Standardized way to automatically access information about a memory module
In computing, serial presence detect (SPD) is a standardized way to automatically access information about a memory module. Earlier 72-pin SIMMs included five pins that provided five bits of parallel presence detect (PPD) data, but the 168-pin DIMM standard changed to a serial presence detect to encode more information.[1]
When an ordinary modern computer is turned on, it starts by doing a power-on self-test (POST). Since about the mid-1990s, this process includes automatically configuring the hardware currently present. SPD is a memory hardware feature that makes it possible for the computer to know what memory is present, and what memory timings to use to access the memory.
Some computers adapt to hardware changes completely automatically. In most cases, there is a special optional procedure for accessing BIOS parameters, to view and potentially make changes in settings. It may be possible to control how the computer uses the memory SPD data—to choose settings, selectively modify memory timings, or possibly to completely override the SPD data (see overclocking).
Stored information
For a memory module to support SPD, the JEDEC standards require that certain parameters be in the lower 128 bytes of an EEPROM located on the memory module. These bytes contain timing parameters, manufacturer, serial number and other useful information about the module. Devices utilizing the memory automatically determine key parameters of the module by reading this information. For example, the SPD data on an SDRAM module might provide information about the CAS latency so the system can set this correctly without user intervention.
The SPD EEPROM firmware is accessed using SMBus, a variant of the I2C protocol. This reduces the number of communication pins on the module to just two: a clock signal and a data signal. The EEPROM shares ground pins with the RAM, has its own power pin, and has three additional pins (SA0–2) to identify the slot, which are used to assign the EEPROM a unique address in the range 0x50–0x57. Not only can the communication lines be shared among 8 memory modules, the same SMBus is commonly used on motherboards for system health monitoring tasks such as reading power supply voltages, CPU temperatures, and fan speeds.
SPD EEPROMs also respond to I2C addresses 0x30–0x37 if they have not been write protected, and an extension (TSE series) uses addresses 0x18–0x1F to access an optional on-chip temperature sensor. All those values are seven-bit I2C addresses formed by a Device Type Identifier Code prefix (DTIC) with SA0-2: to read (1100) from slot 3, one uses 110 0011 = 0x33. With a final R/W bit it forms the 8-bit Device Select Code.[2] Note that the semantics of slot-id is different for write-protection operations: for them they can be not passed by the SA pins at all.[3]
Before SPD, memory chips were spotted with parallel presence detect (PPD). PPD used a separate pin for each bit of information, which meant that only the speed and density of the memory module could be stored because of the limited space for pins.
SDR SDRAM
The first SPD specification was issued by JEDEC and tightened up by Intel as part of its PC100 memory specification introduced in 1998.[4][5][6] Most values specified are in binary-coded decimal form. The most significant nibble can contain values from 10 to 15, and in some cases extends higher. In such cases, the encodings for 1, 2 and 3 are instead used to encode 16, 17 and 18. A most significant nibble of 0 is reserved to represent "undefined".
The SPD ROM defines up to three DRAM timings, for three CAS latencies specified by set bits in byte 18. First comes the highest CAS latency (fastest clock), then two lower CAS latencies with progressively lower clock speeds.
Interface voltage level of this assembly (not the same as Vcc supply voltage) (0–5)
Decoded by table lookup
9
0x09
Nanoseconds (0–15)
Tenths of nanoseconds (0.0–0.9)
Clock cycle time at highest CAS latency.
10
0x0a
Tenths of nanoseconds (0.0–0.9)
Hundredths of nanoseconds (0.00–0.09)
SDRAM access time from clock (tAC)
11
0x0b
DIMM configuration type (0–2): non-ECC, parity, ECC
Table lookup
12
0x0c
Self
Refresh period (0–5): 64, 256, 128, 32, 16, 8 kHz
Refresh requirements
13
0x0d
Bank 2 2×
Bank 1 primary SDRAM width (1–127)
Width of bank 1 data SDRAM devices. Bank 2 may be same width, or 2× width if bit 7 is set.
14
0x0e
Bank 2 2×
Bank 1 ECC SDRAM width (0–127)
Width of bank 1 ECC/parity SDRAM devices. Bank 2 may be same width, or 2× width if bit 7 is set.
15
0x0f
Clock delay for random column reads
Typically 1
16
0x10
Page
—
—
—
8
4
2
1
Burst lengths supported (bitmap)
17
0x11
Banks per SDRAM device (1–255)
Typically 4
18
0x12
—
4
3.5
3
2.5
2
1.5
1
CAS latencies supported (bitmap)
19
0x13
—
6
5
4
3
2
1
0
CS latencies supported (bitmap)
20
0x14
—
6
5
4
3
2
1
0
WE latencies supported (bitmap)
21
0x15
—
x
Diff clock
FET switch external enable
FET switch on-board enable
On-card PLL
Registered
Buffered
Memory module feature bitmap
22
0x16
Fast AP
Concurrent auto precharge
Upper Vcc (supply voltage) tolerance
Lower Vcc (supply voltage) tolerance
—
—
—
Includes weak driver
Memory chip feature bitmap
23
0x17
Nanoseconds (0–15)
Tenths of nanoseconds (0.0–0.9)
Clock cycle time at medium CAS latency.
24
0x18
Tenths of nanoseconds (0.0–0.9)
Hundredths of nanoseconds (0.00–0.09)
Data access time from clock (tAC)
25
0x19
Nanoseconds (0–15)
Tenths of nanoseconds (0.0–0.9)
Clock cycle time at short CAS latency.
26
0x1a
Tenths of nanoseconds (0.0–0.9)
Hundredths of nanoseconds (0.00–0.09)
Data access time from clock (tAC)
27
0x1b
Nanoseconds (1–63)
0.25 ns (0–0.75)
Minimum row precharge time (tRP)
28
0x1c
Nanoseconds (1–63)
0.25 ns (0–0.75)
Minimum row active–row active delay (tRRD)
29
0x1d
Nanoseconds (1–63)
0.25 ns (0–0.75)
Minimum RAS to CAS delay (tRCD)
30
0x1e
Nanoseconds (1–255)
Minimum active to precharge time (tRAS)
31
0x1f
512 MiB
256 MiB
128 MiB
64 MiB
32 MiB
16 MiB/ 4 GiB
8 MiB/ 2 GiB
4 MiB/ 1 GiB
Module bank density (bitmap). Two bits set if different size banks.
32
0x20
Tenths of nanoseconds (0.0–0.9)
Hundredths of nanoseconds (0.00–0.09)
Address/command setup time from clock
33
0x21
Tenths of nanoseconds (0.0–0.9)
Hundredths of nanoseconds (0.00–0.09)
Address/command hold time after clock
34
0x22
Tenths of nanoseconds (0.0–0.9)
Hundredths of nanoseconds (0.00–0.09)
Data input setup time from clock
35
0x23
Tenths of nanoseconds (0.0–0.9)
Hundredths of nanoseconds (0.00–0.09)
Data input hold time after clock
36–40
0x24–0x28
Reserved
Superset information
41
0x29
Nanoseconds (1–255)
Minimum active to active/refresh time (tRC)
42
0x2a
Nanoseconds (1–255)
Minimum refresh to active/refresh time (tRFC)
43
0x2b
Nanoseconds (1–63, or 255: no maximum)
0.25 ns (0–0.75)
Maximum clock cycle time (tCK max.)
44
0x2c
Hundredths of nanoseconds (0.01–2.55)
Maximum skew, DQS to any DQ. (tDQSQ max.)
45
0x2d
Tenths of nanoseconds (0.0–1.2)
Hundredths of nanoseconds (0.00–0.09)
Read data hold skew factor (tQHS)
46
0x2e
Reserved
For future standardization
47
0x2f
—
Height
Height of DIMM module, table lookup
48–61
0x30–0x3d
Reserved
For future standardization
62
0x3e
Major revision (0–9)
Minor revision (0–9)
SPD revision level, 0.0 or 1.0
63
0x3f
Checksum
Sum of bytes 0–62, not then negated
64–71
0x40–47
Manufacturer JEDEC id.
Stored little-endian, trailing zero-padded
72
0x48
Module manufacturing location
Vendor-specific code
73–90
0x49–0x5a
Module part number
ASCII, space-padded
91–92
0x5b–0x5c
Module revision code
Vendor-specific code
93
0x5d
Tens of years (0–90)
Years (0–9)
Manufacturing date (YYWW)
94
0x5e
Tens of weeks (0–50)
Weeks (0–9)
95–98
0x5f–0x62
Module serial number
Vendor-specific code
99–127
0x63–0x7f
Manufacturer-specific data
Could be enhanced performance profile
DDR2 SDRAM
The DDR2 SPD standard makes a number of changes, but is roughly similar to the above. One notable deletion is the confusing and little-used support for DIMMs with two ranks of different sizes.
For cycle time fields (bytes 9, 23, 25 and 49), which are encoded in BCD, some additional encodings are defined for the tenths digit to represent some common timings exactly:
ASCII, space-padded (limited to (,-,), A–Z, a–z, 0–9, space)
91–92
0x5b–0x5c
Module revision code
Vendor-specific code
93
0x5d
Years since 2000 (0–255)
Manufacturing date (YYWW)
94
0x5e
Weeks (1–52)
95–98
0x5f–0x62
Module serial number
Vendor-specific code
99–127
0x63–0x7f
Manufacturer-specific data
Could be enhanced performance profile
DDR3 SDRAM
The DDR3 SDRAM standard significantly overhauls and simplifies the SPD contents layout. Instead of a number of BCD-encoded nanosecond fields, some "timebase" units are specified to high precision, and various timing parameters are encoded as multiples of that base unit.[10] Further, the practice of specifying different time values depending on the CAS latency has been dropped; now there are just a single set of timing parameters.
Revision 1.1 lets some parameters be expressed as a "medium time base" value plus a (signed, −128 +127) "fine time base" correction. Generally, the medium time base is 1/8 ns (125 ps), and the fine time base is 1, 2.5 or 5 ps. For compatibility with earlier versions that lack the correction, the medium time base number is usually rounded up and the correction is negative. Values that work this way are:
The memory capacity of a module can be computed from bytes 4, 7 and 8. The module width (byte 8) divided by the number of bits per chip (byte 7) gives the number of chips per rank. That can then be multiplied by the per-chip capacity (byte 4) and the number of ranks of chips on the module (usually 1 or 2, from byte 7).
DDR4 SDRAM
The DDR4 SDRAM "Annex L" standard for SPD changes the EEPROM module used. Instead of the old AT24C02-compatible 256-byte EEPROMs, JEDEC now defines a new nonstandard EE1004 type with two pages at the SMBus level each with 256 bytes. The new memory still uses the old 0x50–0x57 addresses, but two additional address at 0x36 (SPA0) and 0x37 (SPA1) are now used to receive commands to select the currently-active page for the bus, a form of bank switching.[13] Internally each logical page is further divided into two physical blocks of 128 bytes each, totaling four blocks and 512 bytes.[14] Other semantics for "special" address ranges remain the same, although write protection is now addressed by blocks and a high voltage at SA0 is now required to change its status.[15]
Annex L defines a few different layouts that can be plugged into a 512-byte (of which a maximum of 320 bytes are defined) template, depending on the type of the memory module. The bit definitions are similar to DDR3.[14]
Type of module; e.g., 2 = Unbuffered DIMM, 3 = SO-DIMM, 11=LRDIMM
4
0x04
Bank group bits
Bank address bits−2
Total SDRAM capacity per die in megabits
Zero means no bank groups, 4 banks, 256 Mibit.
5
0x05
Reserved
Row address bits−12
Column address bits−9
6
0x06
Primary SDRAM package type
Die count
Reserved
Signal loading
7
0x07
Reserved
Maximum activate window (tMAW)
Maximum activate count (MAC)
SDRAM optional features
8
0x08
Reserved
SDRAM thermal and refresh options
9
0x09
Post package repair (PPR)
Soft PPR
Reserved
Other SDRAM optional features
10
0x0a
SDRAM package type
Die count−1
DRAM density ratio
Signal loading
Secondary SDRAM package type
11
0x0b
Reserved
Endurant flag
Operable flag
Module nominal voltage, VDD
12
0x0c
Reserved
Rank mix
Package ranks per DIMM−1
SDRAM device width
Module organization
13
0x0d
Reserved
Bus width extension
Primary bus width
Module memory bus width in bits
14
0x0e
Thermal sensor
Reserved
Module thermal sensor
15
0x0f
Reserved
Extended base module type
16
0x10
Reserved
17
0x11
Reserved
Medium timebase (MTB)
Fine timebase (FTB)
Measured in ps.
18
0x12
Minimum SDRAM cycle time, tCKAVGmin
In multiples of MTB; e.g., 100/8 ns.
19
0x13
Maximum SDRAM cycle time, tCKAVGmax
In multiples of MTB; e.g., 60/8 ns.
20
0x14
14
13
12
11
10
9
8
7
CAS latencies supported bit-mask
21
0x15
22
21
20
19
18
17
16
15
CAS latencies supported bit-mask
22
0x16
30
29
28
27
26
25
24
23
CAS latencies supported bit-mask
23
0x17
Low CL range
Reserved
36
35
34
33
32
31
CAS latencies supported bit-mask
24
0x18
Minimum CAS latency time, tAAmin
In multiples of MTB; e.g., 1280/8 ns.
25
0x19
Minimum RAS to CAS delay time, tRCDmin
In multiples of MTB; e.g., 60/8 ns.
26
0x1a
Minimum row precharge delay time, tRPmin
In multiples of MTB; e.g., 60/8 ns.
27
0x1b
Upper nibbles for tRASmin and tRCmin
28
0x1c
Minimum active to precharge delay time, tRASmin least significant byte
In multiples of MTB
29
0x1d
Minimum active to active/refresh delay time, tRCmin least significant byte
In multiples of MTB
30
0x1e
Minimum refresh recovery delay time, tRFC1min least significant byte
In multiples of MTB
31
0x1f
Minimum refresh recovery delay time, tRFC1min most significant byte
In multiples of MTB
32
0x20
Minimum refresh recovery delay time, tRFC2min least significant byte
In multiples of MTB
33
0x21
Minimum refresh recovery delay time, tRFC2min most significant byte
In multiples of MTB
34
0x22
Minimum refresh recovery delay time, tRFC4min least significant byte
In multiples of MTB
35
0x23
Minimum refresh recovery delay time, tRFC4min most significant byte
In multiples of MTB
36
0x24
Reserved
tFAWmin most significant nibble
37
0x25
Minimum four activate window delay time, tFAWmin least significant byte
In multiples of MTB
38
0x26
Minimum activate to activate delay time, tRRD_Smin, different bank group
In multiples of MTB
39
0x27
Minimum activate to activate delay time, tRRD_Lmin, same bank group
In multiples of MTB
40
0x28
Minimum CAS to CAS delay time, tCCD_Lmin, same bank group
In multiples of MTB
41
0x29
Upper nibble for tWRmin
42
0x2a
Minimum write recovery time, tWRmin
In multiples of MTB
43
0x2b
Upper nibbles for tWTRmin
44
0x2c
Minimum write to read time, tWTR_Smin, different bank group
In multiples of MTB
45
0x2d
Minimum write to read time, tWTR_Lmin, same bank group
In multiples of MTB
49–59
0x2e–0x3b
Reserved
Base configuration section
60–77
0x3c–0x4d
Connector to SDRAM bit mapping
78–116
0x4e–0x74
Reserved
Base configuration section
117
0x75
Fine offset for minimum CAS to CAS delay time, tCCD_Lmin, same bank
Two's complement multiplier for FTB units
118
0x76
Fine offset for minimum activate to activate delay time, tRRD_Lmin, same bank group
Two's complement multiplier for FTB units
119
0x77
Fine offset for minimum activate to activate delay time, tRRD_Smin, different bank group
Two's complement multiplier for FTB units
120
0x78
Fine offset for minimum active to active/refresh delay time, tRCmin
Two's complement multiplier for FTB units
121
0x79
Fine offset for minimum row precharge delay time, tRPmin
Two's complement multiplier for FTB units
122
0x7a
Fine offset for minimum RAS to CAS delay time, tRCDmin
Two's complement multiplier for FTB units
123
0x7b
Fine offset for minimum CAS latency time, tAAmin
Two's complement multiplier for FTB units
124
0x7c
Fine offset for SDRAM maximum cycle time, tCKAVGmax
Two's complement multiplier for FTB units
125
0x7d
Fine offset for SDRAM minimum cycle time, tCKAVGmin
Two's complement multiplier for FTB units
126
0x7e
Cyclic rendundancy code (CRC) for base config section, least significant byte
CRC16 algorithm
127
0x7f
Cyclic rendundancy code (CRC) for base config section, most significant byte
CRC16 algorithm
128–191
0x80–0xbf
Module-specific section
Dependent upon memory module family (UDIMM, RDIMM, LRDIMM)
192–255
0xc0–0xff
Hybrid memory architecture specific parameters
256–319
0x100–0x13f
Extended function parameter block
320–321
0x140–0x141
Module manufacturer
See JEP-106
322
0x142
Module manufacturing location
Manufacturer-defined manufacturing location code
323
0x143
Module manufacturing year
Represented in Binary Coded Decimal (BCD)
324
0x144
Module manufacturing week
Represented in Binary Coded Decimal (BCD)
325–328
0x145–0x148
Module serial number
Manufacturer-defined format for a unique serial number across part numbers
329–348
0x149–0x15c
Module part number
ASCII part number, unused digits should be set to 0x20
349
0x15d
Module revision code
Manufacturer-defined revision code
350–351
0x15e–0x15f
DRAM manufacturer ID code
See JEP-106
352
0x160
DRAM stepping
Manufacturer-defined stepping or 0xFF if not used
353–381
0x161–0x17d
Manufacturer's specific data
382–383
0x17e–0x17f
Reserved
DDR5 SDRAM
Preliminary table for DDR5, based on JESD400-5 specification.[17]
DDR5 expands the SPD table to 1024-byte. SPD of DDR5 is using the I3C bus.
SPD contents for DDR5 SDRAM
Byte
Bit
Notes
Dec
Hex
7
6
5
4
3
2
1
0
0
0x00
Number of bytes in SPD device
1
0x01
SPD revision for base configuration parameters
2
0x02
Key byte / host bus command protocol type
3
0x03
Key byte / module type
4
0x04
First SDRAM density and package
5
0x05
First SDRAM addressing
6
0x06
First SDRAM I/O width
7
0x07
First SDRAM bank groups & banks per bank group
8
0x08
Second SDRAM density and package
9
0x09
Second SDRAM addressing
10
0x0a
Second SDRAM I/O width
11
0x0b
Second SDRAM bank groups & banks per bank group
12
0x0c
SDRAM optional features
13
0x0d
Thermal and refresh options
14
0x0e
Reserved
15
0x0f
Reserved
16
0x10
SDRAM nominal voltage, VDD
Extensions
The JEDEC standard only specifies some of the SPD bytes. The truly critical data fits into the first 64 bytes,[8][9][18][19][20] while some of the remainder is earmarked for manufacturer identification. However, a 256-byte EEPROM is generally provided. A number of uses have been made of the remaining space.
Enhanced Performance Profiles (EPP)
Memory generally comes with conservative timing recommendations in the SPD ROM, to ensure basic functionality on all systems. Enthusiasts often spend considerable time manually adjusting the memory timings for higher speed.
Enhanced Performance Profiles is an extension of SPD, developed by Nvidia and Corsair, which includes additional information for higher-performance operation of DDR2 SDRAM, including supply voltages and command timing information not included in the JEDEC SPD spec. The EPP information is stored in the same EEPROM, but in bytes 99–127, which are unused by standard DDR2 SPD.[21]
EPP SPD ROM usage
Bytes
Size
Full profiles
Abbreviated profiles
99–103
5
EPP header
104–109
6
Profile FP1
Profile AP1
110–115
6
Profile AP2
116–121
6
Profile FP2
Profile AP3
122–127
6
Profile AP4
The parameters are particularly designed to fit the memory controller on the nForce 5, nForce 6 and nForce 7 chipsets. Nvidia encourages support for EPP in the BIOS for its high-end motherboard chipsets. This is intended to provide "one-click overclocking" to get better performance with minimal effort.
Nvidia's name for EPP memory that has been qualified for performance and stability is "SLI-ready memory".[22] The term "SLI-ready-memory" has caused some confusion, as it has nothing to do with SLI video. One can use EPP/SLI memory with a single video card (even a non-Nvidia card), and one can run a multi-card SLI video setup without EPP/SLI memory.
An extended version, EPP 2.0, supports DDR3 memory as well.[23]
Intel Extreme Memory Profile (XMP)
"Intel XMP" redirects here. Not to be confused with Intel MPX.
A similar, Intel-developed JEDEC SPD extension was developed for DDR3 SDRAM DIMMs, later used in DDR4 and DDR5 SDRAM as well. XMP uses bytes 176–255, which are unallocated by JEDEC, to encode higher-performance memory timings.[24]
Later, AMD developed AMP, an equivalent technology to XMP, for use in its "Radeon Memory" line of memory modules optimized for use in AMD platforms.[25][26] Furthermore, motherboard developers implemented their own technologies to allow their AMD-based motherboards to read XMP profiles: MSI offers A-XMP,[27] ASUS has DOCP (Direct Over Clock Profile), and Gigabyte has EOCP (Extended Over Clock Profile).[28]
The header contains the following data. Most importantly, it contains a "medium timebase" value MTB, as a rational number of nanoseconds (common values are 1/8, 1/12 and 1/16 ns). Many other later timing values are expressed as an integer number of MTB units.
Also included in the header is the number of DIMMs per memory channel that the profile is designed to support; including more DIMMs may not work well.
System CMD rate mode. 0=JTAG default, otherwise in peculiar units of MTB × tCK/ns. E.g. if MTB is 1/8 ns, then this is in units of 1/8 clock cycle.
209
244
7:0
SDRAM auto self refresh performance. Standard version 1.1 says documentation is TBD.
210–218
245–253
7:0
Reserved
219
254
7:0
Reserved, vendor-specific personality code.
All data above are for DDR3 (XMP 1.1); DDR4 specs are not yet available.
AMD Extended Profiles for Overclocking (EXPO)
AMD's Extended Profiles for Overclocking (EXPO) is a JEDEC SPD extension developed for DDR5 DIMMs to apply a one-click automatic overclocking profile to system memory.[30][31] AMD EXPO-certified DIMMs include optimised timings that optimise the performance of its Zen 4 processors.[32] Unlike Intel's closed standard XMP, the EXPO standard is open and royalty-free.[31] It can be used on Intel platforms.[31] At launch in September 2022, there are 15 partner RAM kits with EXPO-certification available reaching up to 6400 MT/s.[33]
Vendor-specific memory
A common misuse is to write information to certain memory regions to bind vendor-specific memory modules to a specific system. Fujitsu Technology Solutions is known to do this. Adding different memory module to the system usually results in a refusal or other counter-measures (like pressing F1 on every boot).
This is the output of a 512 MB memory module from Micron Technologies, branded for Fujitsu-Siemens Computers, note the "FSC" string.
The system BIOS rejects memory modules that don't have this information starting at offset 128h.
Some Packard Bell AMD laptops also use this method, in this case the symptoms can vary but it can lead to a flashing cursor rather than a beep pattern. Incidentally this can also be a symptom of BIOS corruption as well.[34] Though upgrading a 2 GB to a 4 GB can also lead to issues.
Reading and writing SPD information
Memory module manufacturers write the SPD information to the EEPROM on the module. Motherboard BIOSes read the SPD information to configure the memory controller. There exist several programs that are able to read and modify SPD information on most, but not all motherboard chipsets.
dmidecode program that can decode information about memory (and other things) and runs on Linux, FreeBSD, NetBSD, OpenBSD, BeOS, Cygwin and Solaris. dmidecode does not access SPD information directly; it reports the SMBIOS data about the memory.[35] This information may be limited or incorrect.
On Linux systems and FreeBSD, the user space program decode-dimms provided by i2c-tools decodes and prints information on any memory with SPD information in the computer.[36][37] It requires SMBus controller support in the kernel, the EEPROM kernel driver, and also that the SPD EEPROMs are connected to the SMBus. On older Linux distributions, decode-dimms.pl was available as part of lm_sensors.
OpenBSD has included a driver (spdmem(4)) since version 4.3 to provide information about memory modules. The driver was ported from NetBSD, where it is available since release 5.0.
Coreboot reads and uses SPD information to initialize all memory controllers in a computer with timing, size and other properties.
Windows systems use programs like HWiNFO,[38]CPU-Z and Speccy, which can read and display DRAM module information from SPD.
Chipset-independent reading and writing of SPD information is done by accessing the memory's EEPROM directly with eeprom programmer hardware and software.
A not so common use for old laptops is as generic SMBus readers, as the internal EEPROM on the module can be disabled once the BIOS has read it so the bus is essentially available for use. The method used is to pull low the A0,A1 lines so the internal memory shuts down, allowing the external device to access the SMBus. Once this is done, a custom Linux build or DOS application can then access the external device. A common use is recovering data from LCD panel memory chips to retrofit a generic panel into a proprietary laptop.
On some chips it is also a good idea to separate write protect lines so that the onboard chips do not get wiped during reprogramming.
A related technique is rewriting the chip on webcams often included with many laptops as the bus speed is substantially higher and can even be modified so that 25x compatible chips can be read back for later cloning of the uEFI in the event of a chip failure.
This unfortunately only works on DDR3 and below, as DDR4 uses different security and can usually only be read. Its possible to use a tool like SPDTool or similar and replace the chip with one that has its WP line free so it can be altered in situ.
On some chipsets the message "Incompatible SMBus driver?" may be seen so read is also prevented.
RGB LED control
Some memory modules (especially on Gaming PCs)[39] support RGB LEDs that are controlled by proprietary SMBus commands. This allows LED color control without additional connectors and cables. Kernel drivers from multiple manufacturers required to control the lights have been exploited to gain access ranging from full kernel memory access, to MSR and I/O port control numerous times in 2020 alone.[40][41][42]
On older equipment
Some older equipment require the use of SIMMs with parallel presence detect (more commonly called simply presence detect or PD). Some of this equipment uses non-standard PD coding, IBM computers and Hewlett-PackardLaserJet and other printers in particular.
^JEDEC Standard 21-C section 4.1.4 "Definition of the TSE2002av Serial Presence Detect (SPD) EEPROM with Temperature Sensor (TS) for Memory Module Applications"