Search papers, labs, and topics across Lattice.
This paper critically analyzes the security vulnerabilities of the Sigries Rowhammer mitigation deployed by Microsoft, revealing that the transition between tracking and sampling modes is insecure and can drastically reduce the mean time to failure (MTTF) to about 1 second. In response, the authors propose FiRM (Filtered Rowhammer Mitigation), which co-designs tracking and sampling mechanisms to ensure security during transitions while maintaining performance. FiRM achieves zero slowdown for benign workloads and significantly reduces storage overhead compared to Sigries, offering a more secure and efficient solution for Rowhammer mitigation.
A single transition in Sigries can compromise security, reducing its effectiveness to just 1 second, while the new FiRM approach eliminates this vulnerability and complexity.
This paper studies efficient and secure Rowhammer mitigation at the Memory-Controller (MC). Rowhammer mitigation faces a fundamental tradeoff between tracking storage and mitigation rate: precise trackers (such as Misra-Gries) avoid unnecessary mitigations but require large CAM structures, whereas sampling-based schemes (such as PARA) require no storage but incur frequent mitigations even when not under attack. Microsoft recently deployed Sigries, an MC-side Rowhammer defense that combines an under-provisioned Misra-Gries tracker with a row-sampling fallback, in its Azure Cobalt 200 SoC. Sigries observed that the tracker-to-sampling transition can be insecure, and claimed the reverse transition is always safe. Our analysis shows that this transition is also vulnerable, and a Round-Robin Attack across sub-banks reduces the MTTF of Sigries to about 1 second, 8 orders of magnitude below the 13 years with PARA. Sigries also suffers from CAM complexity and high storage overheads. Our proposal, FiRM (Filtered Rowhammer Mitigation), is based on the insight that, for a secure design, the tracking-mode and sampling-mode should not be configured independently but co-designed to ensure the system remains secure not only in both modes but also during transitions. FiRM incurs zero slowdown for benign workloads, since they do not exceed the filtering threshold, and also replaces the complex CAM-based tracker with simple SRAM filters. To handle stressful patterns, we propose FiRM-P (probabilistic) and FiRM-D (deterministic). FiRM-P uses varying probabilities during transitions and steady state to ensure both security and low performance overhead. FiRM-D provides guaranteed deterministic security by modulating the rate of mitigation. Both FiRM-P and FiRM-D have less storage overhead than Sigries. Our paper shows that a principled approach can avoid both the insecurity and the complexity of Sigries.
