Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper critiques the security and complexity of Microsoft’s Sigries Rowhammer mitigation strategy, revealing vulnerabilities in its transition between tracking and sampling modes that drastically reduce its mean time to failure (MTTF) to just 1 second. The authors propose FiRM (Filtered Rowhammer Mitigation), which co-designs the tracking and sampling mechanisms to maintain security during transitions while eliminating the need for complex CAM structures. FiRM achieves zero slowdown for benign workloads and offers two variants, FiRM-P and FiRM-D, which effectively balance security and performance with lower storage requirements than Sigries.
Transitioning between tracking and sampling modes in Rowhammer defenses can introduce critical vulnerabilities, as shown by a dramatic reduction in Sigries' security.
This paper studies efficient and secure Rowhammer mitigation at the Memory-Controller (MC). Rowhammer mitigation faces a fundamental tradeoff between tracking storage and mitigation rate: precise trackers (such as Misra-Gries) avoid unnecessary mitigations but require large CAM structures, whereas sampling-based schemes (such as PARA) require no storage but incur frequent mitigations even when not under attack. Microsoft recently deployed Sigries, an MC-side Rowhammer defense that combines an under-provisioned Misra-Gries tracker with a row-sampling fallback, in its Azure Cobalt 200 SoC. Sigries observed that the tracker-to-sampling transition can be insecure, and claimed the reverse transition is always safe. Our analysis shows that this transition is also vulnerable, and a Round-Robin Attack across sub-banks reduces the MTTF of Sigries to about 1 second, 8 orders of magnitude below the 13 years with PARA. Sigries also suffers from CAM complexity and high storage overheads. Our proposal, FiRM (Filtered Rowhammer Mitigation), is based on the insight that, for a secure design, the tracking-mode and sampling-mode should not be configured independently but co-designed to ensure the system remains secure not only in both modes but also during transitions. FiRM incurs zero slowdown for benign workloads, since they do not exceed the filtering threshold, and also replaces the complex CAM-based tracker with simple SRAM filters. To handle stressful patterns, we propose FiRM-P (probabilistic) and FiRM-D (deterministic). FiRM-P uses varying probabilities during transitions and steady state to ensure both security and low performance overhead. FiRM-D provides guaranteed deterministic security by modulating the rate of mitigation. Both FiRM-P and FiRM-D have less storage overhead than Sigries. Our paper shows that a principled approach can avoid both the insecurity and the complexity of Sigries.