  After years of development, FPGAs are finally making an appearance on
multi-tenant cloud servers. These heterogeneous FPGA-CPU architectures break
common assumptions about isolation and security boundaries. Since the FPGA and
CPU architectures share hardware resources, a new class of vulnerabilities
requires us to reassess the security and dependability of these platforms.
  In this work, we analyze the memory and cache subsystem and study Rowhammer
and cache attacks enabled on two proposed heterogeneous FPGA-CPU platforms by
Intel: the Arria 10 GX with an integrated FPGA-CPU platform, and the Arria 10
GX PAC expansion card which connects the FPGA to the CPU via the PCIe
interface. We show that while Intel PACs currently are immune to cache attacks
from FPGA to CPU, the integrated platform is indeed vulnerable to Prime and
Probe style attacks from the FPGA to the CPU's last level cache. Further, we
demonstrate JackHammer, a novel and efficient Rowhammer from the FPGA to the
host's main memory. Our results indicate that a malicious FPGA can perform
twice as fast as a typical Rowhammer attack from the CPU on the same system and
causes around four times as many bit flips as the CPU attack. We demonstrate
the efficacy of JackHammer from the FPGA through a realistic fault attack on
the WolfSSL RSA signing implementation that reliably causes a fault after an
average of fifty-eight RSA signatures, 25% faster than a CPU rowhammer attack.
In some scenarios our JackHammer attack produces faulty signatures more than
three times more often and almost three times faster than a conventional CPU
rowhammer attack.
