# How physical addresses map to rows and banks in DRAM

DevFeed: [How physical addresses map to rows and banks in DRAM](<https://devfeed.tech/articles/how-physical-addresses-map-to-rows-and-banks-in-dram-21572.md>)

Original publisher: [Read original article](<http://lackingrhoticity.blogspot.com/2015/05/how-physical-addresses-map-to-rows-and-banks.html>)

Author: Mark Seaborn (noreply@blogger.com)

Published: 2015-05-04T22:57:00Z

Content type: article

Language: en

Sources: [Mark Seaborn](<https://devfeed.tech/sources/mark-seaborn.md>)

Topics: [cpu](<https://devfeed.tech/topics/cpu.md>), [intel](<https://devfeed.tech/topics/intel.md>), [bug](<https://devfeed.tech/topics/bug.md>), [Testing](<https://devfeed.tech/topics/testing.md>)

Tags: [cpu](<https://devfeed.tech/tags/cpu.md>), [dram](<https://devfeed.tech/tags/dram.md>), [intel](<https://devfeed.tech/tags/intel.md>), [memory](<https://devfeed.tech/tags/memory.md>), [rowhammer](<https://devfeed.tech/tags/rowhammer.md>), [testing](<https://devfeed.tech/tags/testing.md>)

## AI overview

The article examines how Intel Sandy Bridge memory controllers map physical addresses to DRAM rows, banks, and columns. Using a vulnerable test machine, it relates the mapping to Rowhammer testing and describes inferring and checking the mapping from observed aggressor and victim addresses.

## Source excerpt

In my previous blog post, I discussed how Intel Sandy Bridge CPUs map physical addresses to locations in the L3 cache. Now I'll discuss how these CPUs' memory controllers map physical addresses to locations in DRAM -- specifically, to row, bank and column numbers in DRAM modules. Let's call this the DRAM address mapping. I'll use one test machine as a case study. Motivation: the rowhammer bug I am interested in the DRAM address mapping because it is relevant to the "rowhammer" bug. Rowhammer is a problem with some DRAM modules whereby certain pessimal memory access patterns can cause memory corruption. In these DRAMs, repeatedly activating a row of memory (termed "row hammering") can produce electrical disturbances that produce bit flips in vulnerable cells in adjacent rows of memory. These repeated row activations can be caused by repeatedly accessing a pair of DRAM locations that are in different rows of the same bank of DRAM. Knowing the DRAM address mapping is useful because it tells us which pairs of addresses satisfy this "same bank, different row" (SBDR) property. Guessing and checking an address mapping For my case study, I have a test machine containing DRAM that is vulnerable to the rowhammer problem. Running rowhammer_test on this machine demonstrates bit flips. I'd like to know what the DRAM address mapping is for this machine, but apparently it isn't publicly documented: This machine has a Sandy Bridge CPU, but Intel don't document the address mapping used by these CPUs' memory controllers. rowhammer_test does not actually need to identify SBDR address pairs. rowhammer_test just repeatedly tries hammering randomly chosen address pairs. Typically 1/8 or 1/16 of these pairs will be SBDR pairs, because our machine has 8 banks per DIMM (and 16 banks in total). So, while we don't need to know the DRAM address mapping to cause bit flips on this machine, knowing it would help us be more targeted in our testing. Though the address mapping isn't documented, I fo