# Can cached memory accesses do double-sided row hammering?

DevFeed: [Can cached memory accesses do double-sided row hammering?](<https://devfeed.tech/articles/can-cached-memory-accesses-do-double-sided-row-hammering-21571.md>)

Original publisher: [Read original article](<http://lackingrhoticity.blogspot.com/2015/05/can-cached-memory-accesses-do-double.html>)

Author: Mark Seaborn (noreply@blogger.com)

Published: 2015-05-11T22:35:00Z

Content type: opinion

Language: en

Sources: [Mark Seaborn](<https://devfeed.tech/sources/mark-seaborn.md>)

Topics: [Cache](<https://devfeed.tech/topics/cache.md>), [cpu](<https://devfeed.tech/topics/cpu.md>)

Tags: [cache](<https://devfeed.tech/tags/cache.md>), [cpu](<https://devfeed.tech/tags/cpu.md>), [dram](<https://devfeed.tech/tags/dram.md>), [mapping](<https://devfeed.tech/tags/mapping.md>), [rowhammer](<https://devfeed.tech/tags/rowhammer.md>), [xor](<https://devfeed.tech/tags/xor.md>)

## AI overview

This article examines whether double-sided Rowhammer attacks can be performed using cached memory accesses instead of CLFLUSH. For the author's Sandy Bridge test machine, cache-set, DRAM-bank, and row-address constraints make selecting suitable addresses impossible, leaving single-sided hammering or two sets of 13 addresses as possible approaches.

## Source excerpt

There are indications that it is possible to cause bit flips in memory by row hammering without using CLFLUSH, using normal cached memory accesses. This makes me wonder: Is it possible to do double-sided row hammering using cached memory accesses, or only single-sided row hammering? The former is more likely to cause bit flips, and might be the only way to cause bit flips on some machines, such as those using a 2x refresh rate -- i.e. those configured to refresh DRAM every 32ms instead of every 64ms. (See the rowhammer blog post for more background.) The answer appears to be "no" -- at least on my test machine. For this machine (which has a Sandy Bridge CPU), I figured out how physical addresses map to cache sets and to banks and rows in DRAM. We can use these mappings to answer questions about what kinds of row hammering are possible using cached memory accesses. More specifically, my question is this: For a machine with an N-way L3 cache, is it possible to pick N+1 addresses that map to the same cache set, where at least two of these addresses map to rows R-1 and R+1 in one bank (for some neighbouring row R)? If so, repeatedly accessing these addresses would cause cache misses that cause rows R-1 and R+1 to be repeatedly activated. That puts more stress on row R (the victim row) than repeatedly activating only row R-1 or row R+1. The answer to this is "no": It's not possible to pick two such physical addresses. Here's why: Suppose we have two such addresses, A and B. Then: The addresses map to the same bank, so: (1): A[14:17] ^ A[18:21] = B[14:17] ^ B[18:21] (using the bank/row XOR scheme I described previously) The addresses are 2 rows apart, so: (2): A[18:32] + 2 = B[18:32] The addresses map to the same cache set, so: (3): A[6:17] = B[6:17] (also, SliceHash(A[17:32]) = SliceHash(B[17:32]), but we don't need this property) (2) implies that A[19] = ~B[19]. (3) implies that A[14:17] = B[14:17]. Combining that with (1) gives A[18:21] = B[18:21]. That implies A[19] =