit <NUM> to perform a target row refresh operation based on a row hammer address RH_ADDR. The refresh control circuit <NUM> may generate a refresh address REF_ADDR corresponding to a memory cell row on which a normal refresh operation and/or a target row refresh operation is to be performed.

<FIG> is a block diagram illustrating a row hammer control circuit according to embodiments of the disclosure. <FIG> is a diagram illustrating a refresh operation of the memory device of <FIG>. <FIG> is a conceptual diagram illustrating an example in which an address table of <FIG> is reconfigured. <FIG> is a diagram illustrating a random number generator of the row hammer control circuit of <FIG>. Hereinafter, the row hammer control circuit collectively refers to the circuits implemented in hardware, firmware, software, or a combination thereof for controlling or managing a row hammer.

Referring to <FIG> and <FIG>, the row hammer control circuit <NUM> may be configured to monitor a row hammer on one or more memory cell rows in the memory cell array <NUM> and to detect a row hammer of a certain memory cell row. The certain memory cell row refers to a memory cell row having the greatest access number or the greatest number of active commands during a preset time period. As illustrated in <FIG>, the preset time period may be set to about <NUM> or about <NUM> of the refresh window time tREFw defined in the JEDEC standard. According to an embodiment, the preset time period may be set as a basic refresh rate time tREFi of <FIG>. A basic refresh rate is defined as the number of refresh commands REFRESH of about <NUM> in a <NUM> refresh window. Hereinafter, the preset time period may be referred to as a row hammer monitoring time frame or a time window set by the control logic circuit <NUM>.

The row hammer control circuit <NUM> may detect a row hammer address that is intensively accessed during a row hammer monitoring time frame and prevent a decoy row hammer of a hacker pattern. The row hammer control circuit <NUM> may include an address table <NUM>, a first swap circuit <NUM>, a comparator circuit <NUM>, a random number generator <NUM>, and a second swap circuit <NUM>. The address table <NUM> may include registers allocated to an address storage <NUM> and a counter storage <NUM>.

As illustrated in <FIG>, the address storage <NUM> and the counter storage <NUM> of the address table <NUM> may store access addresses for activating memory cell rows of the memory cell array <NUM> and access numbers. The address table <NUM> illustrated as an example in <FIG> includes four registers and may be reconfigured according to points in time T1 to T3.

It is assumed that, in <FIG>, a 0x02 address entry having an access number of <NUM>, a 0x06 address entry having an access number of <NUM>, a 0x0A address entry having an access number of <NUM>, and a 0x0C address entry having an access number of <NUM> are stored in advance in the address storage <NUM> and the counter storage <NUM> of the address table <NUM> in a default state.

When an access address corresponding to the 0x0A memory cell row is applied at time T1, the access number of the 0x0A address entry stored in the address storage <NUM> is incremented by <NUM>, and thus, the access number may be increased from <NUM> to <NUM>. When an access address corresponding to the 0x02 memory cell row is applied at time T2, the access number of the 0x02 address entry stored in the address storage <NUM> is incremented by <NUM>, and thus, the access number may be increased from <NUM> to <NUM>. Thereafter, at time T3, an access address corresponding to the 0x0E memory cell row may be applied. A new 0x0E address entry may be stored in the address table <NUM>, and there is no free space because the address table <NUM> is full. Accordingly, the 0x02 address entry having the smallest access number of <NUM> may be evicted, and the 0x0E address entry may be stored with the access number of <NUM> in the free space. The 0x02 address entry to be evicted is an address having the smallest access in the address table <NUM>, but as the 0x02 address entry is evicted from the address table <NUM>, row hammer data on the 0x02 address may be lost.

In this way, an aggressor may use a decoy entry stored in the address table <NUM> for the purpose of causing the row hammer address to be evicted from the address table <NUM>. In order to prevent a pattern of a hacker pattern such as a decoy entry, the row hammer control circuit <NUM> may randomly perform a flattening operation and a random selection operation on the address entries stored in the address table <NUM>.

In <FIG>, the row hammer control circuit <NUM> may receive an access address for activating a memory cell row of the memory cell array <NUM> and store a first address entry having a first access number (for example, <NUM>) in a free space of the address table <NUM>. When there is no free space in the address table <NUM>, the first swap circuit <NUM> may select a second address entry having a second access number from the address table <NUM> and perform a first swap operation of swapping the first address entry with the second address entry. The second access number may be set as the smallest access number among the access numbers stored in the address table <NUM>.

When swapping the first address entry with the second address entry, the first swap circuit <NUM> may set the access number of the first address entry to a first value increased by <NUM> from the second access number. Accordingly, the access number of the first address entry may be changed from the first access number to the second access number + <NUM>. A first swap operation performed in this way may be referred to as a counter-based flattening operation.

The comparator circuit <NUM> may randomly select a third address entry having a third access number from the address table <NUM>. The third access number may be set to an access number that is not the greatest value among the access numbers stored in the address table <NUM>.

The random number generator <NUM> may be configured to randomly select one of the addresses of the access numbers that are not the greatest value selected by the comparator circuit <NUM>. The random number generator <NUM> may generate random numbers by using an algorithm used to generate the random numbers. For example, the random number generator <NUM> may generate random numbers according to a linear congruential random number generation algorithm, a middle-square random number generation algorithm, a Mersenne Twister random number generation algorithm, and so on and output the random numbers. In addition, the random number generator <NUM> may have a hardware logic for generating the random numbers.

For example, the random number generator <NUM> may be configured as a linear feedback shift register (LFSR) that generates and outputs a linear random number sequence based on a primitive polynomial. The LFSR may include a shift register unit <NUM>, a feedback constant unit <NUM>, and a linear feedback function unit <NUM>, as illustrated in <FIG>.

Referring to <FIG>, the shift register unit <NUM> may include n shift registers S<NUM>, S<NUM>,. , Sn-<NUM>, the shift registers S<NUM>, S<NUM>,. , Sn-<NUM> may receive and shift an output P of the linear feedback function unit <NUM>, and the shift registers S<NUM>, S<NUM>,. , Sn-<NUM> may respectively transmit outputs thereof to stages of the feedback constant unit <NUM> one-to-one.

The feedback constant unit <NUM> takes values of modes <NUM> and <NUM> as coefficients of a primitive polynomial and outputs values of Ci (C<NUM> = <NUM>, I = <NUM>, <NUM>,. ) indicating a connection state to the shift register unit <NUM>. The feedback constant unit <NUM> may receive the bits s<NUM>, s<NUM>,. , sn-<NUM> output from of the shift register unit <NUM> and transmit the outputs and constant values Ci (C<NUM> = <NUM>, I = <NUM>, <NUM>,. ) thereof to the linear feedback function unit <NUM>.

The linear feedback function unit <NUM> may receive bits s<NUM>, s<NUM>,. , sn-<NUM> output from the feedback constant unit <NUM>, generate the output P according to Equation <NUM>, and transmit the output P to the shift register unit <NUM>.

An operation process of a linear feedback shift register (LFSR) is as follows. The linear feedback function unit <NUM> may calculate and output the output P. Thereafter, the shift register unit <NUM> outputs all of bits s<NUM>, s<NUM>,. , sn-<NUM> and receives and shifts the output P of the linear feedback function unit <NUM>. The shift registers S<NUM>, S<NUM>,. , Sn-<NUM> output the bits s<NUM>, s<NUM>,. , sn1 to the feedback constant unit <NUM>. All of the bits s<NUM>, s<NUM>,. , sn-<NUM> output from the shift register unit <NUM> whenever the operation process is repeated may be output as random values. Based on the random value output from the shift register unit <NUM>, the comparator circuit <NUM> may randomly select an address entry having a third access number that is not the greatest value from the address table <NUM>.

Referring back to <FIG>, the second swap circuit <NUM> may perform a second swap operation related to the third address entry, having the third access number randomly selected from the address table <NUM> by the comparator circuit <NUM> and the random number generator <NUM>, and the first address entry. The second swap operation may be a random swap operation in which the second access number + <NUM> of the first address entry is swapped with the third access number. According to an embodiment, the second swap operation may be a random swap operation in which the first address entry is swapped with the third address entry.

<FIG> is a flowchart illustrating an operation of a control logic circuit according to embodiments of the disclosure.

Referring to <FIG> in conjunction with <FIG>, the system <NUM> may perform initialization in operation S710. When the system <NUM> is powered up, the memory controller <NUM> and the memory device <NUM> may perform an initial setting operation according to a preset method. Default operation parameters may be set in initialization of the memory device <NUM>. For example, the row hammer monitoring time frame tREFi may be set. In addition, the address table <NUM> may be reset to be emptied every row hammer monitoring time frame tREFi.

In operation S720, the control logic circuit <NUM> may perform an operation of monitoring a row hammer. In the operation of monitoring the row hammer (operation S720 ), the control logic circuit <NUM> may count access numbers of the addresses to be accessed during the row hammer monitoring time frame tREFi and store the access addresses and the access numbers in the address table <NUM>.

In operation S730, the control logic circuit <NUM> may perform a counter-based flattening operation and a random swap operation on the access address entries obtained in operation S720 and stored in the address table <NUM>. The flattening operation and random swap operation S730 will be described in detail with reference to <FIG>.

In operation S740, the control logic circuit <NUM> may determine whether the row hammer monitoring time frame tREFi elapses. When the row hammer monitoring time frame tREFi has not elapsed (NO), the processing may proceed to operation S720. The control logic circuit <NUM> may repeat a row hammer monitoring operation on the access addresses in operation S720. Otherwise, when the row hammer monitoring time frame tREFi has elapsed (YES), the processing may proceed to operation S750.

In operation S750, the control logic circuit <NUM> may perform a target row refresh operation based on an address entry having the greatest access number among the access numbers of the address entries stored in the address table <NUM>. The control logic circuit <NUM> may provide the address entry having the greatest access number as a row hammer address RH_ADDR to the refresh control circuit <NUM>. The refresh control circuit <NUM> may generate a hammer refresh address indicating an address of a memory cell row physically adjacent to a memory cell row corresponding to the row hammer address RH_ADDR and target-refresh memory cells connected to a memory cell row corresponding to the hammer refresh address. After the target row refresh operation of operation S750 is performed, the processing proceeds to operation S710, and thus, address entries and access numbers in the address table <NUM> may be emptied.

<FIG> is a flowchart illustrating an operation of a control logic circuit according to embodiments of the disclosure. <FIG> is a flowchart specifically explaining the counter-based flattening operation and random swap operation S730 described with reference to <FIG>. <FIG> are diagrams illustrating the address table <NUM> reconfigured at each point in time Ta to Td according to the operation flows of <FIG>.

First, the control logic circuit <NUM> may store the access address entries and the access numbers in the address table <NUM> according to the row hammer monitoring operation (operation S720 ) described with reference to <FIG>. It is assumed that the address storage <NUM> and the counter storage <NUM> in the address table <NUM> are composed of four registers as illustrated in <FIG>. For example, it is assumed that a 0x02 address entry having an access number of <NUM>, a 0x06 address entry having an access number of <NUM>, a 0x0A address entry having an access number of <NUM>, and a 0x0C address entry having an access number of <NUM> are stored in advance in the address storage <NUM> and the counter storage <NUM> in the address table <NUM> of <FIG>.

Referring to <FIG> in conjunction with <FIG>, the control logic circuit <NUM> may receive a first row address together with a row active command in operation S800. In operation S810, the control logic circuit <NUM> may determine whether the received first row address matches an address entry stored in the address table <NUM>. As a result of the determination, when the received first row address matches the address entry (YES), the processing may proceed to operation S820, and when the received first row address does not match the address entry (NO), the processing may proceed to operation S830. In operation S820, the control logic circuit <NUM> may increment a counter value of the matched address entry by <NUM>.

In operation S830, the control logic circuit <NUM> may determine whether there is no free space because the address entries of the address table <NUM> are full. As a result of the determination, when there is a free space (NO), the processing may proceed to operation S840, and when there is no free space, the processing may proceed to operation S831. In operation S840, the control logic circuit <NUM> may store the first row address entry in a free space of the address table <NUM>.

In operation S831, the control logic circuit <NUM> may perform a counter-based flattening operation on the address entries of the address table <NUM>. The control logic circuit <NUM> may select an address entry having the smallest access number from among the address entries stored in the address table <NUM>. The control logic circuit <NUM> may swap the address entry having the smallest access number with the first row address entry by using the first swap circuit <NUM>.

Operation S831 may be performed at points in time Ta and Tb of <FIG>. At the point in time Ta, a 0x0E address entry may be accessed. When the received 0x0E address entry does not match an address entry stored in the address table <NUM> (operation S810) and there is no free space in the address table <NUM> (operation S830), the control logic circuit <NUM> may select the 0x0A address entry having the smallest access number of <NUM>. The first swap circuit <NUM> may swap the selected 0x0A address entry with the 0x0E address entry. The 0x0E address entry may be replaced with the 0x0A address entry to be stored in the address table <NUM>. In this case, the first swap circuit <NUM> may store an access number of the 0x0E address entry obtained by incrementing the access number of <NUM> of the swapped 0x0A address entry by a first value (for example, <NUM>). For example, the access number of the 0x0E address entry may be stored as <NUM>.

In operation S832, the control logic circuit <NUM> may perform a random selection operation on the address entries of the address table <NUM>. The control logic circuit <NUM> may randomly select any one of the address entries of the address table <NUM> by using the random number generator <NUM>.

In operation S833, the control logic circuit <NUM> may determine whether an access number of the address entry selected by the random selection operation in operation S832 is not the greatest value by using the comparator circuit <NUM>. As a result of the determination, when the access number is the greatest value (NO), the processing may proceed to operation S832 and when the access number is not the greatest value (YES), the processing may proceed to operation S834. Operation S832 and operation S833 may be repeated until an address entry having an access number other than the greatest value is selected.

Operation S832 and operation S833 may be performed at a point in time Tc of <FIG>. At the point in time Tc, the comparator circuit <NUM> may select one of access numbers of <NUM> and <NUM> other than an access number of <NUM> that is the greatest value from the address table <NUM>. For example, an access number of <NUM> may be selected by the comparator circuit <NUM>.

In operation S834, the control logic circuit <NUM> may perform a random swap operation on the address entries of the address table <NUM>. The control logic circuit <NUM> may swap the access number that is not the greatest value selected by the comparator circuit <NUM> with the access number of the first row address entry by using the second swap circuit <NUM>.

Operation S834 may be performed at a point in time Td of <FIG>. At the point in time Td, the second swap circuit <NUM> may swap the access number of <NUM> that is not the greatest access number selected in operation S832 and operation S833 with the access number of <NUM> of the 0x0E address entry. Accordingly, the access number of the 0x0E address entry may be changed from <NUM> to <NUM>, and the access number of the 0x06 address entry may be changed from <NUM> to <NUM>. According to an embodiment, the 0x0E address entry may be swapped with the 0x06 address entry instead of solely being incremented by a number of accesses.

An aggressor may not determine that the flattening operation and random swap operation S730 are randomly performed in this way on address entries stored in the address table <NUM>. In addition, a decoy row hammer aggression of a hacker pattern may not be easily performed due to randomness of the flattening operation and random swap operation S730 during each row hammer monitoring time frame. Accordingly, the control logic circuit <NUM> may prevent row hammer information from being lost and prevent a hacker-pattern row hammer aggression from being easily performed.

<FIG> is a view illustrating a memory device for controlling a row hammer according to an example embodiment of the disclosure. <FIG> illustrates the memory device <NUM> of <FIG> implemented in HBM. It may be noted that an HBM configuration illustrated in <FIG> is provided as an example and is not an actual HBM configuration. In addition, the disclosure is not limited by an example of the HBM configuration illustrated in <FIG>. Hereinafter, subscripts (for example, a of 120a) attached to the same reference numerals in different drawings are used to distinguish a plurality of circuits having similar or identical functions. For the sake of convenient description, a memory device 120a may be hereinafter referred to as an HBM.

Referring to <FIG> and <FIG>, the HBM 120a may be connected to the host device <NUM> through an HBM protocol of the JEDEC standard. The HBM protocol is a high-performance random access memory (RAM) interface for three-dimensional stacked memories (for example, DRAM). The HBM 120a generally achieves a wider bandwidth while consuming less power in a substantially smaller form factor than other DRAM technologies (for example, DDR4, graphics DDR5 (GDDR5), and so on).

The HBM 120a may have a high bandwidth by including a plurality of channels CH1 to CH8 having interfaces independent of each other. The HBM 120a may include a plurality of dies, for example, a logic die <NUM> (<NUM> (or a buffer die)) and one or more core dies <NUM> stacked on the logic die <NUM>. <FIG> illustrates an example in which first to fourth core dies <NUM> to <NUM> are provided in the HBM 120a, but the number of core dies <NUM> may be variously changed. The core dies <NUM> may be referred to as memory dies.

Each of the first to fourth core dies <NUM> to <NUM> may include one or more channels. <FIG> illustrates an example in which each of the first to fourth core dies <NUM> to <NUM> includes two channels and the HBM 120a includes eight channels CH1 to CH8. For example, the first core die <NUM> may include a first channel CH1 and a third channel CH3, the second core die <NUM> may include a second channel CH2 and a fourth channel CH4, the third core die <NUM> may include a fifth channel CH5 and a seventh channel CH7, and the fourth core die <NUM> may include a sixth channel CH6 and an eighth channel CH8.

The logic die <NUM> may include an interface circuit <NUM> communicating with the host device <NUM> and receive a command/address signal and data from the host device <NUM> through the interface circuit <NUM>. The host device <NUM> may transmit the command/address signal and the data through the buses <NUM> corresponding to the first channel CH1 to the eighth channel CH8, and the buses <NUM> may be formed to be divided for each channel or some of the buses <NUM> may be shared by at least two channels. The interface circuit <NUM> may transmit the command/address signal and the data to channels through which the host device <NUM> requests a memory operation or arithmetic processing. In addition, according to an example embodiment of the disclosure, each of the core dies <NUM> or each of the channels may include a processor-in-memory (PIM) circuit.

The host device <NUM> may provide the command/address signal and the data such that at least some of a plurality of arithmetic operations or kernels may be performed by the HBM 120a, and a PIM circuit of a channel designated by the host device <NUM> may perform arithmetic processing. For example, when the received command/address signal indicates arithmetic processing, the PIM circuit of a corresponding channel may perform the arithmetic processing by using write data provided from the host device <NUM> and/or data read from the corresponding channel. In another example, when the command/address signal received through a corresponding channel of the HBM 120a indicates a memory operation, an access operation on data may be performed.

According to an embodiment, each of the first to eighth channels CH1 to CH8 may include a plurality of banks and one or more processing elements may be provided in a PIM circuit in each of the first to eighth channels CH1 to CH8. For example, the number of processing elements in each channel may be equal to the number of banks or one processing element may be shared among at least two banks when the number of processing elements is less than the number of banks. The PIM circuit in each of the first to eight channels CH1 to CH8 may perform a kernel offloaded by the host device <NUM>.

According to an embodiment, each of the first to eighth channels CH1 to CH8 may include the row hammer control circuit <NUM> described with reference to <FIG>. Each of the first to eighth channels CH1 to CH8 may include a logic circuit representing a correlation between a row address accessed during the row hammer monitoring time frame tREFi and an access number, and the logic circuit may include an address table in which a first address entry and a first access number corresponding to a first row address are stored. Each of the first to eighth channels CH1 to CH8 may perform a flattening operation and a random selection operation by which the first address entry is swapped with a second address entry having a smallest second access number in the address table and may randomly perform a random swap operation of swapping the first address entry with a third address entry having a third access number that is not the greatest value in the address table. Accordingly, each of the first to eighth channels CH1 to CH8 may prevent an address entry having a small access number from being evicted from registers and may prevent a hacker-pattern row hammer aggression from being easily performed.

In addition, the logic die <NUM> may further include a through silicon via (TSV) region <NUM>, an HBM physical layer interface (HBM PHY) region <NUM>, and a serializer/deserializer (SERDES) region <NUM>. The TSV region <NUM> is a region in which a TSV for communication with the core dies <NUM> is formed and is a region in which the buses <NUM> corresponding to the first to eighth channels CH1 to CH8 are formed. When each of the first to eight channels CH1 to CH8 has a bandwidth of <NUM> bits, the TSVs may include configurations for data input/output of <NUM> bits.

The HBM PHY region <NUM> may include a plurality of input/output circuits for communication with the memory controller <NUM> and the first to eight channels CH1 to CH8, and for example, the HBM PHY region <NUM> may include one or more interconnect circuits for connecting the first to eighth channels CH1 to CH8 to the memory controller <NUM>. The HBM PHY region <NUM> may include a physical or electrical layer and a logical layer provided for signals, frequencies, timing, driving, detailed operating parameters, and functionality required for efficient communication between the memory controller <NUM> and the first to eighth channels CH1 to CH8. The HBM PHY region <NUM> may perform memory interfacing such as selecting a row and a column corresponding to a memory cell for a corresponding channel, writing data into the memory cell, or reading the written data from the memory cell. The HBM PHY region <NUM> may support features of an HBM protocol of a JEDEC standard.

The SERDES region <NUM> is a region for providing a SERDES interface of the JEDEC standard as processing throughput of a processor of the host device <NUM> increases and as requirements for a memory bandwidth increase. The SERDES region <NUM> may include a SERDES transmitter, a SERDES receiver, and a controller. The SERDES transmitter may include a parallel-to-serial circuit and a transmitter, receive a parallel data stream, and serialize the received parallel data stream. The SERDES receiver may include a reception amplifier, an equalizer, a clock and data recovery circuit, and a serial-to-parallel circuit to receive a serial data stream and parallelize the received serial data stream. The controller may include an error detection circuit, an error correction circuit, and registers such as first in first out (FIFO).

<FIG> is a block diagram illustrating a system including a memory device for controlling a row hammer, according to embodiments of the disclosure.

Referring to <FIG>, a system <NUM> may include a camera <NUM>, a display <NUM>, an audio processor <NUM>, a modem <NUM>, DRAMs 1500a and 1500b, flash memories 1600a and 1600b, I/O devices 1700a and 1700b, and an application processor (AP) <NUM>. The system <NUM> may implemented as a laptop computer, a mobile phone, a smartphone, a tablet personal computer (PC), a wearable device, a healthcare device, or an internet of things (IOT) device. In addition, the system <NUM> may be implemented as a server or a PC.

The camera <NUM> may capture a still image or a moving image according to a user's control and may store the captured images or image data therein or transmit the captured images or image data to the display <NUM>. The audio processor <NUM> may process audio data included in content of the flash memories 1600a and 1600b or a network. The modem <NUM> may modulate a signal and transmit the modulated signal through wired/wireless communication, and a receiver may receive and demodulate the modulated signal to obtain an original signal. The I/O devices 1700a and 1700b may include devices having a digital input function and/or a digital output function, such as a Universal Serial Bus (USB) or storage, a digital camera, a secure digital (SD) card, a digital versatile disc (DVD), a network adapter, and a touch screen.

The AP <NUM> may entirely control an operation of the system <NUM> using a controller <NUM> and interface <NUM>. The AP <NUM> may control the display <NUM> such that some of contents stored in the flash memories 1600a and 1600b is displayed on the display <NUM>. When a user input is received through the I/O devices 1700a and 1700b, the AP <NUM> may perform a control operation corresponding to the user input. The AP <NUM> may include an accelerator block, which is a dedicated circuit for artificial intelligence (AI) data arithmetic, or may include an accelerator <NUM> separate from the AP <NUM>. The DRAM 1500b may be additionally mounted in the accelerator block or the accelerator <NUM>. The accelerator <NUM> may include a function block that performs a certain function of the AP <NUM>, and the accelerator <NUM> may include a GPU that is a function block for processing graphics data, a neural processing unit (NPU) that is a block for performing AI calculation and inference, and a data processing unit (DPU) that is a block for transmitting data.

The system <NUM> may include the plurality of DRAMs 1500a and 1500b. The AP <NUM> may control the DRAMs 1500a and 1500b through command and mode register (MRS) settings conforming to the JEDEC standard or may set a DRAM interface protocol for communication to use company-specific functions such as a low voltage, a high speed, and reliability and a cyclic redundancy Check (CRC)/error correction code (ECC) function. For example, the AP <NUM> may communicate with the DRAM 1500a through an interface which conforms to the JEDEC standard, such as LPDDR4 or LPDDR5, and the accelerator block or the accelerator <NUM> may set a new DRAM interface protocol for communication to control the DRAM 1500b for the accelerator <NUM> having a higher bandwidth than the DRAM 1500a.

Only the DRAMs 1500a and 1500b are illustrated in <FIG> but are not limited thereto, and any type of memory, such as phase-change random access memory (PRAM), static random access memory (SRAM), magnetic random access memory (MRAM), resistive random access memory (RRAM), ferroelectrics random access memory (FRAM), or Hybrid random access memory may be used when satisfying a bandwidth, a response speed, and a voltage condition of the AP <NUM> or the accelerator <NUM>. The DRAMs 1500a and 1500b have relatively less latency and a relatively smaller bandwidth than the I/O devices 1700a and 1700b or the flash memories 1600a and 1600b. The DRAMs 1500a and 1500b may be initialized when the system <NUM> is powered on, used as temporary storages for an operating system and application data when the operating system and the application data are loaded, or used as execution spaces for various software code.

The DRAMs 1500a and 1500b may perform addition/subtraction/multiplication/division operations, a vector operation, address arithmetic, or fast Fourier transform (FFT) arithmetic. In addition, the DRAMs 1500a and 1500b may perform a function used for inference. Here, the inference may be performed by a deep learning algorithm using an artificial neural network. The deep learning algorithm may include a training operation of learning a model through various data and an inference operation of recognizing data by using the learned model. In an embodiment, an image captured by a user through the camera <NUM> is signal-processed and stored in the DRAM 1500b and the accelerator block or the accelerator <NUM> may perform AI data arithmetic that recognizes data by using a function used for the data stored in the DRAM 1500b and the inference.

The system <NUM> may include a plurality of storages or a plurality of flash memories 1600a and 1600b having greater capacity than the capacity of the DRAMs 1500a and 1500b. The accelerator block or the accelerator <NUM> may perform the training operation and the AI data arithmetic by using the flash memory devices 1600a and 1600b. In an embodiment, the flash memories 1600a and 1600b may perform more efficiently the training operation and the inference AI data arithmetic performed by the AP <NUM> and/or the accelerator <NUM> by using a computing device included in the memory controller <NUM>. The flash memories 1600a and 1600b may store pictures taken by the camera <NUM> or data transmitted through a data network. For example, the flash memories 1600a and 1600b may store augmented reality/virtual reality, and high definition (HD) or ultra-high definition (UHD) content. Each of flash memories 1600a and 1600b may store information in a flash memory device <NUM>.

The DRAMs 1500a and 1500b in the system <NUM> may include the row hammer control circuit described with reference to <FIG>. The DRAMs 1500a and 1500b may include a logic circuit representing a correlation between a row address accessed during the row hammer monitoring time frame tREFi and an access number, and the logic circuit may include an address table in which a first address entry corresponding to a first row address and a first access number are stored. The DRAMs 1500a and 1500b may perform a flattening operation and a random selection operation of swapping the first address entry with a second address entry having the lowest second access number in an address table and may randomly perform a random swap operation of swapping the first address entry with a third address entry having a third access number that is not the greatest value in the address table. Accordingly, the DRAMs 1500a and 1500b may prevent an address entry having a small access number from being evicted from registers and prevent a hacker-pattern row hammer aggression from being easily performed.

As is traditional in the field, embodiments may be described and illustrated in terms of blocks which carry out a described function or functions. These blocks, which may be referred to herein as units or modules or the like, are physically implemented by analog and/or digital circuits such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits and the like, and may optionally be driven by firmware and/or software. The circuits may, for example, be embodied in one or more semiconductor chips, or on substrate supports such as printed circuit boards and the like. The circuits constituting a block may be implemented by dedicated hardware, or by a processor (e.g., one or more programmed microprocessors and associated circuitry), or by a combination of dedicated hardware to perform some functions of the block and a processor to perform other functions of the block. Each block of the embodiments may be physically separated into two or more interacting and discrete blocks without departing from the scope of the disclosure. Likewise, the blocks of the embodiments may be physically combined into more complex blocks without departing from the scope of the disclosure. An aspect of an embodiment may be achieved through instructions stored within a non-transitory storage medium and executed by a processor.

Claim 1:
A memory device (<NUM>, 120a, 1600a, 1600b) comprising:
a memory cell array (<NUM>) including a plurality of memory cell rows;
a control logic circuit (<NUM>) configured to monitor a row address with respect to a memory cell row from among the plurality of memory cell rows during a row hammer monitoring time frame and store the row address as an address entry in an address table (<NUM>) in which an access number of the address entry is stored; and
a refresh control circuit (<NUM>) configured to refresh a memory cell row physically adjacent to another memory cell row corresponding to an address entry having the greatest access number stored in the address table (<NUM>) during the row hammer monitoring time frame, wherein
the control logic circuit (<NUM>) performs a counter-based flattening operation and a random swap operation on the address entry stored in the address table (<NUM>),
characterized in that:
the control logic circuit (<NUM>) receives a first row address, selects a second address entry having a second access number from the address table (<NUM>) when there is no free space in the address table (<NUM>), and performs a first swap operation of swapping a first address entry with the second address entry, and
the second access number is the smallest access number in the address table (<NUM>).