Serial presence detect

In computing, serial presence detect (SPD) is a standardized way to automatically access information about a memory module. Earlier 72-pin SIMMs included five pins that provided five bits of parallel presence detect (PPD) data, but the 168-pin DIMM standard changed to a serial presence detect to encode much more information.[1]

When an ordinary modern computer is turned on, it starts by doing a power-on self-test (POST). Since about the mid-1990s, this process includes automatically configuring the hardware currently present. SPD is a memory hardware feature that makes it possible for the computer to know what memory is present, and what memory timings to use to access the memory.

Some computers adapt to hardware changes completely automatically. In most cases, there is a special optional procedure for accessing BIOS parameters, to view and potentially make changes in settings. It may be possible to control how the computer uses the memory SPD data—to choose settings, selectively modify memory timings, or possibly to completely override the SPD data (see overclocking).

Stored information

For a memory module to support SPD, the JEDEC standards require that certain parameters be in the lower 128 bytes of an EEPROM located on the memory module. These bytes contain timing parameters, manufacturer, serial number and other useful information about the module. Devices utilizing the memory automatically determine key parameters of the module by reading this information. For example, the SPD data on an SDRAM module might provide information about the CAS latency so the system can set this correctly without user intervention.

The SPD EEPROM is accessed using SMBus, a variant of the I²C protocol. This reduces the number of communication pins on the module to just two: a clock signal and a data signal. The EEPROM shares ground pins with the RAM, has its own power pin, and has three additional pins (SA0–2) to identify the slot, which are used to assign the EEPROM a unique address in the range 0x50–0x57. Not only can the communication lines be shared among 8 memory modules, the same SMBus is commonly used on motherboards for system health monitoring tasks such as reading power supply voltages, CPU temperatures, and fan speeds.

SPD EEPROMs also respond to I²C addresses 0x30–0x37 if they have not been write protected, and an extension (TSE series) uses addresses 0x18–0x1F to access an optional on-chip temperature sensor. All those values are seven-bit I²C addresses formed by a Device Type Identifier Code prefix (DTIC) with SA0-2: to read (1100) from slot 3, one uses 110 0011 = 0x33. With a final R/W bit it forms the 8-bit Device Select Code.[2] Note that the semantics of slot-id is different for write-protection operations: for them they can be not passed by the SA pins at all.[3]

Before SPD, memory chips were spotted with parallel presence detect (PPD). PPD used a separate pin for each bit of information, which meant that only the speed and density of the memory module could be stored because of the limited space for pins.

SDR SDRAM
Memory device on an SDRAM module, containing SPD data (red circled)

The first SPD specification was issued by JEDEC and tightened up by Intel as part of its PC100 memory specification.[4] Most values specified are in binary-coded decimal form. The most significant nibble can contain values from 10 to 15, and in some cases extends higher. In such cases, the encodings for 1, 2 and 3 are instead used to encode 16, 17 and 18. A most significant nibble of 0 is reserved to represent "undefined".

The SPD ROM defines up to three DRAM timings, for three CAS latencies specified by set bits in byte 18. First comes the highest CAS latency (fastest clock), then two lower CAS latencies with progressively lower clock speeds.

SPD contents for SDR SDRAM[5]
Byte Bit Notes
(dec.)(hex.) 76543210
00x00Number of bytes presentTypically 128
10x01log2(size of SPD EEPROM)Typically 8 (256 bytes)
20x02Basic memory type (4: SPD SDRAM)
30x03Bank 2 row address bits (0–15)Bank 1 row address bits (1–15)Bank 2 is 0 if same as bank 1
40x04Bank 2 column address bits (0–15)Bank 1 column address bits (1–15)Bank 2 is 0 if same as bank 1
50x05Number of RAM banks on module (1–255)Commonly 1 or 2
60x06Module data width low byteCommonly 64, or 72 for ECC DIMMs
70x07Module data width high byte0, unless width ≥ 256 bits
80x08Interface voltage level of this assembly (not the same as Vcc supply voltage) (0–4)Decoded by table lookup
90x09Nanoseconds (0–15)Tenths of nanoseconds (0.0–0.9)Clock cycle time at highest CAS latency
100x0aNanoseconds (0–15)Tenths of nanoseconds (0.0–0.9)SDRAM access time from clock (tAC)
110x0bDIMM configuration type (0–2): non-ECC, parity, ECCTable lookup
120x0cSelfRefresh period (0–5): 64, 256, 128, 32, 16, 8 kHzRefresh requirements
130x0dBank 2 2×Bank 1 primary SDRAM width (1–127, usually 8)Width of bank 1 data SDRAM devices. Bank 2 may be same width, or 2× width if bit 7 is set.
140x0eBank 2 2×Bank 1 ECC SDRAM width (0–127)Width of bank 1 ECC/parity SDRAM devices. Bank 2 may be same width, or 2× width if bit 7 is set.
150x0fClock delay for random column readsTypically 1
160x10Page———8421Burst lengths supported (bitmap)
170x11Banks per SDRAM device (1–255)Typically 2 or 4
180x12—7654321CAS latencies supported (bitmap)
190x13—6543210CS latencies supported (bitmap)
200x14—6543210WE latencies supported (bitmap)
210x15—RedundantDiff. clockRegistered dataBuffered dataOn-card PLLRegistered addr.Buffered addr.Memory module feature bitmap
220x16——Upper Vcc (supply voltage) toleranceLower Vcc (supply voltage) toleranceWrite/1 read burstPrecharge allAuto-prechargeEarly RAS prechargeMemory chip feature support bitmap
230x17Nanoseconds (4–18)Tenths of nanoseconds (0–9: 0.0–0.9)Clock cycle time at medium CAS latency
240x18Nanoseconds (4–18)Tenths of nanoseconds (0–9: 0.0–0.9)Data access time from clock (tAC)
250x19Nanoseconds (1–63)0.25 ns (0–3: 0.00–0.75)Clock cycle time at short CAS latency.
260x1aNanoseconds (1–63)0.25 ns (0–3: 0.00–0.75)Data access time from clock (tAC)
270x1bNanoseconds (1–255)Minimum row precharge time (tRP)
280x1cNanoseconds (1–255)Minimum row active–row active delay (tRRD)
290x1dNanoseconds (1–255)Minimum RAS to CAS delay (tRCD)
300x1eNanoseconds (1–255)Minimum active to precharge time (tRAS)
310x1f512 MiB256 MiB128 MiB64 MiB32 MiB16 MiB8 MiB4 MiBModule bank density (bitmap). Two bits set if different size banks.
320x20Sign (1: −)Nanoseconds (0–7)Tenths of nanoseconds (0–9: 0.0–0.9)Address/command setup time from clock
330x21Sign (1: −)Nanoseconds (0–7)Tenths of nanoseconds (0–9: 0.0–0.9)Address/command hold time after clock
340x22Sign (1: −)Nanoseconds (0–7)Tenths of nanoseconds (0–9: 0.0–0.9)Data input setup time from clock
350x23Sign (1: −)Nanoseconds (0–7)Tenths of nanoseconds (0–9: 0.0–0.9)Data input hold time after clock
36–610x24–0x3d Reserved For future standardization
620x3eMajor revision (0–9)Minor revision (0–9)SPD revision level; e.g., 1.2
630x3fChecksumSum of bytes 0–62, not then negated
64–710x40–47Manufacturer JEDEC id.Stored little-endian, trailing zero-padded
720x48Module manufacturing locationVendor-specific code
73–900x49–0x5aModule part numberASCII, space-padded
91–920x5b–0x5cModule revision codeVendor-specific code
930x5dTens of years (0–9: 0–90)Years (0–9)Manufacturing date (YYWW)
940x5eTens of weeks (0–5: 0–50)Weeks (0–9)
95–980x5f–0x62Module serial numberVendor-specific code
99–1250x63–0x7fManufacturer-specific dataCould be enhanced performance profile
1260x7e0x66 [sic] for 66 MHz, 0x64 for 100 MHzIntel frequency support
1270x7fCLK0CLK1CLK3CLK390/100 °CCL3CL2Concurrent APIntel feature bitmap

DDR SDRAM

The DDR DIMM SPD format is an extension of the SDR SDRAM format. Mostly, parameter ranges are rescaled to accommodate higher speeds.

SPD contents for DDR SDRAM[6]
Byte Bit Notes
(dec.)(hex.) 76543210
00x00Number of bytes writtenTypically 128
10x01log2(size of SPD EEPROM)Typically 8 (256 bytes)
20x02Basic memory type (7 = DDR SDRAM)
30x03Bank 2 row address bits (0–15)Bank 1 row address bits (1–15)Bank 2 is 0 if same as bank 1.
40x04Bank 2 column address bits (0–15)Bank 1 column address bits (1–15)Bank 2 is 0 if same as bank 1.
50x05Number of RAM banks on module (1–255)Commonly 1 or 2
60x06Module data width low byteCommonly 64, or 72 for ECC DIMMs
70x07Module data width high byte0, unless width ≥ 256 bits
80x08Interface voltage level of this assembly (not the same as Vcc supply voltage) (0–5)Decoded by table lookup
90x09Nanoseconds (0–15)Tenths of nanoseconds (0.0–0.9)Clock cycle time at highest CAS latency.
100x0aTenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)SDRAM access time from clock (tAC)
110x0bDIMM configuration type (0–2): non-ECC, parity, ECCTable lookup
120x0cSelfRefresh period (0–5): 64, 256, 128, 32, 16, 8 kHzRefresh requirements
130x0dBank 2 2×Bank 1 primary SDRAM width (1–127)Width of bank 1 data SDRAM devices. Bank 2 may be same width, or 2× width if bit 7 is set.
140x0eBank 2 2×Bank 1 ECC SDRAM width (0–127)Width of bank 1 ECC/parity SDRAM devices. Bank 2 may be same width, or 2× width if bit 7 is set.
150x0fClock delay for random column readsTypically 1
160x10Page———8421Burst lengths supported (bitmap)
170x11Banks per SDRAM device (1–255)Typically 4
180x12—43.532.521.51CAS latencies supported (bitmap)
190x13—6543210CS latencies supported (bitmap)
200x14—6543210WE latencies supported (bitmap)
210x15—xDiff clockFET switch external enableFET switch on-board enableOn-card PLLRegisteredBufferedMemory module feature bitmap
220x16Fast APConcurrent auto prechargeUpper Vcc (supply voltage) toleranceLower Vcc (supply voltage) tolerance———Includes weak driverMemory chip feature bitmap
230x17Nanoseconds (0–15)Tenths of nanoseconds (0.0–0.9)Clock cycle time at medium CAS latency.
240x18Tenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)Data access time from clock (tAC)
250x19Nanoseconds (0–15)Tenths of nanoseconds (0.0–0.9)Clock cycle time at short CAS latency.
260x1aTenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)Data access time from clock (tAC)
270x1bNanoseconds (1–63)0.25 ns (0–0.75)Minimum row precharge time (tRP)
280x1cNanoseconds (1–63)0.25 ns (0–0.75)Minimum row active–row active delay (tRRD)
290x1dNanoseconds (1–63)0.25 ns (0–0.75)Minimum RAS to CAS delay (tRCD)
300x1eNanoseconds (1–255)Minimum active to precharge time (tRAS)
310x1f512 MiB256 MiB128 MiB64 MiB32 MiB16 MiB/
4 GiB		8 MiB/
2 GiB		4 MiB/
1 GiB		Module bank density (bitmap). Two bits set if different size banks.
320x20Tenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)Address/command setup time from clock
330x21Tenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)Address/command hold time after clock
340x22Tenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)Data input setup time from clock
350x23Tenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)Data input hold time after clock
36–40 0x24–0x28Reserved Superset information
410x29Nanoseconds (1–255)Minimum active to active/refresh time (tRC)
420x2aNanoseconds (1–255)Minimum refresh to active/refresh time (tRFC)
430x2bNanoseconds (1–63, or 255: no maximum)0.25 ns (0–0.75)Maximum clock cycle time (tCK max.)
440x2cHundredths of nanoseconds (0.01–2.55)Maximum skew, DQS to any DQ. (tDQSQ max.)
450x2dTenths of nanoseconds (0.0–1.2)Hundredths of nanoseconds (0.00–0.09)Read data hold skew factor (tQHS)
460x2e Reserved For future standardization
470x2f—HeightHeight of DIMM module, table lookup
48–610x30–0x3d Reserved For future standardization
620x3eMajor revision (0–9)Minor revision (0–9)SPD revision level, 0.0 or 1.0
630x3fChecksumSum of bytes 0–62, not then negated
64–710x40–47Manufacturer JEDEC id.Stored little-endian, trailing zero-padded
720x48Module manufacturing locationVendor-specific code
73–900x49–0x5aModule part numberASCII, space-padded
91–920x5b–0x5cModule revision codeVendor-specific code
930x5dTens of years (0–90)Years (0–9)Manufacturing date (YYWW)
940x5eTens of weeks (0–50)Weeks (0–9)
95–980x5f–0x62Module serial numberVendor-specific code
99–1270x63–0x7fManufacturer-specific dataCould be enhanced performance profile

DDR2 SDRAM

The DDR2 SPD standard makes a number of changes, but is roughly similar to the above. One notable deletion is the confusing and little-used support for DIMMs with two ranks of different sizes.

For cycle time fields (bytes 9, 23, 25 and 49), which are encoded in BCD, some additional encodings are defined for the tenths digit to represent some common timings exactly:

DDR2 BCD extensions
HexBinarySignificance
A10100.25 (¼)
B10110.33 (⅓)
C11000.66 (⅔)
D11010.75 (¾)
E11100.875 (⅞, Nvidia XMP extension)
F1111Reserved
SPD contents for DDR2 SDRAM[7]
Byte Bit Notes
DecHex76543210
00x00Number of bytes writtenTypically 128
10x01log2(size of SPD EEPROM)Typically 8 (256 bytes)
20x02Basic memory type (8 = DDR2 SDRAM)
30x03ReservedRow address bits (1–15)
40x04ReservedColumn address bits (1–15)
50x05Vertical heightStack?ConC?Ranks−1 (1–8)Commonly 0 or 1, meaning 1 or 2
60x06Module data widthCommonly 64, or 72 for ECC DIMMs
70x07Reserved
80x08Interface voltage level of this assembly (not the same as Vcc supply voltage) (0–5)Decoded by table lookup.
Commonly 5 = SSTL 1.8 V
90x09Nanoseconds (0–15)Tenths of nanoseconds (0.0–0.9)Clock cycle time at highest CAS latency.
100x0aTenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)SDRAM access time from clock (tAC)
110x0bDIMM configuration type (0–2): non-ECC, parity, ECCTable lookup
120x0cSelfRefresh period (0–5): 64, 256, 128, 32, 16, 8 kHzRefresh requirements
130x0dPrimary SDRAM width (1–255)Commonly 8 (module built from ×8 parts) or 16
140x0eECC SDRAM width (0–255)Width of bank ECC/parity SDRAM devices. Commonly 0 or 8.
150x0fReserved
160x10————84——Burst lengths supported (bitmap)
170x11Banks per SDRAM device (1–255)Typically 4 or 8
180x12765432——CAS latencies supported (bitmap)
190x13Reserved
200x14——Mini-UDIMMMini-RDIMMMicro-DIMMSO-DIMMUDIMMRDIMMDIMM type of this assembly (bitmap)
210x15—Module is analysis probe—FET switch external enable————Memory module feature bitmap
220x16———————Includes weak driverMemory chip feature bitmap
230x17Nanoseconds (0–15)Tenths of nanoseconds (0.0–0.9)Clock cycle time at medium CAS latency.
240x18Tenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)Data access time from clock (tAC)
250x19Nanoseconds (0–15)Tenths of nanoseconds (0.0–0.9)Clock cycle time at short CAS latency.
260x1aTenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)Data access time from clock (tAC)
270x1bNanoseconds (1–63)1/4 ns (0–0.75)Minimum row precharge time (tRP)
280x1cNanoseconds (1–63)1/4 ns (0–0.75)Minimum row active–row active delay (tRRD)
290x1dNanoseconds (1–63)1/4 ns (0–0.75)Minimum RAS to CAS delay (tRCD)
300x1eNanoseconds (1–255)Minimum active to precharge time (tRAS)
310x1f512 MiB256 MiB128 MiB16 GiB8 GiB4 GiB2 GiB1 GiBSize of each rank (bitmap).
320x20Tenths of nanoseconds (0.0–1.2)Hundredths of nanoseconds (0.00–0.09)Address/command setup time from clock
330x21Tenths of nanoseconds (0.0–1.2)Hundredths of nanoseconds (0.00–0.09)Address/command hold time after clock
340x22Tenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)Data input setup time from strobe
350x23Tenths of nanoseconds (0.0–0.9)Hundredths of nanoseconds (0.00–0.09)Data input hold time after strobe
360x24Nanoseconds (1–63)0.25 ns (0–0.75)Minimum write recovery time (tWR)
370x25Nanoseconds (1–63)0.25 ns (0–0.75)Internal write to read command delay (tWTR)
380x26Nanoseconds (1–63)0.25 ns (0–0.75)Internal read to precharge command delay (tRTP)
390x27ReservedReserved for "memory analysis probe characteristics"
400x28—tRC fractional ns (0–5):
0, 0.25, 0.33, 0.5, 0.66, 0.75		tRFC fractional ns (0–5):
0, 0.25, 0.33, 0.5, 0.66, 0.75		tRFC + 256 nsExtension of bytes 41 and 42.
410x29Nanoseconds (1–255)Minimum active to active/refresh time (tRC)
420x2aNanoseconds (1–255)Minimum refresh to active/refresh time (tRFC)
430x2bNanoseconds (0–15)Tenths of nanoseconds (0.0–0.9)Maximum clock cycle time (tCK max)
440x2cHundredths of nanoseconds (0.01–2.55)Maximum skew, DQS to any DQ. (tDQSQ max)
450x2dHundredths of nanoseconds (0.01–2.55)Read data hold skew factor (tQHS)
460x2eMicroseconds (1–255)PLL relock time
47–610x2f–0x3dReservedFor future standardization.
620x3eMajor revision (0–9)Minor revision (0.0–0.9)SPD revision level, usually 1.0
630x3fChecksumSum of bytes 0–62, not negated
64–710x40–47Manufacturer JEDEC IDStored little-endian, trailing zero-pad
720x48Module manufacturing locationVendor-specific code
73–900x49–0x5aModule part numberASCII, space-padded (limited to (,-,), A–Z, a–z, 0–9, space)
91–920x5b–0x5cModule revision codeVendor-specific code
930x5dYears since 2000 (0–255)Manufacturing date (YYWW)
940x5eWeeks (1–52)
95–980x5f–0x62Module serial numberVendor-specific code
99–1270x63–0x7fManufacturer-specific dataCould be enhanced performance profile

DDR3 SDRAM

The DDR3 SDRAM standard significantly overhauls and simplifies the SPD contents layout. Instead of a number of BCD-encoded nanosecond fields, some "timebase" units are specified to high precision, and various timing parameters are encoded as multiples of that base unit.[8] Further, the practice of specifying different time values depending on the CAS latency has been dropped; now there are just a single set of timing parameters.

Revision 1.1 lets some parameters be expressed as a "medium time base" value plus a (signed, −128 +127) "fine time base" correction. Generally, the medium time base is 1/8 ns (125 ps), and the fine time base is 1, 2.5 or 5 ps. For compatibility with earlier versions that lack the correction, the medium time base number is usually rounded up and the correction is negative. Values that work this way are:

DDR3 SPD two-part timing parameters
MTB byteFTB byteValue
1234tCKmin, minimum clock period
1635tAAmin, minimum CAS latency time
1836tRCDmin, minimum RAS# to CAS# delay
2037tRPmin, minimum row precharge delay
21, 2338tRCmin, minimum active to active/precharge delay
SPD contents for DDR3 SDRAM[9][10]
Byte Bit Notes
DecHex76543210
00x00Exclude serial from CRCSPD bytes total (undef/256)SPD bytes used (undef/128/176/256)
10x01SPD major revisionSPD minor revision1.0, 1.1, 1.2 or 1.3
20x02Basic memory type (11 = DDR3 SDRAM)Type of RAM chips
30x03ReservedModule typeType of module; e.g., 2 = Unbuffered DIMM, 3 = SO-DIMM, 11=LRDIMM
40x04—Bank address bits−3log2(bits per chip)−28Zero means 8 banks, 256 Mibit.
50x05—Row address bits−12Column address bits−9
60x06Reserved1.25 V1.35 VNot 1.5 VModules voltages supported. 1.5 V is default.
70x07—ranks−1log2(I/O bits/chip)−2Module organization
80x08—ECC bits (001=8)log2(data bits)−30x03 for 64-bit, non-ECC DIMM.
90x09Dividend, picoseconds (1–15)Divisor, picoseconds (1–15)Fine Time Base, dividend/divisor
100x0aDividend, nanoseconds (1–255)Medium Time Base, dividend/divisor; commonly 1/8
110x0bDivisor, nanoseconds (1–255)
120x0cMinimum cycle time tCKminIn multiples of MTB
130x0dReserved
140x0e1110987654CAS latencies supported (bitmap)
150x0f—18171615141312
160x10Minimum CAS latency time, tAAminIn multiples of MTB; e.g., 80/8 ns.
170x11Minimum write recovery time, tWRminIn multiples of MTB; e.g., 120/8 ns.
180x12Minimum RAS to CAS delay time, tRCDminIn multiples of MTB; e.g., 100/8 ns.
190x13Minimum row to row active delay time, tRRDminIn multiples of MTB; e.g., 60/8 ns.
200x14Minimum row precharge time, tRPminIn multiples of MTB; e.g., 100/8 ns.
210x15tRCmin, bits 11:8tRASmin, bits 11:8Upper 4 bits of bytes 23 and 22
220x16Minimum active to time, tRASmin, bits 7:0In multiples of MTB; e.g., 280/8 ns.
230x17Minimum active to active/refresh, tRCmin, bits 7:0In multiples of MTB; e.g., 396/8 ns.
240x18Minimum refresh recovery delay, tRFCmin, bits 7:0In multiples of MTB; e.g., 1280/8 ns.
250x19Minimum refresh recovery delay, tRFCmin, bits 15:8
260x1aMinimum internal write to read delay, tWTRminIn multiples of MTB; e.g., 60/8 ns.
270x1bMinimum internal read to precharge delay, tRTPminIn multiples of MTB; e.g., 60/8 ns.
280x1cReservedtFAWmin, bits 11:8In multiples of MTB; e.g., 240/8 ns.
290x1dMinimum four activate window delay tFAWmin, bits 7:0
300x1eDLL-off—RZQ/7RZQ/6SDRAM optional features support bitmap
310x1fPASR—ODTSASRETR 1×ETR (95 °C)SDRAM thermal and refresh options
320x20PresentAccuracy (TBD; currently 0 = undefined)DIMM thermal sensor present?
330x21Nonstd.Die count—Signal loadNonstandard SDRAM device type (e.g., stacked die)
340x22tCKmin correction (new for 1.1)Signed multiple of FTB, added to byte 12
350x23tAAmin correction (new for 1.1)Signed multiple of FTB, added to byte 16
360x24tRCDmin correction (new for 1.1)Signed multiple of FTB, added to byte 18
370x25tRPmin correction (new for 1.1)Signed multiple of FTB, added to byte 20
380x26tRCmin correction (new for 1.1)Signed multiple of FTB, added to byte 23
39–400x27–0x28ReservedFor future standardization.
410x29Vendor specifictMAWMaximum Activate Count (MAC) (untested/700k/600k/.../200k/reserved/∞)For row hammer mitigation
42–590x2a–0x3bReservedFor future standardization.
600x3c—Module height, mm (1–31, >45)Module nominal height
610x3dBack thickness, mm (1–16)Front thickness, mm (1–16)Module thickness, value = ceil(mm) − 1
620x3eDesignRevisionJEDEC design numberJEDEC reference design used (11111=none)
63–1160x3f–0x74Module-specific sectionDiffers between registered/unbuffered
1170x75Module manufacturer ID, lsbyteAssigned by JEP-106
1180x76Module manufacturer ID, msbyte
1190x77Module manufacturing locationVendor-specific code
1200x78Tens of yearsYearsManufacturing year (BCD)
1210x79Tens of weeksWeeksManufacturing week (BCD)
122–1250x7a–0x7dModule serial numberVendor-specific code
126–1270x7e–0x7fSPD CRC-16Includes bytes 0–116 or 0–125; see byte 0 bit 7
128–1450x80–0x91Module part numberASCII subset, space-padded
146–1470x92–0x93Module revision codeVendor-defined
148–1490x94–0x95DRAM manufacturer IDAs distinct from module manufacturer
150–1750x96–0xAFManufacturer-specific data
176–2550xB0–0xFFAvailable for customer use

The memory capacity of a module can be computed from bytes 4, 7 and 8. The module width (byte 8) divided by the number of bits per chip (byte 7) gives the number of chips per rank. That can then be multiplied by the per-chip capacity (byte 4) and the number of ranks of chips on the module (usually 1 or 2, from byte 7).

DDR4 SDRAM

The DDR4 SDRAM "Annex L" standard for SPD changes the EEPROM module used. Instead of the old AT24C02-compatible 256-byte EEPROMs, JEDEC now defines a new nonstandard EE1004 type with two pages at the SMBus level each with 256 bytes. The new memory still uses the old 0x50–0x57 addresses, but two additional address at 0x36 (SPA0) and 0x37 (SPA1) are now used to receive commands to select the currently-active page for the bus, a form of bank switching.[11] Internally each logical page is further divided into two physical blocks of 128 bytes each, totaling four blocks and 512 bytes.[12] Other semantics for "special" address ranges remain the same, although write protection is now addressed by blocks and a high voltage at SA0 is now required to change its status.[13]

Annex L defines a few different layouts that can be plugged into a 512-byte (of which a maximum of 320 bytes are defined) template, depending on the type of the memory module. The bit definitions are similar to DDR3.[12]

SPD contents for DDR4 SDRAM[14]
Byte Bit Notes
DecHex76543210
00x00SPD bytes used
10x01SPD revision nTypically 0x10, 0x11, 0x12
20x02Basic memory type (12 = DDR4 SDRAM)Type of RAM chips
30x03ReservedModule typeType of module; e.g., 2 = Unbuffered DIMM, 3 = SO-DIMM, 11=LRDIMM
40x04Bank group bitsBank address bits−2Total SDRAM capacity per die in MbZero means no bank groups, 4 banks, 256 Mibit.
50x05ReservedRow address bits−12Column address bits−9
60x06Primary SDRAM package typeDie countReservedSignal loading
70x07ReservedMaximum activate window (tMAW)Maximum activate count (MAC)SDRAM optional features
80x08ReservedSDRAM thermal and refresh options
90x09Post package repair (PPR)Soft PPRReservedOther SDRAM optional features
100x0aSDRAM package typeDie count−1DRAM density ratioSignal loadingSecondary SDRAM package type
110x0bReservedEndurant flagOperable flagModule nominal voltage, VDD
120x0cReservedRank mixPackage ranks per DIMM−1SDRAM device widthModule organization
130x0dReservedBus width extensionPrimary bus widthModule memory bus width in bits
140x0eThermal sensorReservedModule thermal sensor
150x0fReservedExtended base module type
160x10Reserved
170x11ReservedMedium timebase (MTB)Fine timebase (FTB)Measured in ps.
180x12Minimum SDRAM cycle time, tCKAVGminIn multiples of MTB; e.g., 100/8 ns.
190x13Maximum SDRAM cycle time, tCKAVGmaxIn multiples of MTB; e.g., 60/8 ns.
200x141413121110987CAS latencies supported bit-mask
210x152221201918171615CAS latencies supported bit-mask
220x163029282726252423CAS latencies supported bit-mask
230x17Low CL rangeReserved363534333231CAS latencies supported bit-mask
240x18Minimum CAS latency time, tAAminIn multiples of MTB; e.g., 1280/8 ns.
250x19Minimum RAS to CAS delay time, tRFCminIn multiples of MTB; e.g., 60/8 ns.
260x1aMinimum row precharge delay time, tRPminIn multiples of MTB; e.g., 60/8 ns.
270x1bUpper nibbles for tRASmin and tRCmin
280x1cMinimum active to precharge delay time, tRASmin least significant byteIn multiples of MTB
290x1dMinimum active to active/refresh delay time, tRCmin least significant byteIn multiples of MTB
300x1eMinimum refresh recovery delay time, tRFC1min least significant byteIn multiples of MTB
310x1fMinimum refresh recovery delay time, tRFC1min most significant byteIn multiples of MTB
320x20Minimum refresh recovery delay time, tRFC2min least significant byteIn multiples of MTB
330x21Minimum refresh recovery delay time, tRFC2min most significant byteIn multiples of MTB
340x22Minimum refresh recovery delay time, tRFC4min least significant byteIn multiples of MTB
350x23Minimum refresh recovery delay time, tRFC4min most significant byteIn multiples of MTB
360x24ReservedtFAWmin most significant nibble
370x25Minimum four activate window delay time, tFAWmin least significant byteIn multiples of MTB
380x26Minimum activate to activate delay time, tRRD_Smin, different bank groupIn multiples of MTB
390x27Minimum activate to activate delay time, tRRD_Smin, same bank groupIn multiples of MTB
400x28Minimum CAS to CAS delay time, tCCD_Lmin, same bank groupIn multiples of MTB
410x29Upper nibble for tWRmin
420x2aMinimum write recovery time, tWRminIn multiples of MTB
430x2bUpper nibbles for tWTRmin
440x2cMinimum write to read time, tWTR_Smin, different bank groupIn multiples of MTB
450x2dMinimum write to read time, tWTR_Lmin, same bank groupIn multiples of MTB
49–590x2e–0x3bReservedBase configuration section
60–770x3c–0x4dConnector to SDRAM bit mapping
78–1160x4e–0x74ReservedBase configuration section
1170x75Fine offset for minimum CAS to CAS delay time, tCCD_Lmin, same bankTwo's complement multiplier for FTB units
1180x76Fine offset for minimum activate to activate delay time, tRRD_Lmin, same bank groupTwo's complement multiplier for FTB units
1190x77Fine offset for minimum activate to activate delay time, tRRD_Smin, different bank groupTwo's complement multiplier for FTB units
1200x78Fine offset for minimum active to active/refresh delay time, tRCminTwo's complement multiplier for FTB units
1210x79Fine offset for minimum row precharge delay time, tRPminTwo's complement multiplier for FTB units
1220x7aFine offset for minimum RAS to CAS delay time, tRCDminTwo's complement multiplier for FTB units
1230x7bFine offset for minimum CAS latency time, tAAminTwo's complement multiplier for FTB units
1240x7cFine offset for SDRAM maximum cycle time, tCKAVGmaxTwo's complement multiplier for FTB units
1250x7dFine offset for SDRAM minimum cycle time, tCKAVGminTwo's complement multiplier for FTB units
1260x7eCyclic rendundancy code (CRC) for base config section, least significant byteCRC16 algorithm
1270x7fCyclic rendundancy code (CRC) for base config section, most significant byteCRC16 algorithm
128–1910x80–0xbfModule-specific sectionDependent upon memory module family (UDIMM, RDIMM, LRDIMM)
192–2550xc0–0xffHybrid memory architecture specific parameters
256–3190x100–0x13fExtended function parameter block
320–3210x140–0x141Module manufacturerSee JEP-106
3220x142Module manufacturing locationManufacturer-defined manufacturing location code
3230x143Module manufacturing yearRepresented in Binary Coded Decimal (BCD)
3240x144Module manufacturing weekRepresented in Binary Coded Decimal (BCD)
325–3280x145–0x148Module serial numberManufacturer-defined format for a unique serial number across part numbers
329–3480x149–0x15cModule part numberASCII part number, unused digits should be set to 0x20
3490x15dModule revision codeManufacturer-defined revision code
350–3510x15e–0x15fDRAM manufacturer ID codeSee JEP-106
3520x160DRAM steppingManufacturer-defined stepping or 0xFF if not used
353–3810x161–0x17dManufacturer's specific data
382–3830x17e–0x17fReserved

Extensions

The JEDEC standard only specifies some of the SPD bytes. The truly critical data fits into the first 64 bytes,[6][7][15][16][17] while some of the remainder is earmarked for manufacturer identification. However, a 256-byte EEPROM is generally provided. A number of uses have been made of the remaining space.

Enhanced Performance Profiles (EPP)

Memory generally comes with conservative timing recommendations in the SPD ROM, to ensure basic functionality on all systems. Enthusiasts often spend considerable time manually adjusting the memory timings for higher speed.

Enhanced Performance Profiles is an extension of SPD, developed by Nvidia and Corsair, which includes additional information for higher-performance operation of DDR2 SDRAM, including supply voltages and command timing information not included in the JEDEC SPD spec. The EPP information is stored in the same EEPROM, but in bytes 99–127, which are unused by standard DDR2 SPD.[18]

EPP SPD ROM usage
BytesSizeFull profilesAbbreviated profiles
99–1035EPP header
104–1096Profile FP1Profile AP1
110–1156Profile AP2
116–1216Profile FP2Profile AP3
122–1276Profile AP4

The parameters are particularly designed to fit the memory controller on the nForce 5, nForce 6 and nForce 7 chipsets. Nvidia encourages support for EPP in the BIOS for its high-end motherboard chipsets. This is intended to provide "one-click overclocking" to get better performance with minimal effort.

Nvidia's name for EPP memory that has been qualified for performance and stability is "SLI-ready memory".[19] The term "SLI-ready-memory" has caused some confusion, as it has nothing to do with SLI video. One can use EPP/SLI memory with a single video card (even a non-Nvidia card), and one can run a multi-card SLI video setup without EPP/SLI memory.

An extended version, EPP 2.0, supports DDR3 memory as well.[20]

Extreme Memory Profile (XMP)

A similar, Intel-developed JEDEC SPD extension was developed for DDR3 SDRAM DIMMs, later used in DDR4 also. XMP uses bytes 176–255, which are unallocated by JEDEC, to encode higher-performance memory timings.[21]

Later, AMD developed AMP, an equivalent technology to XMP, for use in its "Radeon Memory" line of memory modules optimized for use in AMD platforms.[22][23] Furthermore, motherboard developers implemented their own technologies to allow their AMD-based motherboards to read XMP profiles: MSI offers A-XMP,[24] ASUS has DOCP (Direct Over Clock Profile), and Gigabyte has EOCP (Extended Over Clock Profile).[25]

XMP SPD ROM usage[26]
DDR3 BytesSizeUse
176–18410XMP header
185–21933XMP profile 1 ("enthusiast" settings)
220–25436XMP profile 2 ("extreme" settings)

The header contains the following data. Most importantly, it contains a "medium timebase" value MTB, as a rational number of nanoseconds (common values are 1/8, 1/12 and 1/16 ns). Many other later timing values are expressed as an integer number of MTB units.

Also included in the header is the number of DIMMs per memory channel that the profile is designed to support; including more DIMMs may not work well.

XMP Header bytes[26]
DDR3 ByteBitsUse
1767:0XMP magic number byte 1 0x0C
1777:0XMP magic number byte 2 0x4A
1780Profile 1 enabled (if 0, disabled)
1Profile 2 enabled
3:2Profile 1 DIMMs per channel (1–4 encoded as 0–3)
5:4Profile 2 DIMMs per channel
7:6Reserved
1793:0XMP minor version number (x.0 or x.1)
7:4XMP major version number (0.x or 1.x)
1807:0Medium timebase dividend for profile 1
1817:0Medium timebase divisor for profile 1 (MTB = dividend/divisor ns)
1827:0Medium timebase dividend for profile 2 (e.g. 8)
1837:0Medium timebase divisor for profile 2 (e.g. 1, giving MTB = 1/8 ns)
1847:0Reserved
XMP profile bytes[26]
DDR3 Byte 1DDR3 Byte 2BitsUse
1852200Module Vdd voltage twentieths (0.00 or 0.05)
4:1Module Vdd voltage tenths (0.0–0.9)
6:5Module Vdd voltage units (0–2)
7Reserved
1862217:0Minimum SDRAM clock period tCKmin (MTB units)
1872227:0Minimum CAS latency time tAAmin (MTB units)
1882237:0CAS latencies supported (bitmap, 4–11 encoded as bits 0–7)
1892246:0CAS latencies supported (bitmap, 12–18 encoded as bits 0–6)
7Reserved
1902257:0Minimum CAS write latency time tCWLmin (MTB units)
1912267:0Minimum row precharge delay time tRPmin (MTB units)
1922277:0Minimum RAS to CAS delay time tRCDmin (MTB units)
1932287:0Minimum write recovery time tWRmin (MTB units)
1942293:0tRASmin upper nibble (bits 11:8)
7:4tRCmin upper nibble (bits 11:8)
1952307:0Minimum active to precharge delay time tRASmin bits 7:0 (MTB units)
1962317:0Minimum active to active/refresh delay time tRCmin bits 7:0 (MTB units)
1972327:0Maximum average refresh interval tREFI lsbyte (MTB units)
1982337:0Maximum average refresh interval tREFI msbyte (MTB units)
1992347:0Minimum refresh recovery delay time tRFCmin lsbyte (MTB units)
2002357:0Minimum refresh recovery delay time tRFCmin msbyte (MTB units)
2012367:0Minimum internal read to precharge command delay time tRTPmin (MTB units)
2022377:0Minimum row active to row active delay time tRRDmin (MTB units)
2032383:0tFAWmin upper nibble (bits 11:8)
7:4Reserved
2042397:0Minimum four activate window delay time tFAWmin bits 7:0 (MTB units)
2052407:0Minimum internal write to read command delay time tWTRmin (MTB units)
2062412:0Write to read command turnaround time adjustment (0–7 clock cycles)
3Write to read command turnaround adjustment sign (0=pull-in, 1=push-out)
6:4Read to write command turnaround time adjustment (0–7 clock cycles)
7Read to write command turnaround adjustment sign (0=pull-in, 1=push-out)
2072422:0Back-to-back command turnaround time adjustment (0–7 clock cycles)
3Back-to-back turnaround adjustment sign (0=pull-in, 1=push-out)
7:4Reserved
2082437:0System CMD rate mode. 0=JTAG default, otherwise in peculiar units of MTB × tCK/ns.
E.g. if MTB is 1/8 ns, then this is in units of 1/8 clock cycle.
2092447:0SDRAM auto self refresh performance.
Standard version 1.1 says documentation is TBD.
210–218245–2537:0Reserved
2192547:0Reserved, vendor-specific personality code.

All data above are for DDR3 (XMP 1.1); DDR4 specs are not yet available.

Vendor-specific memory

A common misuse is to write information to certain memory regions to bind vendor-specific memory modules to a specific system. Fujitsu Technology Solutions is known to do this. Adding different memory module to the system usually results in a refusal or other counter-measures (like pressing F1 on every boot).

02 0E 00 01-00 00 00 EF-02 03 19 4D-BC 47 C3 46 ...........M.G.F
53 43 00 04-EF 4F 8D 1F-00 01 70 00-01 03 C1 CF SC...O....p.....

This is the output of a 512 MB memory module from Micron Technologies, branded for Fujitsu-Siemens Computers, note the "FSC" string. The system BIOS rejects memory modules that don't have this information starting at offset 128h.

Some Packard Bell AMD laptops also use this method, in this case the symptoms can vary but it can lead to a flashing cursor rather than a beep pattern. Incidentally this can also be a symptom of BIOS corruption as well.[27] Though upgrading a 2GB to a 4GB can also lead to issues.

Reading and writing SPD information

Memory module manufacturers write the SPD information to the EEPROM on the module. Motherboard BIOSes read the SPD information to configure the memory controller. There exist several programs that are able to read and modify SPD information on most, but not all motherboard chipsets.

  • dmidecode program that can decode information about memory (and other things) and runs on Linux, FreeBSD, NetBSD, OpenBSD, BeOS, Cygwin and Solaris. dmidecode does not access SPD information directly; it reports the SMBIOS data about the memory.[28] This information may be limited or incorrect.
  • On Linux systems and FreeBSD, the user space program decode-dimms provided by i2c-tools decodes and prints information on any memory with SPD information in the computer.[29][30] It requires SMBus controller support in the kernel, the EEPROM kernel driver, and also that the SPD EEPROMs are connected to the SMBus. On older Linux distributions, decode-dimms.pl was available as part of lm_sensors.
  • OpenBSD has included a driver (spdmem(4)) since version 4.3 to provide information about memory modules. The driver was ported from NetBSD, where it is available since release 5.0.
  • Coreboot reads and uses SPD information to initialize all memory controllers in a computer with timing, size and other properties.
  • Windows systems use programs like HWiNFO,[31] CPU-Z and Speccy, which can read and display DRAM module information from SPD.

Chipset-independent reading and writing of SPD information is done by accessing the memory's EEPROM directly with eeprom programmer hardware and software.

A not so common use for old laptops is as generic SMBus readers, as the internal EEPROM on the module can be disabled once the BIOS has read it so the bus is essentially available for use. The method used is to pull low the A0,A1 lines so the internal memory shuts down, allowing the external device to access the SMBus. Once this is done, a custom Linux build or DOS application can then access the external device. A common use is recovering data from LCD panel memory chips to retrofit a generic panel into a proprietary laptop. On some chips it is also a good idea to separate write protect lines so that the onboard chips do not get wiped during reprogramming. A related technique is rewriting the chip on webcams often included with many laptops as the bus speed is substantially higher and can even be modified so that 25x compatible chips can be read back for later cloning of the uEFI in the event of a chip failure.

This unfortunately only works on DDR3 and below, as DDR4 uses different security and can usually only be read. Its possible to use a tool like SPDTool or similar and replace the chip with one that has its WP line free so it can be altered in situ. On some chipsets the message "Incompatible SMBus driver?" may be seen so read is also prevented.

RGB LED control

Some memory modules (especially on Gaming PCs)[32] support RGB LEDs that are controlled by proprietary SMBus commands. This allows LED color control without additional connectors and cables. Kernel drivers from multiple manufacturers required to control the lights have been exploited to gain access ranging from full kernel memory access, to MSR and I/O port control numerous times in 2020 alone.[33][34][35]

On older equipment

Some older equipment require the use of SIMMs with parallel presence detect (more commonly called simply presence detect or PD). Some of this equipment uses non-standard PD coding, IBM computers and Hewlett-Packard LaserJet and other printers in particular.

See also
  • Transducer electronic data sheet

References
  1. Thomas P. Koenig; Nathan John (3 February 1997), "Serial Presence Detection poised for limelight", Electronic News, 43 (2153)
  2. JEDEC Standard 21-C section 4.1.4 "Definition of the TSE2002av Serial Presence Detect (SPD) EEPROM with Temperature Sensor (TS) for Memory Module Applications"
  3. "TN-04-42: Memory Module Serial Presence-Detect Write Protection" (PDF). Micron.
  4. Application note INN-8668-APN3: SDRAM SPD Data Standards, memorytesters.com
  5. PC SDRAM Serial Presence Detect (SPD) Specification (PDF), 1.2A, December 1997, p. 28
  6. JEDEC Standard 21-C section 4.1.2.4 "SPDs for DDR SDRAM"
  7. JEDEC Standard 21-C section 4.1.2.10 "Specific SPDs for DDR2 SDRAM"
  8. "Understanding DDR3 Serial Presence Detect (SPD) Table".
  9. JESD21-C Annex K: Serial Presence Detect for DDR3 SDRAM Modules, Release 4, SPD Revision 1.1
  10. JESD21-C Annex K: Serial Presence Detect for DDR3 SDRAM Modules, Release 6, SPD Revision 1.3
  11. Delvare, Jean. "[PATCH] eeprom: New ee1004 driver for DDR4 memory". LKML. Retrieved 7 November 2019.
  12. JEDEC. "Annex L: Serial Presence Detect (SPD) for DDR4 SDRAM Modules" (PDF).
  13. JEDEC. "EE1004 and TSE2004 Device Specification (Draft)" (PDF). Retrieved 7 November 2019.
  14. JESD21-C Annex L: Serial Presence Detect for DDR4 SDRAM Modules, Release 5
  15. JEDEC Standard 21-C section 4.1.2.11 "Serial Presence Detect (SPD) for DDR3 SDRAM Modules"
  16. JEDEC Standard 21-C section 4.1.2 "SERIAL PRESENCE DETECT STANDARD, General Standard"
  17. JEDEC Standard 21-C section 4.1.2.5 "Specific PDs for Synchronous DRAM (SDRAM)"
  18. DDR2 UDIMM Enhanced Performance Profiles Design Specification (PDF), Nvidia, 12 May 2006, retrieved 5 May 2009
  19. http://www.nvidia.com/docs/CP/45121/sli_memory.pdf
  20. Enhanced Performance Profiles 2.0 (pp. 2–3)
  21. "Intel Support". Intel.
  22. Advanced Micro Devices, Inc (2012). "Memory Profile Technology - AMP up your RAM". Retrieved 8 January 2018.
  23. Ryan Martin (23 July 2012). "AMD introduces its XMP-equivalent AMP - eTeknix". Retrieved 8 January 2018.
  24. Micro-Star Int'l Co., Ltd (21 March 2017). "MSI is worlds first brand to enable A-XMP on Ryzen for best DDR4 performance, launches new models". Retrieved 8 January 2018.
  25. Tradesman1 (26 August 2016). "What does XMP, DOCP, EOCP mean - Solved - Memory". Retrieved 8 January 2018.
  26. Intel Extreme Memory Profile (XMP) Specification, Rev 1.1 (PDF), October 2007, archived from the original (PDF) on 6 March 2012, retrieved 25 May 2010
  27. "Packard Bell LJ65 RAM upgrade". Tom's Hardware Forum.
  28. "dmidecode: What's it good for?". Linux.com | The source for Linux information. 29 November 2004.
  29. "decode-dimms(1)". Debian Manpage. Retrieved 16 December 2020.
  30. "decode-dimms". www.freebsd.org. Retrieved 24 January 2021.
  31. "HWiNFO - Professional System Information and Diagnostics". HWiNFO.
  32. "VENGEANCE RGB PRO series DDR4 memory | Desktop Memory | CORSAIR". www.corsair.com. Retrieved 26 November 2020.
  33. ActiveCyber. Viper RGB Driver Local Privilege Escalation (Technical report). CVE-2019-18845 – via MITRE Corporation.
  34. ActiveCyber. CORSAIR iCUE Driver Local Privilege Escalation (CVE-2020-8808) (Technical report). CVE-2020-8808 – via MITRE Corporation.
  35. ActiveCyber. ACTIVE-2020-003: Trident Z Lighting Control Driver Local Privilege Escalation (Technical report). CVE-2020-12446 – via MITRE Corporation.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.