DDR3 modules' SPD data can report rowhammer mitigations/testing

996 views
Skip to first unread message

Mark Seaborn

unread,
Aug 14, 2015, 10:36:16 PM8/14/15
to rowhammer-discuss
Earlier this year, I learned that the SPD data [1] for DDR3 DIMMs includes fields which indicate whether the DRAM is meant to be rowhammer-free or whether the DRAM requires special handling.

The fields are:
  • MAC (Maximum Activate Count):  the maximum number of activations that are safe for a row.
  • tMAW (Maximum Activate Window)

These fields in the SPD data are publicly documented by JEDEC in the following spec:
"SPD Annex K - Serial Presence Detect (SPD) for DDR3 SDRAM Modules (Release 6)"
"Release No. 24. Item 2065.47A"
Feb 2014
(Note that registration is required to download specs from the JEDEC site, but it's free.  There also happens to be a copy of this spec here, which doesn't require a JEDEC registration: http://dev.xdevs.com/projects/rpi/repository/raw/doc/4_01_02_11R24.pdf)

In particular, see "Byte 41: SDRAM Maximum Active Count (MAC) Value".


This MAC parameter appears to have the same meaning as the MAC parameter described by the LPDDR4 specification [2].  (However, LPDDR4 does not have a tMAW parameter.)

It is not clear how these SPD fields relate to support for pTRR (Pseudo TRR) in DDR3.  There does not seem to be any public documentation explaining how pTRR works.

However, they do appear to be related.  Searching for "pTRR" turns up the following documentation from DRAM manufacturers, which indicates how these SPD fields should be populated for these specific DRAM devices:
Note that both of these values, 0x84 and 0x85, have bit 7 set, but the SPD docs say that bits 6 and 7 are "Vendor Specific" -- "Contact DRAM supplier for guidance in coding or interpreting these bits".

In contrast, the following documentation for SPD data does not cover byte 41:
It just lists bytes 39-59 as "Reserved, General Section", with hex value 0.
Since these bytes are zero, byte 0x41 would decode to the default, "Untested MAC".

Cheers,
Mark

[1] For background on SPD data, see:  https://en.wikipedia.org/wiki/Serial_presence_detect

Mark Seaborn

unread,
Aug 20, 2015, 2:31:24 PM8/20/15
to rowhammer-discuss
On 14 August 2015 at 19:35, Mark Seaborn <msea...@chromium.org> wrote:
This MAC parameter appears to have the same meaning as the MAC parameter described by the LPDDR4 specification [2].  (However, LPDDR4 does not have a tMAW parameter.)

It is not clear how these SPD fields relate to support for pTRR (Pseudo TRR) in DDR3.  There does not seem to be any public documentation explaining how pTRR works.

However, they do appear to be related.  Searching for "pTRR" turns up the following documentation from DRAM manufacturers, which indicates how these SPD fields should be populated for these specific DRAM devices:
I did some further investigation of the MAC values that Hynix report in the SPD data sheets for their DRAM.

The PDF I linked above is just one example.  Doing a Google search for "site:skhynix.com spd" turns up a lot more PDF files describing the SPD data for different DRAM modules.

I downloaded all the PDFs I found that way.  Here is a table of the resulting PDFs, with the MAC values they report (if any):

Part number/PDFDRAM typeMAC valueModule type
HMA41GS6AFR8N_SPD.pdfDDR4Unlimited260 pin SO-DIMM
HMA42GR7MFR4N_SPD_IDT(Rev1.0).pdfDDR4Unlimited288 pin Registered DIMM
HMA82GR7MFR4N_SPD_IDT(Rev0.2).pdfDDR4Unlimited288 pin Registered DIMM
HMA84GL7MFR4N_SPD_IDT.pdfDDR4Unlimited288 pin LRDIMM
HMA84GL7MFR4N_SPD_Montage.pdfDDR4Unlimited288 pin LRDIMM
HMA84GR7MFR4N_SPD_IDT(Rev0.2).pdfDDR4Unlimited288 pin Registered DIMM
HMAA8GL7MMR4N_SPD_IDT.pdfDDR4Unlimited288 pin LRDIMM
HMAA8GL7MMR4N_SPD_Montage(Rev0.1).pdfDDR4Unlimited288 pin LRDIMM
HMT112S6BFR6C_SPD(Rev0.4).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT125U6BFR8C_SPD(Rev0.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT151R7BFR4C_SPD(Rev0.1).pdfDDR3Unknown240 pin Registered DIMM
HMT151R7TFR4C_SPD(Rev0.2).pdfDDR3Unknown240 pin Registered DIMM
HMT31GR7AFR8C_SPD(Rev0.3).pdfDDR3Unknown240 pin Registered DIMM
HMT31GR7CFR4A_SPD(Rev0.1).pdfDDR3Unknown240 pin Registered DIMM
HMT31GR7CFR4C_SPD(Rev0.pdfDDR3Unknown240 pin Registered DIMM
HMT31GR7CFR4C_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin Registered DIMM
HMT31GR7CFR8A_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin Registered DIMM
HMT325A7CFR8A_SPD(Rev1.0).pdfDDR3Unknown204 pin ECC SO-DIMM
HMT325R7CFR8A_SPD(Rev0.1).pdfDDR3Unknown240 pin Registered DIMM
HMT325R7CFR8A_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin Registered DIMM
HMT325R7CFR8C_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin Registered DIMM
HMT325S6BFR8C_SPD(Rev0.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT325S6CFR8A_SPD(1.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT325S6CFR8C_SPD(Rev0.1).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT325S6EFR8A_SPD(Rev1.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT325U6CFR8C_SPD(1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT325U7EFR8C_SPD(Rev1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT325V7EFR8C_SPD_IDT(Rev1.0).pdfDDR3400K240 pin VLP Registered DIMM
HMT325V7EFR8C_SPD_IDT(Rev1.1).pdfDDR3400K240 pin VLP Registered DIMM
HMT351A7CFR8A_SPD(Rev1.0).pdfDDR3Unknown204 pin ECC SO-DIMM
HMT351E7EFR8A_SPD(Rev1.1).pdfDDR3400K240 pin VLP ECC UDIMM
HMT351R7CFR4A_SPD(Rev0.1).pdfDDR3Unknown240 pin Registered DIMM
HMT351R7CFR4C_SPD(Rev0.1).pdfDDR3Unknown240 pin Registered DIMM
HMT351R7CFR4C_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin Registered DIMM
HMT351R7CFR4C_SPD_Inphi(Rev1.0).pdfDDR3Unknown240 pin Registered DIMM
HMT351R7CFR8A_SPD(Rev0.1).pdfDDR3Unknown240 pin Registered DIMM
HMT351R7CFR8C_SPD(Rev0.1).pdfDDR3Unknown240 pin Registered DIMM
HMT351R7CFR8C_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin Registered DIMM
HMT351S6AFR8C_SPD(Rev0.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT351S6BFR8C_SPD(Rev0.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT351S6CFR8C_SPD(1.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT351S6CFR8C_SPD(Rev0.1).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT351S6EFR8A_SPD(Rev1.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT351U6CFR8C_SPD(1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT351U7CFR8A_SPD(1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT351U7EFR8A_SPD(Rev1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT351V7EFR4A_SPD_IDT(Rev1.1).pdfDDR3400K240 pin VLP Registered DIMM
HMT351V7EFR8A_SPD_IDT(Rev1.1).pdfDDR3400K240 pin VLP Registered DIMM
HMT351V7EFR8C_SPD_IDT(Rev1.1).pdfDDR3400K240 pin VLP Registered DIMM
HMT41GA7AFR8A_SPD(Rev1.0).pdfDDR3400K204 pin ECC SO-DIMM
HMT41GR7BFR4A_SPD_IDT(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GR7BFR4C_SPD_IDT(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GR7BFR4C_SPD_Inphi(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GR7BFR8A_SPD_IDT(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GR7DFR4A_SPD_Montage(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GR7DFR4C_SPD_IDT(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GR7DFR4C_SPD_Inphi(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GR7DFR4C_SPD_Montage(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GR7DFR8A_SPD_Inphi(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GR7DFR8A_SPD_Montage(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GR7DFR8C_SPD_Inphi(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GR7DFR8C_SPD_Montage(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT41GS6AFR8A_SPD(Rev1.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT41GS6AFR8A_SPD(Rev1.3).pdfDDR3200K204 pin Unbuffered SO-DIMM
HMT41GS6DFR8A_SPD(Rev1.0).pdfDDR3Unlimited204 pin Unbuffered SO-DIMM
HMT41GU6AFR8A_SPD(Rev1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT41GU6DFR8A_SPD(Rev1.0).pdfDDR3Unlimited240 pin Unbuffered DIMM
HMT41GU7AFR8C_SPD(Rev1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT41GU7BFR8A_SPD(Rev1.1).pdfDDR3Unlimited240 pin Unbuffered DIMM
HMT41GU7MFR8A_SPD(1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT41GV7AFR4A_SPD_IDT(Rev1.1).pdfDDR3400K240 pin VLP Registered DIMM
HMT41GV7AFR4C_SPD_TI(Rev1.1).pdfDDR3400K240 pin VLP Registered DIMM
HMT41GV7AFR8C_SPD_IDT(Rev1.1).pdfDDR3400K240 pin VLP Registered DIMM
HMT41GV7BFR4A_SPD_Inphi(Rev1.0).pdfDDR3Unlimited240 pin VLP Registered DIMM
HMT41GV7BFR4C_SPD_Inphi(Rev1.0).pdfDDR3Unlimited240 pin VLP Registered DIMM
HMT41GV7BFR8A_SPD_IDT(Rev1.0).pdfDDR3Unlimited240 pin VLP Registered DIMM
HMT41GV7BFR8C_SPD_Inphi(Rev1.0).pdfDDR3Unlimited240 pin VLP Registered DIMM
HMT41GV7MFR4A_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin VLP Registered DIMM
HMT41GV7MFR4A_SPD_Inphi(Rev1.0).pdfDDR3Unknown240 pin VLP Registered DIMM
HMT41GV7MFR4A_SPD_TI(Rev1.0).pdfDDR3Unknown240 pin VLP Registered DIMM
HMT41GV7MFR4C_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin VLP Registered DIMM
HMT41GV7MFR8A_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin VLP Registered DIMM
HMT41GV7MFR8A_SPD_TI(Rev1.0).pdfDDR3Unknown240 pin VLP Registered DIMM
HMT41GV7MFR8C_SPD_TI(Rev1.0).pdfDDR3Unknown240 pin VLP Registered DIMM
HMT425S6AFR6A_SPD(Rev1.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT425U6AFR6C_SPD(Rev1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT42GR7BFR4A_SPD_IDT(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT42GR7BFR4C_SPD_IDT(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT42GR7CMR4A_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin Registered DIMM
HMT42GR7CMR4C_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin Registered DIMM
HMT42GR7DFR4A_SPD_Inphi(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT42GR7DFR4A_SPD_Montage(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT42GR7DFR4C_SPD_Inphi(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT451R7BFR8A_SPD_IDT(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT451R7BFR8A_SPD_Inphi(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT451R7MFR8A_SPD_IDT(Rev0.1).pdfDDR3Unknown240 pin Registered DIMM
HMT451S6AFR6C_SPD(Rev1.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT451S6AFR8C_SPD(Rev1.3).pdfDDR3200K204 pin Unbuffered SO-DIMM
HMT451S6MFR8A_SPD(1.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT451S6MFR8A_SPD(Rev1.1).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT451S6MFR8C_SPD(1.2).pdfDDR3Unknown204 pin Unbuffered SO-DIMM
HMT451U6AFR8A_SPD(Rev1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT451U6BFR8C_SPD(Rev1.1).pdfDDR3Unlimited240 pin Unbuffered DIMM
HMT451U7AFR8A_SPD(Rev1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT451U7AFR8C_SPD(Rev1.2).pdfDDR3Unknown240 pin Unbuffered DIMM
HMT451V7AFR8C_SPD_Inphi(Rev1.1).pdfDDR3400K240 pin VLP Registered DIMM
HMT451V7BFR8A_SPD_Inphi(Rev1.0).pdfDDR3Unlimited240 pin VLP Registered DIMM
HMT451V7BFR8C_SPD_IDT(Rev1.0).pdfDDR3Unlimited240 pin VLP Registered DIMM
HMT451V7MFR8A_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin VLP Registered DIMM
HMT451V7MFR8C_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin VLP Registered DIMM
HMT82GV7AMR4A_SPD_IDT(Rev1.1).pdfDDR3400K240 pin VLP Registered DIMM
HMT82GV7AMR4C_SPD_IDT(Rev1.1).pdfDDR3400K240 pin VLP Registered DIMM
HMT82GV7BMR4C_SPD_IDT(Rev1.0).pdfDDR3Unlimited240 pin VLP Registered DIMM
HMT82GV7MMR8A_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin VLP Registered DIMM
HMT84GL7AMR4A_SPD_Inphi(Rev1.0).pdfDDR3400K240 pin LRDIMM
HMT84GL7AMR4A_SPD_Montage(Rev0.1).pdfDDR3400K240 pin LRDIMM
HMT84GL7AMR4C_SPD_Inphi(Rev1.0).pdfDDR3400K240 pin LRDIMM
HMT84GL7MMR4A_SPD_Montage(Rev1.0).pdfDDR3Unknown240 pin LRDIMM
HMT84GR7BMR4C_SPD_IDT(Rev1.0).pdfDDR3Unlimited240 pin Registered DIMM
HMT84GR7MMR4C_SPD_IDT(Rev1.0).pdfDDR3Unknown240 pin Registered DIMM
HMT84GR7MMR4C_SPD_Inphi(Rev0.1).pdfDDR3Unknown240 pin Registered DIMM
HMTA8GL7AHR4A_SPD_Inphi(Rev1.0).pdfDDR3400K240 pin LRDIMM

To summarise, the results break down as follows:
  • 64 modules have MAC=Unknown
  • 39 modules have MAC=Unlimited
  • 17 modules have MAC=400K
  • 2 modules have MAC=200K
"Unknown" means that the SPD data doesn't report a MAC value -- it just has a zero value for byte 0x41.

Note that I excluded DDR2 modules from the list.

The raw table is attached as a CSV file.

I decoded the module types from the part numbers using this documentation:

It would be interesting to acquire some of the modules with MAC=200K and see if they do actually produce rowhammer-induced bit flips when a row is hammered with 200,000+ activations.

I don't mean to pick on Hynix specifically here.  It happened to be easy to find their SPD data sheets, but it might be possible to build similar tables from the SPD data that other manufacturers report.

Cheers,
Mark

table.csv

Mark Seaborn

unread,
Sep 10, 2015, 1:30:41 PM9/10/15
to rowhammer-discuss
On 14 August 2015 at 19:35, Mark Seaborn <msea...@chromium.org> wrote:
In contrast, the following documentation for SPD data does not cover byte 41:
It just lists bytes 39-59 as "Reserved, General Section", with hex value 0.
Since these bytes are zero, byte 0x41 would decode to the default, "Untested MAC".

Correction:  That should be "byte 41" (decimal), not "byte 0x41" (hex).  The byte offsets used in the SPD docs are decimal, not hex.

Mark

Raunaque Khan

unread,
Sep 5, 2023, 4:28:11 PM9/5/23
to rowhammer-discuss
please provide a list of models have been tested in which it was vulnerable to row hammer 
Reply all
Reply to author
Forward
0 new messages