fetched/reality

Silicon Architecture • Hardware Security • Systems Forensics
TECHSCAPADE
DRAM ARCHITECTURE: JEDEC JESD79-5C DDR5 PRAC standardizes inlined wordline counters to replace broken TRR →
Home > Techscapade Desk
Techscapade Deep Dive JESD79-5C DDR5 SDRAM HARDWARE SECURITY
Open Dedicated Report → Deep-Dive & Schematics ▼

Low-Level DRAM Security Architecture: DDR5 Per-Row Activation Counting (PRAC) vs. Legacy Target Row Refresh (TRR) for RowHammer Mitigation

Physical hardware security and memory system architecture under sub-20nm scaling limits: why deterministic wordline counters are replacing probabilistic black-box sampling to defeat RowHammer.

Desk: Hardware Security Desk
Classification: Standardized Architecture (JEDEC)
Read Time: 8 min read • Peer-Reviewed

The Core Problem: Sub-20nm DRAM Scaling & Bit Flips

As DRAM manufacturing process nodes have scaled below 20nm, storage capacitors have shrunk and wordlines are packed in extreme physical proximity. Repeatedly toggling (activating and precharging) a single DRAM wordline—an aggressor row—causes electromagnetic interference and accelerated charge leakage in adjacent victim rows. If the activation count exceeds the critical RowHammer threshold (TRH), the charge stored in victim capacitors degrades past the sense-amplifier detection margin, inducing unrecoverable bit flips.

Legacy Threshold (DDR3 / DDR4)
~100,000 – 140,000
Activations required before adjacent capacitor leakage caused bit flips. Probabilistic sampling was moderately viable.
Modern Threshold (DDR5 Sub-20nm)
< 5,000 activations
In high-density nodes, threshold drops < 1,000. Feinting and many-sided hammering bypass legacy filters with ease.

Legacy mitigation strategies like Target Row Refresh (TRR) relied on sampling or probabilistic hardware tables inside the DRAM controller or DRAM die to guess which rows were being hammered. Modern exploit techniques easily bypassed TRR via "many-sided" or "feinting" activation patterns, forcing JEDEC to standardize hardware-level tracking directly inside the JESD79-5C DDR5 SDRAM specification.

⚡ DRAM Architecture & Subarray PRAC Tracking Engine
JESD79-5C / Hardware Schematic
MEMORY ARRAY (BANKS 0–3) Bank 0 Row 0 (Wordline Aggressor) 8-bit PRAC Bank 1 Bank 2 Bank 3 Row Decoder / Drivers Row 0 Wordline Column Decoder Sense Amplifiers (Row Buffer / One-Hot Shift) Sense Amplifiers (Row Buffer / One-Hot Shift) Sense Amp Signal Amplification Address Bus (Row/Col) DRAM 1T-1C CELL STRUCTURE Word Line (Gate) Storage Cap (Cs) < 20nm Leakage Zone Bit Line Control Logic & State Machine RAS#, CAS# WE#, CE# CLK, CKE Command Decoder Refresh Counter & PRAC ALERT_n Data Buffer (I/O DQ0..DQn) ALERT_n Back-Off Pin (ABO)
| DDR5 DRAM Subarray | +-------------------------------------------------------------------------+ | Wordline 0 (Row Data) | Inlined Activation Counter (e.g., 8-bit) | | Wordline 1 (Row Data) | Inlined Activation Counter (e.g., 8-bit) | | Wordline 2 (Row Data) | Inlined Activation Counter (e.g., 8-bit) | +-------------------------------------------------------------------------+ | [Count Exceeds Threshold] | v Asserts `ALERT_n` Signal (ABO Protocol) | v Host Memory Controller Halts Commands & Refreshes Victims
1
Inlined Wordline Counters
Each DRAM row has dedicated hardware counter bits stored directly in the DRAM array to track exact activation cycles.
2
Alert-Back-Off (ABO) Protocol
When any row hits safety threshold, the DRAM die asserts the physical ALERT_n pin back to the host memory controller.
3
Controller Coordination
Memory controller pauses command traffic and issues targeted Refresh Management (RFM) cycles to restore victim capacitor charge.

1. The Death of TRR and the Rise of JEDEC PRAC

Traditional Target Row Refresh (TRR) operated strictly as a "black box" inside the DRAM chip. It sampled row activations probabilistically and fired counter-refreshes to neighboring rows during regular refresh windows. Because TRR counters were limited in size and completely hidden from the host system's memory controller, sophisticated access patterns (such as 16-sided hammering, cascaded feinting, and synchronization attacks) could easily overflow or desynchronize TRR tracking logic without ever triggering a victim refresh.

Per-Row Activation Counting (PRAC) completely replaces probabilistic sampling with exact, deterministic tracking by embedding counter metadata directly alongside every DRAM row inside the memory array. Under the JEDEC JESD79-5C standard, DRAM silicon no longer guesses which wordlines are under attack—every row tracks its own operational history.

2. Architectural Challenges & Recent Research Solutions

While PRAC closes the fundamental security hole of TRR, implementing precise counter updates at nanosecond speeds introduces severe hardware performance, timing, and queue management overheads:

Challenge A • Latency Bottleneck
Read-Modify-Write (RMW) Overhead
In standard PRAC, every activation of a DRAM row requires a full Read-Modify-Write (RMW) cycle: reading the 8-bit counter, incrementing it via internal ALU logic, and writing it back. Research from DRAMSec and ASPLOS demonstrates that this additional timing delay (tUP) degrades overall system performance by up to 16.7% under heavy memory workloads.
Fix (One-Hot Counters): Proposals like Counterpoint replace binary counters with modified one-hot encoding in local sense amplifiers, hiding latency during row access.
Challenge B • Queue Exploitation
Queue Overflow & Jailbreak Patterns
Evaluations (e.g., MOAT from Georgia Tech / USENIX) revealed that naive PRAC implementations remain vulnerable to "Jailbreak" access patterns where concurrent multi-row hammering overflows internal mitigation queues faster than controller processing.
Fix (Dual-Threshold Hardware): Deploys Eligibility Threshold (ETH) for background mitigation + ALERT Threshold (ATH) for immediate ABO signaling.

Architectural Trade-off Matrix

Feature / Dimension Legacy TRR (DDR4) Standard DDR5 PRAC (JESD79-5C) Advanced PRAC (One-Hot / Dual-Threshold)
Tracking Granularity Probabilistic sampling / small table Deterministic (1 counter per row) Deterministic (1 counter per row)
Hardware Overhead Minimal (< 0.1% silicon area) ~1–3% DRAM die area overhead ~1–2% DRAM die area + modified sense amps
Performance Impact < 0.5% slowdown Up to 16.7% slowdown due to RMW (tUP) delay < 0.3% slowdown (hides RMW latency)
Security Guarantee ✕ Broken (Bypassed via multi-sided hammering) ▲ High (Requires tuned ABO thresholding) ✓ Provably Secure (Resistant to arbitrary feinting patterns)
System Co-design Isolated to DRAM die Requires ALERT_n host-DRAM protocol Requires ALERT_n + tuned memory controller scheduling

■ Silicon & Architecture Reality/Report

Co-Packaged Photonic Systems Thermal Flux
300 W/cm² FLUX
Optoelectronics • CPO

Thermal Reliability Challenges in Co-Packaged Photonic Systems

Severe 100–300 W/cm² thermal dissipation induces thermo-optic resonant drift, CTE warpage, and interfacial delamination in optical waveguides.

Packaging Reliability • 9 min read • IEEE / ECTC
DID THIS HAPPEN? NO VOTES YET