  The Rowhammer vulnerability continues to get worse, with the Rowhammer
Threshold (TRH) reducing from 139K activations to 4.8K activations over the
last decade. Typical Rowhammer mitigations rely on tracking aggressor rows. The
number of possible aggressors increases with lowering thresholds, making it
difficult to reliably track such rows in a storage-efficient manner. At lower
thresholds, academic trackers such as Graphene require prohibitive SRAM
overheads (hundreds of KBs to MB). Recent in-DRAM trackers from industry, such
as DSAC-TRR, perform approximate tracking, sacrificing guaranteed protection
for reduced storage overheads, leaving DRAM vulnerable to Rowhammer attacks.
Ideally, we seek a scalable tracker that tracks securely and precisely, and
incurs negligible dedicated SRAM and performance overheads, while still being
able to track arbitrarily low thresholds. To that end, we propose START - a
Scalable Tracker for Any Rowhammer Threshold. Rather than relying on dedicated
SRAM structures, START dynamically repurposes a small fraction the Last-Level
Cache (LLC) to store tracking metadata. START is based on the observation that
while the memory contains millions of rows, typical workloads touch only a
small subset of rows within a refresh period of 64ms, so allocating tracking
entries on demand significantly reduces storage. If the application does not
access many rows in memory, START does not reserve any LLC capacity. Otherwise,
START dynamically uses 1-way, 2-way, or 8-way of the cache set based on demand.
START consumes, on average, 9.4% of the LLC capacity to store metadata, which
is 5x lower compared to dedicating a counter in LLC for each row in memory. We
also propose START-M, a memory-mapped START for large-memory systems. Our
designs require only 4KB SRAM for newly added structures and perform within 1%
of idealized tracking even at TRH of less than 100.
