March 1, 2016 at 17:46A simple example of visualizing the results of a CPUID instruction
There was a time when a lot of useful information about new processors could be fished out from the Intel Processor Identification and the CPUID Instruction . This manual was regularly updated and was full of descriptions of innovations that literally overwhelmed Intel. Unfortunately, since May 2012, the description of the CPUID instruction has migrated to the multi-volume Intel 64 and IA-32 Architectures Software Developer's Manual, and a link to the specified document will forward to one of the volumes of the yarbukh (specifically Vol. 2A ).
From now on, keeping track of innovations has become more difficult. An idea arose with the help of a simple utility to visualize the results of the CPUID in order to monitor the introduction of new products and to be in the know. (The software development process is described here., the latest version is available here ). Actually, there can be no revolutionary novelty in such developments by definition, but the convenience with which we observe the development of the processor park is undeniable. We will verify this assumption by examining the functionality of a processor from the recently appeared SkyLake family. As a test platform, we used a cube server based on the Supermicro X11SSL-F board (thanks to Entry). We’ll be silent about the processor: let him tell everything himself ...
Using the utility, we immediately discover a number of functions that SkyLake processors are equipped with. Let's try to comment on our findings - additions to the architecture of the CPUID instruction associated with the emergence of a new family.
Function 0000000Eh is reserved, the results in the registers are zero.
Function 0000000Fh Platform Quality of Service Monitoring Enumeration, declares functionality that allows you to monitor the use of processor resources by the application. According to the documentation, today such monitoring is implemented only for L3 Cache, although it is possible to add other resources to the list of analyzed ones. Despite the fact that this function is included in the range of functions supported by the processor, the results in the registers are zero. This means that this processor does not support this feature. And the range was increased to add new features with large numbers.
Function 00000010h Platform Quality of Service Enforcement Enumeration , declares functionality that allows the operating system to prioritize applications (threads) when using shared resources. As for the function described above, so far we are only talking about L3 cache. Despite the fact that this function is included in the range of functions supported by the processor, the results in the registers are zero. This means that this processor does not support this feature.
Function 00000011h is reserved, the results in the registers are zero.
Function 00000012h Intel SGX Resource Enumeration declares the capabilities of the Software Guard Extension technology, a security technology that allows you to create enclosed areas within applications. Theoretically, such protection is quite effective, including in situations where the attacking malicious code has the privileges of the supervisor Ring0 (privileged attack), as well as with hardware interception of memory traffic (snooping attack).
The instruction sets SGX1, SGX2 are marked as unsupported, the maximum values for the size of the protected area (enclave size = 1 byte) are not valid. On the other hand, according to the results of the CPUID # 7 function, the support flag SGX = 1. According to the documentation, the processor supports SGX. Possible reasons for this contradiction: Firmware did not initialize SGX resources, for example, if this technology is not included in CMOS Setup or is not supported due to the old version of Firmware. The role of UEFI initialization procedures in the formation of the values of these fields will be the topic of a separate material.
Function 00000013h is reserved, the results in the registers are zero.
The 00000014h Intel Processor Trace Enumeration function declares functionality that provides a trace of program execution with logging information about occurring events, for example, conditional and unconditional jumps, subroutine calls. The protocol is kept in real time. RTIT (Real Time Instruction Trace) trace technology using the MTC (Mini Time Counter) timer is supported by this processor. The acronym COFI stands for Change of Flow Instruction, and defines many events related to conditional and unconditional transfer of control, the monitoring of which can be controlled. A detailed description of this functionality will be the subject of a separate article.
The 00000015h Time Stamp Counter / Core Crystal Clock Information Enumeration function declares the relationship between the TSC and some internal reference frequency source called “Core Crystal Clock”.
The frequency of the indicated reference frequency source is 150 times less than the TSC frequency. According to Intel documentation, one of these sources may be a timer implemented in the processor as part of the Local APIC interrupt controller. This function is declared by the Always Running APIC Timer bit, which emphasizes the functionality of such a timer in various Power-Management states of the processor.
Function 00000016h Processor Frequency Information allows you to read the values of the main clock frequencies of the processor. The returned constants correspond to the processor model; you should not use this function as an alternative to measuring the frequency, otherwise incorrect readings in case of “overclocking” are possible.
As you can see, a number of changes in the CPUID architecture only reserve the capabilities that the processor giant, apparently, intends to use a little later. On the other hand, instructions that have not yet been implemented, but described in advance, are considered implemented in Odessa.
From now on, keeping track of innovations has become more difficult. An idea arose with the help of a simple utility to visualize the results of the CPUID in order to monitor the introduction of new products and to be in the know. (The software development process is described here., the latest version is available here ). Actually, there can be no revolutionary novelty in such developments by definition, but the convenience with which we observe the development of the processor park is undeniable. We will verify this assumption by examining the functionality of a processor from the recently appeared SkyLake family. As a test platform, we used a cube server based on the Supermicro X11SSL-F board (thanks to Entry). We’ll be silent about the processor: let him tell everything himself ...
Using the utility, we immediately discover a number of functions that SkyLake processors are equipped with. Let's try to comment on our findings - additions to the architecture of the CPUID instruction associated with the emergence of a new family.
CPUID = 0000000Eh
Function 0000000Eh is reserved, the results in the registers are zero.
CPUID = 0000000Fh
Function 0000000Fh Platform Quality of Service Monitoring Enumeration, declares functionality that allows you to monitor the use of processor resources by the application. According to the documentation, today such monitoring is implemented only for L3 Cache, although it is possible to add other resources to the list of analyzed ones. Despite the fact that this function is included in the range of functions supported by the processor, the results in the registers are zero. This means that this processor does not support this feature. And the range was increased to add new features with large numbers.
CPUID = 00000010h
Function 00000010h Platform Quality of Service Enforcement Enumeration , declares functionality that allows the operating system to prioritize applications (threads) when using shared resources. As for the function described above, so far we are only talking about L3 cache. Despite the fact that this function is included in the range of functions supported by the processor, the results in the registers are zero. This means that this processor does not support this feature.
CPUID = 00000011h
Function 00000011h is reserved, the results in the registers are zero.
CPUID = 00000012h
Function 00000012h Intel SGX Resource Enumeration declares the capabilities of the Software Guard Extension technology, a security technology that allows you to create enclosed areas within applications. Theoretically, such protection is quite effective, including in situations where the attacking malicious code has the privileges of the supervisor Ring0 (privileged attack), as well as with hardware interception of memory traffic (snooping attack).
The instruction sets SGX1, SGX2 are marked as unsupported, the maximum values for the size of the protected area (enclave size = 1 byte) are not valid. On the other hand, according to the results of the CPUID # 7 function, the support flag SGX = 1. According to the documentation, the processor supports SGX. Possible reasons for this contradiction: Firmware did not initialize SGX resources, for example, if this technology is not included in CMOS Setup or is not supported due to the old version of Firmware. The role of UEFI initialization procedures in the formation of the values of these fields will be the topic of a separate material.
CPUID = 00000013h
Function 00000013h is reserved, the results in the registers are zero.
CPUID = 00000014h
The 00000014h Intel Processor Trace Enumeration function declares functionality that provides a trace of program execution with logging information about occurring events, for example, conditional and unconditional jumps, subroutine calls. The protocol is kept in real time. RTIT (Real Time Instruction Trace) trace technology using the MTC (Mini Time Counter) timer is supported by this processor. The acronym COFI stands for Change of Flow Instruction, and defines many events related to conditional and unconditional transfer of control, the monitoring of which can be controlled. A detailed description of this functionality will be the subject of a separate article.
CPUID = 00000015h
The 00000015h Time Stamp Counter / Core Crystal Clock Information Enumeration function declares the relationship between the TSC and some internal reference frequency source called “Core Crystal Clock”.
- EAX = denominator = denominator = 2
- EBX = numerator = numerator = 12Ch = 300
- Ratio = 300/2
The frequency of the indicated reference frequency source is 150 times less than the TSC frequency. According to Intel documentation, one of these sources may be a timer implemented in the processor as part of the Local APIC interrupt controller. This function is declared by the Always Running APIC Timer bit, which emphasizes the functionality of such a timer in various Power-Management states of the processor.
CPUID = 00000016h
Function 00000016h Processor Frequency Information allows you to read the values of the main clock frequencies of the processor. The returned constants correspond to the processor model; you should not use this function as an alternative to measuring the frequency, otherwise incorrect readings in case of “overclocking” are possible.
- EAX = Processor Base Frequency (MHz) = 0E10h = 3600 MHz
- EBX = Maximum Frequency (MHz) = 0FA0h = 4000 MHz (Turbo Boost)
- ECX = Bus Frequency (MHz) = 064h = 100 MHz (Bus Clock)
- EDX = Reserved = 0
Summary
As you can see, a number of changes in the CPUID architecture only reserve the capabilities that the processor giant, apparently, intends to use a little later. On the other hand, instructions that have not yet been implemented, but described in advance, are considered implemented in Odessa.
