DDR3 modules' SPD data can report rowhammer mitigations/testing
991 views
Skip to first unread message
Mark Seaborn
Aug 14, 2015, 10:36:16 PM8/14/15
to rowhammer-discuss
Earlier this year, I learned that the SPD data [1] for DDR3 DIMMs includes fields which indicate whether the DRAM is meant to be rowhammer-free or whether the DRAM requires special handling.
The fields are:
- MAC (Maximum Activate Count): the maximum number of activations that are safe for a row.
- tMAW (Maximum Activate Window)
These fields in the SPD data are publicly documented by JEDEC in the following spec:
"SPD Annex K - Serial Presence Detect (SPD) for DDR3 SDRAM Modules (Release 6)"
"Release No. 24. Item 2065.47A"
Feb 2014(Note that registration is required to download specs from the JEDEC site, but it's free. There also happens to be a copy of this spec here, which doesn't require a JEDEC registration: http://dev.xdevs.com/projects/rpi/repository/raw/doc/4_01_02_11R24.pdf)
In particular, see "Byte 41: SDRAM Maximum Active Count (MAC) Value".
This MAC parameter appears to have the same meaning as the MAC parameter described by the LPDDR4 specification [2]. (However, LPDDR4 does not have a tMAW parameter.)
It is not clear how these SPD fields relate to support for pTRR (Pseudo TRR) in DDR3. There does not seem to be any public documentation explaining how pTRR works.
However, they do appear to be related. Searching for "pTRR" turns up the following documentation from DRAM manufacturers, which indicates how these SPD fields should be populated for these specific DRAM devices:
- https://skhynix.com/inc/pdfDownload.jsp?path=/datasheet/spd/HMT325V7EFR8C_SPD_IDT(Rev1.0).pdf
Title: "HMT325V7EFR8C-H9/PB/RD", "Serial Presence Detect"
Byte: 41
Function described: pTRR Support(pTRR, Max Active Window, Max Active Count)
Function support: pTRR, MAW 64ms, MAC 400K
HEX: 84 - https://www.micron.com/products/spd-details?mp=%7B1107DC72-DB32-4319-8C08-957217025F45%7D&ds=%7B6B3EB792-69B1-4E57-8826-8BBCBFD48E0C%7D
Title: "SPD details"
Byte number: 41
Byte description: DDR3-PTRR TMAW MAC
Byte value: 85
This value of 0x85 decodes to MAW=64ms, MAC=300K.
The spreadsheet linked from that page indicates that this is for part "MT9JSF25672PZ 1G6K1".
That page is linked from here:
https://www.micron.com/parts/modules/ddr3-sdram/mt9jsf25672pz-1g6?pc=%7BDCF74082-CBEE-454A-9BB8-D4CF05A3DE7C%7D
Note that both of these values, 0x84 and 0x85, have bit 7 set, but the SPD docs say that bits 6 and 7 are "Vendor Specific" -- "Contact DRAM supplier for guidance in coding or interpreting these bits".
In contrast, the following documentation for SPD data does not cover byte 41:
It just lists bytes 39-59 as "Reserved, General Section", with hex value 0.
Since these bytes are zero, byte 0x41 would decode to the default, "Untested MAC".
That PDF is dated "Mar, 26, 2012" by the page that links to it: http://www.samsung.com/global/business/semiconductor/product/computing-dram/detail?iaId=692&productId=7426
Cheers,
Mark
[1] For background on SPD data, see: https://en.wikipedia.org/wiki/Serial_presence_detect
[2] The LPDDR4 specification: http://www.jedec.org/standards-documents/results/jesd209-4
Mark Seaborn
Aug 20, 2015, 2:31:24 PM8/20/15
to rowhammer-discuss
On 14 August 2015 at 19:35, Mark Seaborn <msea...@chromium.org> wrote:
This MAC parameter appears to have the same meaning as the MAC parameter described by the LPDDR4 specification [2]. (However, LPDDR4 does not have a tMAW parameter.)It is not clear how these SPD fields relate to support for pTRR (Pseudo TRR) in DDR3. There does not seem to be any public documentation explaining how pTRR works.However, they do appear to be related. Searching for "pTRR" turns up the following documentation from DRAM manufacturers, which indicates how these SPD fields should be populated for these specific DRAM devices:
- https://skhynix.com/inc/pdfDownload.jsp?path=/datasheet/spd/HMT325V7EFR8C_SPD_IDT(Rev1.0).pdf
Title: "HMT325V7EFR8C-H9/PB/RD", "Serial Presence Detect"
Byte: 41
Function described: pTRR Support(pTRR, Max Active Window, Max Active Count)
Function support: pTRR, MAW 64ms, MAC 400K
HEX: 84
I did some further investigation of the MAC values that Hynix report in the SPD data sheets for their DRAM.
The PDF I linked above is just one example. Doing a Google search for "site:skhynix.com spd" turns up a lot more PDF files describing the SPD data for different DRAM modules.
I downloaded all the PDFs I found that way. Here is a table of the resulting PDFs, with the MAC values they report (if any):
| Part number/PDF | DRAM type | MAC value | Module type |
| HMA41GS6AFR8N_SPD.pdf | DDR4 | Unlimited | 260 pin SO-DIMM |
| HMA42GR7MFR4N_SPD_IDT(Rev1.0).pdf | DDR4 | Unlimited | 288 pin Registered DIMM |
| HMA82GR7MFR4N_SPD_IDT(Rev0.2).pdf | DDR4 | Unlimited | 288 pin Registered DIMM |
| HMA84GL7MFR4N_SPD_IDT.pdf | DDR4 | Unlimited | 288 pin LRDIMM |
| HMA84GL7MFR4N_SPD_Montage.pdf | DDR4 | Unlimited | 288 pin LRDIMM |
| HMA84GR7MFR4N_SPD_IDT(Rev0.2).pdf | DDR4 | Unlimited | 288 pin Registered DIMM |
| HMAA8GL7MMR4N_SPD_IDT.pdf | DDR4 | Unlimited | 288 pin LRDIMM |
| HMAA8GL7MMR4N_SPD_Montage(Rev0.1).pdf | DDR4 | Unlimited | 288 pin LRDIMM |
| HMT112S6BFR6C_SPD(Rev0.4).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT125U6BFR8C_SPD(Rev0.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT151R7BFR4C_SPD(Rev0.1).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT151R7TFR4C_SPD(Rev0.2).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT31GR7AFR8C_SPD(Rev0.3).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT31GR7CFR4A_SPD(Rev0.1).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT31GR7CFR4C_SPD(Rev0.pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT31GR7CFR4C_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT31GR7CFR8A_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT325A7CFR8A_SPD(Rev1.0).pdf | DDR3 | Unknown | 204 pin ECC SO-DIMM |
| HMT325R7CFR8A_SPD(Rev0.1).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT325R7CFR8A_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT325R7CFR8C_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT325S6BFR8C_SPD(Rev0.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT325S6CFR8A_SPD(1.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT325S6CFR8C_SPD(Rev0.1).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT325S6EFR8A_SPD(Rev1.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT325U6CFR8C_SPD(1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT325U7EFR8C_SPD(Rev1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT325V7EFR8C_SPD_IDT(Rev1.0).pdf | DDR3 | 400K | 240 pin VLP Registered DIMM |
| HMT325V7EFR8C_SPD_IDT(Rev1.1).pdf | DDR3 | 400K | 240 pin VLP Registered DIMM |
| HMT351A7CFR8A_SPD(Rev1.0).pdf | DDR3 | Unknown | 204 pin ECC SO-DIMM |
| HMT351E7EFR8A_SPD(Rev1.1).pdf | DDR3 | 400K | 240 pin VLP ECC UDIMM |
| HMT351R7CFR4A_SPD(Rev0.1).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT351R7CFR4C_SPD(Rev0.1).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT351R7CFR4C_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT351R7CFR4C_SPD_Inphi(Rev1.0).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT351R7CFR8A_SPD(Rev0.1).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT351R7CFR8C_SPD(Rev0.1).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT351R7CFR8C_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT351S6AFR8C_SPD(Rev0.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT351S6BFR8C_SPD(Rev0.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT351S6CFR8C_SPD(1.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT351S6CFR8C_SPD(Rev0.1).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT351S6EFR8A_SPD(Rev1.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT351U6CFR8C_SPD(1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT351U7CFR8A_SPD(1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT351U7EFR8A_SPD(Rev1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT351V7EFR4A_SPD_IDT(Rev1.1).pdf | DDR3 | 400K | 240 pin VLP Registered DIMM |
| HMT351V7EFR8A_SPD_IDT(Rev1.1).pdf | DDR3 | 400K | 240 pin VLP Registered DIMM |
| HMT351V7EFR8C_SPD_IDT(Rev1.1).pdf | DDR3 | 400K | 240 pin VLP Registered DIMM |
| HMT41GA7AFR8A_SPD(Rev1.0).pdf | DDR3 | 400K | 204 pin ECC SO-DIMM |
| HMT41GR7BFR4A_SPD_IDT(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GR7BFR4C_SPD_IDT(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GR7BFR4C_SPD_Inphi(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GR7BFR8A_SPD_IDT(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GR7DFR4A_SPD_Montage(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GR7DFR4C_SPD_IDT(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GR7DFR4C_SPD_Inphi(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GR7DFR4C_SPD_Montage(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GR7DFR8A_SPD_Inphi(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GR7DFR8A_SPD_Montage(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GR7DFR8C_SPD_Inphi(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GR7DFR8C_SPD_Montage(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT41GS6AFR8A_SPD(Rev1.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT41GS6AFR8A_SPD(Rev1.3).pdf | DDR3 | 200K | 204 pin Unbuffered SO-DIMM |
| HMT41GS6DFR8A_SPD(Rev1.0).pdf | DDR3 | Unlimited | 204 pin Unbuffered SO-DIMM |
| HMT41GU6AFR8A_SPD(Rev1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT41GU6DFR8A_SPD(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Unbuffered DIMM |
| HMT41GU7AFR8C_SPD(Rev1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT41GU7BFR8A_SPD(Rev1.1).pdf | DDR3 | Unlimited | 240 pin Unbuffered DIMM |
| HMT41GU7MFR8A_SPD(1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT41GV7AFR4A_SPD_IDT(Rev1.1).pdf | DDR3 | 400K | 240 pin VLP Registered DIMM |
| HMT41GV7AFR4C_SPD_TI(Rev1.1).pdf | DDR3 | 400K | 240 pin VLP Registered DIMM |
| HMT41GV7AFR8C_SPD_IDT(Rev1.1).pdf | DDR3 | 400K | 240 pin VLP Registered DIMM |
| HMT41GV7BFR4A_SPD_Inphi(Rev1.0).pdf | DDR3 | Unlimited | 240 pin VLP Registered DIMM |
| HMT41GV7BFR4C_SPD_Inphi(Rev1.0).pdf | DDR3 | Unlimited | 240 pin VLP Registered DIMM |
| HMT41GV7BFR8A_SPD_IDT(Rev1.0).pdf | DDR3 | Unlimited | 240 pin VLP Registered DIMM |
| HMT41GV7BFR8C_SPD_Inphi(Rev1.0).pdf | DDR3 | Unlimited | 240 pin VLP Registered DIMM |
| HMT41GV7MFR4A_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin VLP Registered DIMM |
| HMT41GV7MFR4A_SPD_Inphi(Rev1.0).pdf | DDR3 | Unknown | 240 pin VLP Registered DIMM |
| HMT41GV7MFR4A_SPD_TI(Rev1.0).pdf | DDR3 | Unknown | 240 pin VLP Registered DIMM |
| HMT41GV7MFR4C_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin VLP Registered DIMM |
| HMT41GV7MFR8A_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin VLP Registered DIMM |
| HMT41GV7MFR8A_SPD_TI(Rev1.0).pdf | DDR3 | Unknown | 240 pin VLP Registered DIMM |
| HMT41GV7MFR8C_SPD_TI(Rev1.0).pdf | DDR3 | Unknown | 240 pin VLP Registered DIMM |
| HMT425S6AFR6A_SPD(Rev1.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT425U6AFR6C_SPD(Rev1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT42GR7BFR4A_SPD_IDT(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT42GR7BFR4C_SPD_IDT(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT42GR7CMR4A_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT42GR7CMR4C_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT42GR7DFR4A_SPD_Inphi(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT42GR7DFR4A_SPD_Montage(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT42GR7DFR4C_SPD_Inphi(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT451R7BFR8A_SPD_IDT(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT451R7BFR8A_SPD_Inphi(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT451R7MFR8A_SPD_IDT(Rev0.1).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT451S6AFR6C_SPD(Rev1.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT451S6AFR8C_SPD(Rev1.3).pdf | DDR3 | 200K | 204 pin Unbuffered SO-DIMM |
| HMT451S6MFR8A_SPD(1.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT451S6MFR8A_SPD(Rev1.1).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT451S6MFR8C_SPD(1.2).pdf | DDR3 | Unknown | 204 pin Unbuffered SO-DIMM |
| HMT451U6AFR8A_SPD(Rev1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT451U6BFR8C_SPD(Rev1.1).pdf | DDR3 | Unlimited | 240 pin Unbuffered DIMM |
| HMT451U7AFR8A_SPD(Rev1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT451U7AFR8C_SPD(Rev1.2).pdf | DDR3 | Unknown | 240 pin Unbuffered DIMM |
| HMT451V7AFR8C_SPD_Inphi(Rev1.1).pdf | DDR3 | 400K | 240 pin VLP Registered DIMM |
| HMT451V7BFR8A_SPD_Inphi(Rev1.0).pdf | DDR3 | Unlimited | 240 pin VLP Registered DIMM |
| HMT451V7BFR8C_SPD_IDT(Rev1.0).pdf | DDR3 | Unlimited | 240 pin VLP Registered DIMM |
| HMT451V7MFR8A_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin VLP Registered DIMM |
| HMT451V7MFR8C_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin VLP Registered DIMM |
| HMT82GV7AMR4A_SPD_IDT(Rev1.1).pdf | DDR3 | 400K | 240 pin VLP Registered DIMM |
| HMT82GV7AMR4C_SPD_IDT(Rev1.1).pdf | DDR3 | 400K | 240 pin VLP Registered DIMM |
| HMT82GV7BMR4C_SPD_IDT(Rev1.0).pdf | DDR3 | Unlimited | 240 pin VLP Registered DIMM |
| HMT82GV7MMR8A_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin VLP Registered DIMM |
| HMT84GL7AMR4A_SPD_Inphi(Rev1.0).pdf | DDR3 | 400K | 240 pin LRDIMM |
| HMT84GL7AMR4A_SPD_Montage(Rev0.1).pdf | DDR3 | 400K | 240 pin LRDIMM |
| HMT84GL7AMR4C_SPD_Inphi(Rev1.0).pdf | DDR3 | 400K | 240 pin LRDIMM |
| HMT84GL7MMR4A_SPD_Montage(Rev1.0).pdf | DDR3 | Unknown | 240 pin LRDIMM |
| HMT84GR7BMR4C_SPD_IDT(Rev1.0).pdf | DDR3 | Unlimited | 240 pin Registered DIMM |
| HMT84GR7MMR4C_SPD_IDT(Rev1.0).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMT84GR7MMR4C_SPD_Inphi(Rev0.1).pdf | DDR3 | Unknown | 240 pin Registered DIMM |
| HMTA8GL7AHR4A_SPD_Inphi(Rev1.0).pdf | DDR3 | 400K | 240 pin LRDIMM |
To summarise, the results break down as follows:
- 64 modules have MAC=Unknown
- 39 modules have MAC=Unlimited
- 17 modules have MAC=400K
- 2 modules have MAC=200K
"Unknown" means that the SPD data doesn't report a MAC value -- it just has a zero value for byte 0x41.
Note that I excluded DDR2 modules from the list.
The raw table is attached as a CSV file.
I decoded the module types from the part numbers using this documentation:
It would be interesting to acquire some of the modules with MAC=200K and see if they do actually produce rowhammer-induced bit flips when a row is hammered with 200,000+ activations.
I don't mean to pick on Hynix specifically here. It happened to be easy to find their SPD data sheets, but it might be possible to build similar tables from the SPD data that other manufacturers report.
Cheers,
Mark
Mark Seaborn
Sep 10, 2015, 1:30:41 PM9/10/15
to rowhammer-discuss
On 14 August 2015 at 19:35, Mark Seaborn <msea...@chromium.org> wrote:
In contrast, the following documentation for SPD data does not cover byte 41:It just lists bytes 39-59 as "Reserved, General Section", with hex value 0.Since these bytes are zero, byte 0x41 would decode to the default, "Untested MAC".
Correction: That should be "byte 41" (decimal), not "byte 0x41" (hex). The byte offsets used in the SPD docs are decimal, not hex.
Mark
Raunaque Khan
Sep 5, 2023, 4:28:11 PM9/5/23
to rowhammer-discuss
please provide a list of models have been tested in which it was vulnerable to row hammer
Reply all
Reply to author
Forward
0 new messages