# L3 cache mapping on Sandy Bridge CPUs

DevFeed: [L3 cache mapping on Sandy Bridge CPUs](<https://devfeed.tech/articles/l3-cache-mapping-on-sandy-bridge-cpus-21570.md>)

Original publisher: [Read original article](<http://lackingrhoticity.blogspot.com/2015/04/l3-cache-mapping-on-sandy-bridge-cpus.html>)

Author: Mark Seaborn (noreply@blogger.com)

Published: 2015-04-27T21:59:00Z

Content type: article

Language: en

Sources: [Mark Seaborn](<https://devfeed.tech/sources/mark-seaborn.md>)

Topics: [Cache](<https://devfeed.tech/topics/cache.md>), [cpu](<https://devfeed.tech/topics/cpu.md>), [intel](<https://devfeed.tech/topics/intel.md>), [systems](<https://devfeed.tech/topics/systems.md>)

Tags: [cache](<https://devfeed.tech/tags/cache.md>), [cpu](<https://devfeed.tech/tags/cpu.md>), [hash](<https://devfeed.tech/tags/hash.md>), [intel](<https://devfeed.tech/tags/intel.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [memory](<https://devfeed.tech/tags/memory.md>), [paper](<https://devfeed.tech/tags/paper.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [rowhammer](<https://devfeed.tech/tags/rowhammer.md>), [side-channel](<https://devfeed.tech/tags/side-channel.md>), [slices](<https://devfeed.tech/tags/slices.md>), [xor](<https://devfeed.tech/tags/xor.md>)

## AI overview

The article explains how physical addresses map to cache sets and slices in the L3 cache of Intel Sandy Bridge CPUs. It reports a previously published mapping for four-core CPUs and presents the author's mapping for two-core CPUs, with applications to kernel ASLR analysis and row-hammering research.

## Source excerpt

In 2013, some researchers reverse-engineered how Intel Sandy Bridge CPUs map physical addresses to cache sets in the L3 cache (the last-level cache). They were interested in the cache mapping because it can be used to defeat kernel ASLR. I'm interested because the cache mapping can be used to test whether cached memory accesses can do row hammering (which can cause exploitable bit flips in some DRAM devices). The researchers published the details in the paper "Practical Timing Side Channel Attacks Against Kernel Space ASLR" (Ralf Hund, Carsten Willems and Thorsten Holz). They only published the mapping for 4-core CPUs, but I have figured out the mapping for 2-core CPUs as well. Some background: On Sandy Bridge CPUs, the L3 cache is divided into slices. Physical addresses are hashed to determine which slice of the L3 cache they will be stored in. The L3 cache is distributed and ring-based. There is one slice per core, but all the cores in a CPU can access all the cache slices via a ring bus which connects all the cores and their caches together. When a core accesses a memory location, the location will be slightly slower to access if it maps to a different core's cache slice, because it would take one or two hops around the ring bus to access it. The protocol used on the ring bus is based on QPI (Intel's QuickPath Interconnect). (QPI is a protocol used for connecting multiple CPUs together on high-end multi-socket systems.) Each cache slice contains 2048 cache sets. On lower-end CPUs, cache sets are 12-way associative, so a cache slice is 1.5MB in size (2048 sets * 12 ways * 64 bytes per cache line = 1.5MB). On higher-end CPUs, cache sets are 16-way associative, so a cache slice is 2MB in size (2048 sets * 16 ways * 64 bytes per cache line = 2MB). Cache mapping The researchers (Hund et al) figured out that the L3 cache uses the bits of a physical address as follows: Bits 0-5: These give the 6-bit byte offset within a 64-byte cache line. Bits 6-16: These give the 11-b