  As Dynamic Random Access Memories (DRAM) scale, they are becoming
increasingly susceptible to Row Hammer. By rapidly activating rows of DRAM
cells (aggressor rows), attackers can exploit inter-cell interference through
Row Hammer to flip bits in neighboring rows (victim rows). A recent work,
called Randomized Row-Swap (RRS), proposed proactively swapping aggressor rows
with randomly selected rows before an aggressor row can cause Row Hammer.
  Our paper observes that RRS is neither secure nor scalable. We first propose
the `Juggernaut attack pattern' that breaks RRS in under 1 day. Juggernaut
exploits the fact that the mitigative action of RRS, a swap operation, can
itself induce additional target row activations, defeating such a defense.
Second, this paper proposes a new defense Secure Row-Swap mechanism that avoids
the additional activations from swap (and unswap) operations and protects
against Juggernaut. Furthermore, this paper extends Secure Row-Swap with attack
detection to defend against even future attacks. While this provides better
security, it also allows for securely reducing the frequency of swaps, thereby
enabling Scalable and Secure Row-Swap. The Scalable and Secure Row-Swap
mechanism provides years of Row Hammer protection with 3.3X lower storage
overheads as compared to the RRS design. It incurs only a 0.7% slowdown as
compared to a not-secure baseline for a Row Hammer threshold of 1200.
