arXiv subjects

Alessandro Palumbo

Publications and source records attributed to Alessandro Palumbo.

4 recordsLinked to original sources

arXiv2026

JENGA: Exploiting Counter-Based RowHammer Countermeasures to Break Real-Time Predictability

Safety-critical real-time systems must satisfy multiple dependability requirements, notably time predictability and security. In such systems, tasks must complete within bounded and known execution times, typically characterised through Worst-Case Execution Time (WCET) analysis. At the same time, DRAM-based platforms are increasingly sensitive to the RowHammer read-disturbance security vulnerability, which has motivated the development of numerous hardware and software countermeasures in both academia and industry. However, the impact of these defences is generally evaluated in terms of average-case performance, a metric that is insufficient for safetycritical real-time systems, where worst-case behaviour is the primary concern. In this paper, we study the impact of RowHammer countermeasures based on hardware counters on the timing behaviour of real-time systems. We use a Per-Row-Activation-Counter (PRAC) countermeasure as a case study, standardised for recent DDR5 memories, and show that it can introduce significant timing variations. Based on this observation, we introduce JENGA, an attack in which an attacker-controlled task manipulates the internal state of the RowHammer countermeasure mechanism to increase the execution time of a victim real-time task beyond its expected WCET. We implement JENGA in a gem5 and Ramulator 2.0 simulation environment and evaluate its impact on TACLeBench workloads. We show that such an attack can delay tasks up to 200% of their WCET, making the initial timesafety assumptions unsafe. To address this issue, we derive a safe analytical bound that accounts for mitigation-induced delays in WCET analysis for DRAM systems protected by hardware countermeasures, such as PRAC-N.

cs.CR↗

arXiv2026

Frame-Dependent Traces and the Third-Particle Paradox

The Paradox of the Third Particle arises when comparing subsystem descriptions across Quantum Reference Frame (QRF) perspectives. We isolate two distinct origins of the Paradox: the QRF covariance of the partial trace and the failure of the physical Hilbert space to inherit the kinematical tensor-product structure. We give an explicit counterexample to the Relational Trace (RT) resolution: an uncorrelated product state for which the RT statistical condition trivialises. We then introduce a new statistical consistency condition comparing subsystem discarding between external and internal QRFs, together with an associated frame-dependent map, the Perspective Relational Trace (PRT). We argue that our condition captures the operational content of the Paradox: rather than imposing consistency on the whole state space, we characterise exactly the states on which it holds in the Perspective-Neutral (PN) and Quantum-Information (QI) approaches. This separates three levels of description: a PN subsystem of a PN whole, where consistency fails on a characterised set that includes product states; a QI subsystem of a QI whole, where it holds for all states; and a QI subsystem obtained from a PN whole by kinematical partial trace, where the full weakly invariant algebra is recovered, yet consistency holds only on a proper subset. These results show that the PN approach can consistently describe only a closed, isolated system, while the QI approach can accommodate arbitrary subsystems. Tracing out a subsystem from a globally PN state yields a charge-superselected algebra, reproducing in a minimal QRF model the boundary-charge structure of edge modes. We understand the Paradox not as a genuine contradiction, but as the consequence of comparing inequivalent physical layers without tracking which information is externally and which internally accessible.

quant-ph↗

arXiv2025

Detecting Hardware Trojans in Microprocessors via Hardware Error Correction Code-based Modules

Software-exploitable Hardware Trojans (HTs) enable attackers to execute unauthorized software or gain illicit access to privileged operations. This manuscript introduces a hardware-based methodology for detecting runtime HT activations using Error Correction Codes (ECCs) on a RISC-V microprocessor. Specifically, it focuses on HTs that inject malicious instructions, disrupting the normal execution flow by triggering unauthorized programs. To counter this threat, the manuscript introduces a Hardware Security Checker (HSC) leveraging Hamming Single Error Correction (HSEC) architectures for effective HT detection. Experimental results demonstrate that the proposed solution achieves a 100% detection rate for potential HT activations, with no false positives or undetected attacks. The implementation incurs minimal overhead, requiring only 72 #LUTs, 24 #FFs, and 0.5 #BRAM while maintaining the microprocessor's original operating frequency and introducing no additional time delay.

cs.CR↗

arXiv2020

hXDP: Efficient Software Packet Processing on FPGA NICs

FPGA accelerators on the NIC enable the offloading of expensive packet processing tasks from the CPU. However, FPGAs have limited resources that may need to be shared among diverse applications, and programming them is difficult. We present a solution to run Linux's eXpress Data Path programs written in eBPF on FPGAs, using only a fraction of the available hardware resources while matching the performance of high-end CPUs. The iterative execution model of eBPF is not a good fit for FPGA accelerators. Nonetheless, we show that many of the instructions of an eBPF program can be compressed, parallelized or completely removed, when targeting a purpose-built FPGA executor, thereby significantly improving performance. We leverage that to design hXDP, which includes (i) an optimizing-compiler that parallelizes and translates eBPF bytecode to an extended eBPF Instruction-set Architecture defined by us; a (ii) soft-CPU to execute such instructions on FPGA; and (iii) an FPGA-based infrastructure to provide XDP's maps and helper functions as defined within the Linux kernel. We implement hXDP on an FPGA NIC and evaluate it running real-world unmodified eBPF programs. Our implementation is clocked at 156.25MHz, uses about 15% of the FPGA resources, and can run dynamically loaded programs. Despite these modest requirements, it achieves the packet processing throughput of a high-end CPU core and provides a 10x lower packet forwarding latency.

cs.AR↗