So far I have only verified normal operation of the DRAM. Now lets move on the the hacking.

The RAS signal controls the internal operations of the DRAM, many of which are limited in their speed by internal capacitances. Since the CH32V003, which I am using to control the DRAM, is clocked at 48MHz, it can actually toggle the control signals faster than the internal signals of the DRAM can follow.

Let's first look at a situation where we pull the RAS signal low for only 40ns (two 48MHz clocks), shown as "RAS glitch low" in the scope image below.

Before the RAS signal is pulled low, the bitlines of the array are precharged to VDD/2. On the falling edge of the RAS signal, the ROW address is latched and then the wordline of the corresponding row is activated to connect the memory cells of the row to the bitlines. The cell capacitors are discharged to the bitlines. At the same time, the read amplifiers are activated. However, since we immediately pull up RAS again, the read amplifiers do not have enough time to restore logic levels on the bitlines and the discharged memory cells are not refreshed.

Let's have a look what happens when we do that.

void dram_set_row(uint8_t row,int32_t reps) {
    // RAS-only refresh cycle
    GPIOD->BSHR = DRAM_RAS_PIN;   // RAS high (inactive)
    GPIOD->BSHR = DRAM_CAS_PIN;   // CAS high (inactive)
    DRAM_ADDR_PORT->OUTDR = row;  // Set row address
    DELAY_3_CYCLES();             // Make sure row address is latched

    for (int32_t i=0; i<reps; i++) {
        GPIOD->BCR = DRAM_RAS_PIN;    // RAS low (active)
        GPIOD->BSHR = DRAM_RAS_PIN;   // RAS high (inactive)
        DELAY_RP_CYCLES();            // RAS precharge time -> ensureds bitlines are at VDD/2
    }

    dram_refresh_row(row);             // Refresh the row to ensure stable levels on the cells
}

The code above will glitch RAS low for a predefined number of times and then refresh the row to ensure the levels in the cells are stable.

The log above shows the results of applying different numbers of RAS low glitches. First we write a dummy pattern into row 0 (noninverting) and row 0x40 (inverting). Then the glitch is applied 0,1,2 times.

We can see that after applying the glitch, the entire row is reset to a stable level, either 1 for the noninverting or 0 for the inverting row. In some instances it also takes two cycles to reach a stable level.

"So what?  is this good for anything?"

Yes! We can now delete entire rows (256 bits) of memory at once, in less than 1µs. A 1980ies CPU like the 6502, would have taken around 10 cycles per bit, totalling ~2500 cycles. Now, being able to do this in 1µs would be a speedup of more than 2000x, assuming a 1 MHz 6502.