DRAM & Memory Design · All levels

Rowhammer and Disturb Effects

Reliability, ECC & Security: High-frequency activation of aggressor rows injects disturbance into adjacent victim rows, causing data corruption unless mitigated with TRR policies, refresh adaptation, mapping randomization, and controller throttling.

What this topic teaches

Rowhammer and Disturb Effects turns DRAM theory into production-grade review decisions. High-frequency activation of aggressor rows injects disturbance into adjacent victim rows, causing data corruption unless mitigated with TRR policies, refresh adaptation, mapping randomization, and controller throttling.

The main objective is to identify where the first loss starts in the memory service path, prove it with reproducible traces, and close with the smallest owner-controlled fix.

Senior DRAM work is less about isolated register tuning and more about cross-layer causality: traffic shape, command stream legality, bank behavior, PHY margin, and field reliability must agree before signoff.

Senior-engineer framing question

When hammer threshold margin, disturb-induced bit flip count, mitigation hit rate regresses, can you prove whether the first failure is locality collapse, timing-window pressure, scheduler fairness loss, lane-margin drift, or reliability policy overhead?

diagram

DRAM CELL DIAGRAM - Rowhammer and Disturb Effects

                bitline (BL)
                    |
           +--------+--------+
wordline --| access transistor|-- storage capacitor (Ccell)
           +--------+--------+
                    |
                  ground

Read:   BL precharge -> WL on -> tiny delta-V -> sense amp amplifies
Write:  drive BL -> WL on -> charge/discharge Ccell -> WL off

Focus: link physical state changes to service-level latency and bandwidth outcomes
Metric tracked: hammer threshold margin, disturb-induced bit flip count, mitigation hit rate

Architecture and timing visuals

Draw the mechanism before tuning knobs. These visuals are optimized for design reviews, bring-up triage, and interview whiteboards.

Rowhammer aggressor-victim map

diagram

ROWHAMMER DISTURB MAP

bank X rows:
  R100  [aggressor]  ACT ACT ACT ACT ACT ...
  R101  [victim]     leakage/disturb -> possible bit flips
  R102  [aggressor]  ACT ACT ACT ACT ACT ...

hammer count threshold:
if activates(R100,R102) > H_th before refresh(R101) => corruption risk

Mitigation control path (TRR + throttling)

diagram

MITIGATION CONTROL

activate monitor -> hot-row counter -> threshold compare -> mitigation action
                                                |
                                                +--> targeted refresh
                                                +--> activate throttle
                                                +--> remap/randomize policy

validation metric: unmitigated flips per stress matrix

Array hierarchy context

diagram

ARRAY HIERARCHY MAP - Rowhammer and Disturb Effects

[Channel]
   |
[DIMM/Package]
   |
[Rank]
   |
[Bank Group]
   |
[Bank]
   |
[Subarray]
   |
[Row + Column Decode]
   |
[Cell Mat + Sense Amps]

Lens: map locality decisions to activate/precharge cost.

Command timing context

diagram

COMMAND TIMING DIAGRAM - Rowhammer and Disturb Effects

time --->    t0      t1      t2      t3      t4      t5
cmd bus   |  ACT  |   RD  |   WR  |  PRE  |  REF  |  ACT
row state | open  | open  | open  | close | all   | open

key checks:
- ACT->RD >= tRCD
- RD data return >= CL
- WR->PRE >= tWR
- PRE->ACT >= tRP

Controller queue context

diagram

CONTROLLER QUEUE VIEW - Rowhammer and Disturb Effects

read queue : [R12 bank0 row88] [R13 bank2 row88] [R14 bank0 row12]
write queue: [W44 bank3 row90] [W45 bank3 row90]

scheduler tick:
1) prioritize ready row hits
2) cap write-drain burst
3) age outstanding reads

issue stream:
cycle 40 -> RD bank0 row88 (hit)
cycle 41 -> RD bank2 row88 (parallel bank group)
cycle 42 -> ACT bank0 row12 (miss prepare)

Ownership layers

diagram

MEMORY OWNERSHIP LAYERS - Rowhammer and Disturb Effects

artifact area     owner
----------------  ----------------------------
architecture    memory controller owner
controller FW   security architect
verification    validation owner
silicon bringup TBD

Rule: every signoff metric has a named accountable owner.

Evidence to collect before changing knobs

Fast closure comes from complete evidence packets, not from isolated counter wins. Every recommendation should carry a metric, artifact, owner, and rollback-safe validation plan.

Primary metric: hammer threshold margin, disturb-induced bit flip count, mitigation hit rate.
Primary artifact: rowhammer stress log, aggressor-victim address trace, mitigation counter report.
Owners to include: memory controller owner, security architect, validation owner.
One reproducible failing traffic slice plus one stable comparator capture.
One command legality timeline that isolates first failing transition.
One margin or reliability packet when PHY or RAS behavior is implicated.

Bandwidth-latency operating lens

diagram

BANDWIDTH vs LATENCY CURVE - Rowhammer and Disturb Effects

latency
  ^
  |  low-load region
  |      *
  |        *
  |          *
  |            *         knee
  |              *      *
  |                *   *
  |                  ***
  +----------------------------------------------> bandwidth demand
     stable QoS          queue growth / saturation

Use the knee to set safe operating headroom.

Root-cause decision tree

diagram

ROOT CAUSE TREE - Rowhammer and Disturb Effects

hammer threshold margin, disturb-induced bit flip count, mitigation hit rate regressed
        |
reproducible with fixed seed?
      /               \
    no                 yes
    |                   |
testbench noise    localize bottleneck
                    /              \
               command path       data path
                 |                  |
             scheduler/FSM      PHY/timing/noise
                 |                  |
             timing limits      training/calibration

Stop at first failing mechanism, then patch and re-measure.

Key takeaways

Prove first failing transition before touching broad tuning policies.
Tie command-level behavior to application-visible QoS outcomes.
Close with accountable owner, rollback criteria, and corner validation.

Common pitfalls

Optimizing average GB/s while p99 latency and fairness degrade.
Comparing traces without fixed firmware, timing profile, and thermal tags.
Declaring closure without reliability and retrain robustness checks.

DRAM deep dive

Reliability closure combines ECC policy, scrub cadence, and disturbance mitigation like row-hammer controls.

Concept diagram

diagram

RELIABILITY LOOP

error detect -> ECC correct/report -> scrub/retire policy -> monitor recurrence

Metric graph

diagram

ERROR MANAGEMENT TREND

correctable events    ███████
silent-data-risk      ██
unrecoverable events  █

Reports and artifacts

correctable/uncorrectable error trend
scrub interval effectiveness report
row-hammer monitor log
fault-injection coverage summary

Mini case study

Relaxed scrub interval improved bandwidth in test but allowed burst correctables to cluster into service-visible latency spikes.

Debug branches

Segment ECC events by bank, rank, and temperature
Tune scrub cadence with workload-aware idle windows
Verify row-hammer mitigation using adversarial patterns

Senior review question

Ask: which latency, bandwidth, and reliability evidence proves this DRAM topic is closed under real traffic?

Key takeaways

Always tie controller and PHY counter shifts to application latency and throughput outcomes.
Lock firmware timing profile, thermal condition, and DIMM state before comparing DRAM captures.

Common pitfalls

Chasing peak bandwidth while ignoring p99 latency and fairness tails.
Changing timing guardbands without separating SI noise from scheduling issues.
Declaring closure without reliability gates, fault injection, and regression replay.

Practice this lesson