VOGONS


440BX memory detection / SPD hacking

Topic actions

First post, by jwt27

User metadata
Rank Oldbie
Rank
Oldbie

I was wondering how memory detection works on a 440BX board. From experience I know that most 256/512MB DIMMs are often detected as half their actual capacity. I never understood how that worked, and never really cared either. But now I'm getting curious.

Earlier this week I bought some SDRAM modules. They're Kingston 512MB, PC133-CL2, ECC+registered. I bought these, assuming they would be detected as 256MB each. And I got registered types since I recall reading that this is required for 256MB modules to work.

Wrong! The mainboard only sees 128MB per module.

Digging around in my SDRAM box, I found some non-registered 256MB modules. After testing all of them, I found four which are being detected as actual 256MB modules. One of them is another Kingston. Comparing these:

Kingston KTD-PE6400/2048 (512MB PC133-CL2 ECC/Reg)
Chips: 18x HYB39S256400DT-7 (16M x 4bit x 4banks, 7ns)
Relevant SPD data

Row bits            (byte 03) = 0x0D
Column bits (byte 04) = 0x0B
Banks per module (byte 05) = 0x01
Module width (byte 06) = 0x48
Data chip width (byte 0D) = 0x04
ECC chip width (byte 0E) = 0x04
Banks per chip (byte 11) = 0x04
Module bank density (byte 1F) = 0x80 (512MB)

Kingston KVR133X64C3/256 (256MB PC133-CL3)
Chips: 16x HY57V28820HCT-H (4M x 8bit x 4banks, 7.5ns)
Relevant SPD data:

Row bits            (byte 03) = 0x0C
Column bits (byte 04) = 0x0A
Banks per module (byte 05) = 0x02
Module width (byte 06) = 0x40
Data chip width (byte 0D) = 0x08
ECC chip width (byte 0E) = 0x00
Banks per chip (byte 11) = 0x04
Module bank density (byte 1F) = 0x20 (128MB)

It's not hard to see they're completely different. I think the reason why the latter are being detected as 256MB is because the module is split into two banks of 128MB. But then I'm not sure really, DRAM addressing seems terribly confusing.

Now I tried changing the addressing-related bits in the SPD chip, but whatever I do, nothing seems to have any effect. Even if I try to make them smaller (like 64 or 32MB), the BIOS still detects 128MB per module. Even if I copy all the relevant data (the bytes I quoted above) from the 256MB module, they're still being seen as 128MB and work normally without errors.

I also noticed that the modules are timed for PC133-CL3 in SPD. The chips are clearly capable of CL2 operation, so I changed the numbers in SPD to match the datasheet timings. Again, the BIOS completely ignores this, and insists on running them in CL3 (I can change this manually, of course, but not all the various sub-timings).

Then I tried copying the first 0x40 bytes from the 256MB modules completely. Now finally, the 512MB module fails to boot and the BIOS starts beeping. So SPD is not ignored entirely, after all. But it makes me wonder which bytes are being read by the BIOS and which aren't.

So... can anyone enlighten me on how this detection works? How does the BIOS tell how large your modules are, without even looking at the SPD?
And yes, I realize my attempts at changing the SPD data are probably futile since the physical geometry is simply incompatible with the chipset... Still I'm curious to find out how this stuff works.

Reply 3 of 28, by jwt27

User metadata
Rank Oldbie
Rank
Oldbie

Reading the 440BX datasheet, there's no mention of 256MB modules at all. Only 128MB modules are supported, and even then only as registered modules with 16Mx4x4 chips. So this non-registered 256MB module with 4Mx8x4 chips isn't even supposed to work at all, yet somehow it does. But how?

Reply 4 of 28, by mockingbird

User metadata
Rank Oldbie
Rank
Oldbie

I don't have any input, but I must commend your efforts. Re-programming RAM SPD chips. You sir are an enthusiast.

I've got some really high capacity PC133 RAM with two chips stacked on top of eachother. I think they're 1GB modules. If you want I can post a picture.

mslrlv.png
(Decommissioned:)
7ivtic.png

Reply 5 of 28, by shamino

User metadata
Rank l33t
Rank
l33t

I looked at a 440BX datasheet a few years ago, but I can't seem to find the copy that I had in my files. As I remember it, I thought it said it supports a max of 4 rows of 128MB unbuffered, or up to 8 rows if registered (where 256MB modules are 2 rows of 128). So my understanding was that up to 2x256MB PC100 unbuffered modules are legal with the specs, but beyond that you're supposed to use registered modules.
At the time the information was written, 256MB unbuffered modules probably didn't exist because the necessary 16Mx8 chips didn't exist (I guess it's properly written as 4Mx8x4? I've never been clear on the 4 banks thing). But even though those type of modules didn't exist, I thought the documentation supported them being used. Maybe it doesn't.
At the time, the only way to get that much RAM was by using 4-bit chips, which can't be used on an unbuffered module without violating JEDEC.

I once saw a Kingston module that had 512MB worth of chips on it, but was programmed as a 256MB module. The label said the same, and it really did work. The part number was marketed as a 256MB PC100 module for IBM 440BX systems. The chips were 16x Samsung k4s560832e-tc75, which should be 32MB each.
When I tried to "unlock" it through SPD, and tried it on an appropriate motherboard, it had massive memtest errors. My guess is that the PCB didn't have connections for the high address line. It was addressing 32Mx8 chips as if they were 16Mx8. I guess they ran out of the correct chips and had to fill an order.

The timings are penalized with registered modules. Although the chips are CL2, it probably needs slower timings than the chips call for in order to work. How much slower in all the different parameters, I have no idea.
It's weird that it seems to ignore SPD. Is this a Dell by any chance? I ran into a somewhat similar problem with later P4-era Dell DDR1 motherboards, but I was just trying to trick them into booting with ECC modules. Somehow they saw through SPD.

Reply 6 of 28, by feipoa

User metadata
Rank l33t++
Rank
l33t++

How are you reprogramming the SPD? I recall that EPROM chips on memory modules were read-only. You may need to desolder the existing EPROM chip and replace it with your newly programmed EPROM. Do your modules have EEPROM chips? I recall reading online reports about failed attempts to properly reprogram the SPD flash memory on account of this issue. Perhaps you were also not successful in re-writing the SPD. Could you provide more insight on your procedure?

I would like to reprogram some of my 1 GB PC133 sticks of RAM to CL2. I have some which have CL2-capable memory chips, however the module manufacturer programmed the SPD as CL3 instead of CL2. Certain motherboards do not allow for adjustment of memory timings outside of what is programmed in SPD.

Plan your life wisely, you'll be dead before you know it.

Reply 7 of 28, by konc

User metadata
Rank l33t
Rank
l33t
jwt27 wrote:

I realize that, but I don't think that's a valid reason for it to ignore the SPD data altogether...

I believe it is. The 440BX for what concerns 256MB modules, will only recognize correctly 16Mx8 internally arranged SDRAM. This does mean that the SDRAM needs to have 16 chips, but even then not all of such modules will work. They have to be internally arranged as 16Mx8.

I don't think there is even a chance of a 512 module to get recognized in its whole on a 440BX, the best that can be achieved in my opinion is to get it recognized as 256MB and even that would require very specific modules.

Reply 9 of 28, by jwt27

User metadata
Rank Oldbie
Rank
Oldbie
shamino wrote:

I looked at a 440BX datasheet a few years ago, but I can't seem to find the copy that I had in my files. As I remember it, I thought it said it supports a max of 4 rows of 128MB unbuffered, or up to 8 rows if registered (where 256MB modules are 2 rows of 128). So my understanding was that up to 2x256MB PC100 unbuffered modules are legal with the specs, but beyond that you're supposed to use registered modules.

Ah. So my first assumption was correct; the modules must be split up into two "rows" or "banks" (or "ranks"? this shit is what makes DRAM so confusing...) in order to get 256MB from one module. Which would be impossible with x4 chips since you'd split the data bus up into two 36-bit buses.

Now I wonder which pins from the chipset are used to select these "ranks".

shamino wrote:

The timings are penalized with registered modules. Although the chips are CL2, it probably needs slower timings than the chips call for in order to work. How much slower in all the different parameters, I have no idea.
It's weird that it seems to ignore SPD. Is this a Dell by any chance? I ran into a somewhat similar problem with later P4-era Dell DDR1 motherboards, but I was just trying to trick them into booting with ECC modules. Somehow they saw through SPD.

I'm pretty sure the chipset takes care of the slower timings with registered modules. The chips themselves should run at CL2, if they're on CL3 they would effectively run at CL4, I think.

I'm trying this on an Asus P3B-F and a P2B, with the same results on both boards. No weird proprietary stuff 😉

mockingbird wrote:

I don't have any input, but I must commend your efforts. Re-programming RAM SPD chips. You sir are an enthusiast.

I've got some really high capacity PC133 RAM with two chips stacked on top of eachother. I think they're 1GB modules. If you want I can post a picture.

It's not that difficult really.
Now, if only I knew what I was doing... 🤣

I think your modules would be "stacked" DIMMs as opposed to "planar". Never seen these before but I came across the names while figuring out what the SPD bytes meant. I wonder how that would work.. Maybe the second chip has a non-inverted Chip Select pin or something?

feipoa wrote:

How are you reprogramming the SPD? I recall that EPROM chips on memory modules were read-only. You may need to desolder the existing EPROM chip and replace it with your newly programmed EPROM. Do your modules have EEPROM chips? I recall reading online reports about failed attempts to properly reprogram the SPD flash memory on account of this issue. Perhaps you were also not successful in re-writing the SPD. Could you provide more insight on your procedure?

I would like to reprogram some of my 1 GB PC133 sticks of RAM to CL2. I have some which have CL2-capable memory chips, however the module manufacturer programmed the SPD as CL3 instead of CL2. Certain motherboards do not allow for adjustment of memory timings outside of what is programmed in SPD.

At first I just soldered wires directly to the EEPROM like this:

tczVFOh.jpg

...But that was kinda clumsy to use so I made this adapter socket instead:

exrgaCb.jpg

I'm quite sure the EEPROM is not write protected. The programmer writes and verifies correctly, and I can actually brick the DIMM by cloning the first 0x40 bytes from the non-registered module.

konc wrote:
jwt27 wrote:

I realize that, but I don't think that's a valid reason for it to ignore the SPD data altogether...

I believe it is. The 440BX for what concerns 256MB modules, will only recognize correctly 16Mx8 internally arranged SDRAM. This does mean that the SDRAM needs to have 16 chips, but even then not all of such modules will work. They have to be internally arranged as 16Mx8.

I don't think there is even a chance of a 512 module to get recognized in its whole on a 440BX, the best that can be achieved in my opinion is to get it recognized as 256MB and even that would require very specific modules.

But then how does the chipset figure out how the chips are arranged internally? As far as I can tell, the chipset only "sees" a 64- or 72-bit data bus, not 18x4-bit buses, or 9x8-bit.

Last edited by jwt27 on 2014-12-05, 20:59. Edited 1 time in total.

Reply 10 of 28, by feipoa

User metadata
Rank l33t++
Rank
l33t++

So you are reading the existing EEPROM chip with an external programmer, modifying a few cells, then rewriting the file back to the EEPROM chip? Do Astra32 and Everest Home agree with your reprogrammed SPD values?

Plan your life wisely, you'll be dead before you know it.

Reply 11 of 28, by jwt27

User metadata
Rank Oldbie
Rank
Oldbie

The file system on my primary harddrive is completely busted since yesterday, so I don't have access to either a working DOS or Windows installation right now.
I did check with Speedsys on a floppy, which does confirm my changes to SPD.

edit: I just tried all four non-registered 256MB modules in the P3B-F, and I get the entire gigabyte. So it looks like registered modules are not required, after all... Then why does the datasheet say otherwise?

Reply 12 of 28, by jwt27

User metadata
Rank Oldbie
Rank
Oldbie

Reading the BX datasheet again, there are 14 address lines, split up into two "channels" A and B. So you have MAA0 to MAA13 and MAB0 to MAB14. Most signals are split up into A and B and I don't really see why. MAB10 and MAB13 seem to have some special meaning too since the datasheet keeps referring to these as being separate signals. Anyway, MA11 and MA12 double as Bank Address lines BA0 and BA1 for two- and four-bank chips.
Checking the mainboard, I can see MA11 is directly connected to BA1 (note: that's the wrong way around!). BA0 and MA12, are both connected too, but NOT to each other or to any of the other address pins. So these seem to be separate lines, on the P3B at least.

As a quick experiment I tried cutting the BA traces on one of the DIMMs. With BA0 cut, it starts up as normal and works as 128MB module, as expected. When BA1 is cut however, the module no longer boots on it own (no beeps either!). But when a second unmodified module is installed next to it, it boots again and both the normal and "broken" module are detected as 128MB (256MB total). Huh.

Taking a closer look at the DIMMs, I also found that the CS lines for the second rank/row/bank/whatever can be connected to the SDRAM chips' pin 15 if you shuffle some 0-ohm resistors around. I think this would allow using "stacked" chips, like on mockingbird's 1GB module. This is, um, interesting...

Reply 13 of 28, by shamino

User metadata
Rank l33t
Rank
l33t
jwt27 wrote:

I just tried all four non-registered 256MB modules in the P3B-F, and I get the entire gigabyte. So it looks like registered modules are not required, after all... Then why does the datasheet say otherwise?

I think it's just a reliability spec. They don't want you to exceed 4 "rows" (or whatever) of unbuffered memory, but they won't actively prevent it. The 440BX is famous after all for performing well beyond what Intel officially endorsed. It's not supposed to support PC133 either, but it routinely can do that also.
Some of VIA's SDRAM chipsets support up to 4 double sided modules, but I'm pretty sure they say no more than 3 if they're not registered. Just like with Intel, they don't actively prevent you from trying, and in practice it can work.

The P2B-F (and I think the P3B-F) appear to have some buffering chips next to the RAM slots. I'm pretty sure they're not present on regular P2B boards that only have 3 DIMM slots. They probably help.

Reply 14 of 28, by zyga64

User metadata
Rank Oldbie
Rank
Oldbie
feipoa wrote:

I would like to reprogram some of my 1 GB PC133 sticks of RAM to CL2. I have some which have CL2-capable memory chips, however the module manufacturer programmed the SPD as CL3 instead of CL2. Certain motherboards do not allow for adjustment of memory timings outside of what is programmed in SPD.

Maybe you should try SPDtool: http://www.amibay.com/showthread.php?25286-Fo … n-older-machine

1) VLSI SCAMP /286@20 /4M /CL-GD5422 /CMI8330
2) i420EX /486DX33 /16M /TGUI9440 /GUS+ALS100+MT32PI
3) i430FX /K6-2@400 /64M /Rage Pro PCI /ES1370+YMF718
4) i440BX /P!!!750 /256M /MX440 /SBLive!
5) iB75 /3470s /4G /HD7750 /HDA

Reply 15 of 28, by feipoa

User metadata
Rank l33t++
Rank
l33t++
zyga64 wrote:
feipoa wrote:

I would like to reprogram some of my 1 GB PC133 sticks of RAM to CL2. I have some which have CL2-capable memory chips, however the module manufacturer programmed the SPD as CL3 instead of CL2. Certain motherboards do not allow for adjustment of memory timings outside of what is programmed in SPD.

Maybe you should try SPDtool: http://www.amibay.com/showthread.php?25286-Fo … n-older-machine

This looks like a much simplier approach. Thank you for the recommendation!

Plan your life wisely, you'll be dead before you know it.

Reply 16 of 28, by jwt27

User metadata
Rank Oldbie
Rank
Oldbie

Okay I think I might be on to something. I modified one of the modules, like so:

WaLeSWT.jpg

Yeah that's a very quick hack. I don't expect this to work reliably at all, it's only to see if my idea could possibly work.
What I'm doing here is fairly simple: I disconnected the BA1 (Bank Address) line between the registers and the RAM chips, and connected it to the second CS pair (Chip Select, or really, "Rank Select") instead. The diodes and pullup now combine both CS lines from each rank to drive the CS pin on the RAM chips. So now I should have two ranks on one module, using the same chips but switching between on-chip banks for each rank.

And guess what, it works! This module is now detected as 256MB, or 2 ranks of 128MB. It crashes like 9 out of 10 times during POST though, and if I start it together with a second (good) DIMM, memtest shows errors on the first few megabytes of each rank. So I think that means I do have two individual ranks now but switching between them is unreliable. I guess either my diode logic is a bit too slow (very likely) or the CS signal is too short to drive BA line reliably, or CS simply occurs at the wrong time (could be, I have no idea how all these signals are timed).
I don't know if the chipset is able to open multiple ranks at the same time though. This would obviously cause problems since both are now located in the same chip.

I'll get some logic chips, see if I can do this "properly" 😀

feipoa wrote:
zyga64 wrote:
feipoa wrote:

I would like to reprogram some of my 1 GB PC133 sticks of RAM to CL2. I have some which have CL2-capable memory chips, however the module manufacturer programmed the SPD as CL3 instead of CL2. Certain motherboards do not allow for adjustment of memory timings outside of what is programmed in SPD.

Maybe you should try SPDtool: http://www.amibay.com/showthread.php?25286-Fo … n-older-machine

This looks like a much simplier approach. Thank you for the recommendation!

Had a quick look at this but it's for DDR2 only. Non-DDR SDRAM uses an older SPD standard (v 1.2B). I think the wikipedia page and the official specs are most helpful references I found s afar. For the checksum byte, HxD hex editor has a nifty checksum calculator.

But then, who am I to say this? I still don't even know why my own SPD data is being ignored by the BIOS...

Reply 18 of 28, by mockingbird

User metadata
Rank Oldbie
Rank
Oldbie

Fascinating work jwt27 -

I thought I'd take a pic of the stacked RAM. Not the best quality.

There are 36 memory chips (Hitachi 5225405btt75). I assume 4 of them are for ECC, so they're 32MB each (1gig module). The other side looks very similar to yours, except I have small 0 Ohm resistors where yours are unpopulated.

Attachments

  • Filename
    IMG_28782.jpg
    File size
    523.94 KiB
    Downloads
    No downloads
    File license
    Fair use/fair dealing exception

mslrlv.png
(Decommissioned:)
7ivtic.png

Reply 19 of 28, by konc

User metadata
Rank l33t
Rank
l33t

I just had a quick look into 440bx's specs to refresh my memory, it just can't fully address the x4 chips. Not enough address lines for this.
Please don't get me wrong, I'm reading with great interest your efforts and I'm curious to see where this will go.