3 ms·

Even with DDR3 (and probably DDR4) you can still swap bits within a byte lane, and bytes within a word/channel depending on the setup of the memory controller.

Even with DDR3 (and probably DDR4) you can still swap bits within a byte lane, and bytes within a word/channel depending on the setup of the memory controller. Some things change, and some stay the same!

bodyfour 12y ago
That actually surprises me.. I would have guessed that there would be some amount of metadata you could query over the data lines, such as the specs for the DIMM. I guess that's all sent over I2C or something instead?
- makomk 12y ago
  Yeah, that's all done through a seperate EEPROM chip accessed over SMBUS, which is essentially the same as I2C. Raw SDRAM chips don't provide any way to query their specification; on embedded systems that use them, the settings are generally all hardcoded in the bootloader.
- tcas 12y ago
  SDRAM's interface doesn't leave room for extra commands, it's pretty much designed to read/store data and refresh content. It only has 3 lines to select the command (RAS#, CAS#, WE#). Other RAMs/Flash with different interfaces (e.g. SPI) require a prefix command to be sent over the wire, so it's easier for them to implement things like chip id commands.
  - kenz0r 12y ago
    I don't think that is exactly true. DRAM from SDRAM up has had a number of mode registers to control the ram. More info here: http://en.wikipedia.org/wiki/Synchronous_dynamic_random-access_memory#SDRAM_mode_register http://en.wikipedia.org/wiki/Synchronous_dynamic_random-acce...
    - cnvogel 12y ago
      Exactly. ...here's the table for command accesses on DDR4, including the mode register you referred to. http://en.wikipedia.org/wiki/DDR4_SDRAM#Command_encoding http://en.wikipedia.org/wiki/DDR4_SDRAM#Command_encoding
tryp 12y ago
Also, most current DDR3 controllers "scramble" which wire carries which bit based on the address. The idea is that when writing constant repeating data patterns, spreading energy among the wires reduces emitted EMI. When you do a suspend-to-ram on a current x86 machine, it has to save the "scrambler seed" to CMOS so that it can decode the data it left stored in RAM. I think this also helps mitigate the attack where the DRAM is chilled to make its contents less volatile, the machine is powered off, and the DRAM is then dumped in search of sensitive material.

bodyfour 12y ago

That actually surprises me.. I would have guessed that there would be some amount of metadata you could query over the data lines, such as the specs for the DIMM. I guess that's all sent over I2C or something instead?

makomk 12y ago
Yeah, that's all done through a seperate EEPROM chip accessed over SMBUS, which is essentially the same as I2C. Raw SDRAM chips don't provide any way to query their specification; on embedded systems that use them, the settings are generally all hardcoded in the bootloader.
tcas 12y ago
SDRAM's interface doesn't leave room for extra commands, it's pretty much designed to read/store data and refresh content. It only has 3 lines to select the command (RAS#, CAS#, WE#). Other RAMs/Flash with different interfaces (e.g. SPI) require a prefix command to be sent over the wire, so it's easier for them to implement things like chip id commands.
- kenz0r 12y ago
  I don't think that is exactly true. DRAM from SDRAM up has had a number of mode registers to control the ram. More info here: http://en.wikipedia.org/wiki/Synchronous_dynamic_random-access_memory#SDRAM_mode_register http://en.wikipedia.org/wiki/Synchronous_dynamic_random-acce...
  - cnvogel 12y ago
    Exactly. ...here's the table for command accesses on DDR4, including the mode register you referred to. http://en.wikipedia.org/wiki/DDR4_SDRAM#Command_encoding http://en.wikipedia.org/wiki/DDR4_SDRAM#Command_encoding

tryp 12y ago

Also, most current DDR3 controllers "scramble" which wire carries which bit based on the address. The idea is that when writing constant repeating data patterns, spreading energy among the wires reduces emitted EMI. When you do a suspend-to-ram on a current x86 machine, it has to save the "scrambler seed" to CMOS so that it can decode the data it left stored in RAM. I think this also helps mitigate the attack where the DRAM is chilled to make its contents less volatile, the machine is powered off, and the DRAM is then dumped in search of sensitive material.