theoretical DRAM

for e.g on DRAM cell
 |	word line
-|---------|-------------
 |	   |
 |	   |
 |	   |
 |________---_______|__Vcc/2
 |		    |
=== c1		    |
 |		    D (bit line)
===
 -



snippet - the parasitic body capacitor that is an inherent part of silicon on insulator (SOI) - (SOI MOSFET)  transistors.
A DRAM cell consists of a capacitor connected by a pass transistor to the bit line (or digit line or column line). The digit line (or column line) is connected to a multitude of cells arranged in a column. Assume that the capacitor's common node is biased approximately at VCC/2
The voltage change is given by (V^signal observed voltage change in the digit line, C^cell the capacitance of the DRAM cell capacitor, and C^line the capacitance of the digit line..

cell contains a charge Q = ±VCC/2 • C^cell

capacitance of the capacitor C^cell if the cell charge ? Q = +VCC/2 • C^cell(true state = stores a 1)

V^signal = V^cell*C^cell *(C^cell+C^line)-1

wiki image

http://upload.wikimedia.org/wikipedia/commons/thumb/6/6a/Original_1T1C_DRAM_design.svg/800px-Original_1T1C_DRAM_design.svg.png

DRAM cell poisoning with rowhammer (U,R bit)

4 KiB (212 bytes) page size
	page table entry
------------------------------------------
			|G|S|0|A|D|W|U|R|P
------------------------------------------
U, the 'User\Supervisor' bit, controls access to the page based on privilege level. If the bit is set, then the page may be accessed by all; if the bit is not set, however, only the supervisor can access it. For a page directory entry, the user bit controls access to all the pages referenced by the page directory entry. Therefore if you wish to make a page a user page, you must set the user bit in the relevant page directory entry as well as the page table entry.
R, the 'Read/Write' permissions flag. If the bit is set, the page is read/write. Otherwise when it is not set, the page is read-only. The WP bit in CR0 determines if this is only applied to userland, always giving the kernel write access (the default) or both userland and the kernel.

#emingh,#son28gun