Difficulty inspecting Processor Model on Windows

I’ve been trying to build an analysis to map Processor Models and Families to Intel codenames, since they refuse to say “Firmware for Core i5 6th Generation” and instead say “It’s for Skylake”.

Been tearing my hair out as to why I can’t get my workstation’s processor model to map correctly to the lists at https://software.intel.com/en-us/articles/intel-architecture-and-processor-identification-with-cpuid-model-and-family-numbers or a4lg.com | x86 Families and Models List

As it turns out, the Inspector is giving me the wrong results.

My workstation, which is an E5-1620, is returning weird model information from the BigFix inspectors:

q: unique values of vendor names of processors
A: GenuineIntel

q: unique values of model names of processors
A: Intel(R) Xeon(R) CPU E5-1620 0 @ 3.60GHz

q: unique values of models of processors 
A: 13

q: unique values of models of processors as hexadecimal
A: d

q: unique values of families of processors
A: 6

q: unique values of steppings of processors
A: 7

Checking Intel’s table from the earlier link, my Processor Family should be returning 0x2d, but is actually giving 0x0d (which corresponds to a mobile Pentium-M processor).

I downloaded Intel’s Processor Identification Utility and it’s giving me Type 0, Family 6, Model 2D, Stepping 7. So all of the same information as BigFix except for the Model.

I’ve set up an Analysis in my environment, and all of my systems with this particular processor are giving model 0x0d rather than model 0x2d. I’m getting this 0x0d model for Xeon E5-1620, E5-2603, E5-2620, E5-2630, E5-2640, and E5-2687W processors.

From where does the BES client retrieve this data, and any idea why it would be wrong and mismatch Intel’s CPU utility?

1 Like

CC: @AlanM

This does sound like an inspector issue on the platform side.

I wonder if the correct info is in WMI or if it is incorrect there as well.

Much appreciated. If I can find something like “we get it from WMI” or “we get it from SMBIOS” or something then I’ll know where to look to see if something else is giving the wrong results.

1 Like

I think BigFix tries DMI first, then SMBIOS or something like that. It also looks in the registry sometimes for some things.

I found a lot of inconsistencies when looking for BIOS version info, but I’m surprised that it would be true of this.

Ooh this is interesting too. Now that I’ve had time for some more results to come back from my Analysis, I see that all 45 of my Red Hat systems on the E5-1620 processor are correctly returning 0x2d for the processor model, but all 542 of my Windows platforms are incorrectly giving 0x0d. This includes 21 Win7, and 521 of mixed Win10 1607 and Win10 1709.

Also all the Win clients are at 9.5.7 and the Linux are at 9.2.9.

The 9.2.9 fixlet debugger on Windows also gives the incorrect 0x0d result though.

Yep, seems pretty consistent…Windows clients on E5-1620, E5-1620v2, E5-1620v3, E5-1650 v2, E5-1660 v3, and E5-2603 are giving weird processor model results of 0x0d, 0x0e, or 0x0c; while Linux machines across these processors are all giving 0x2d.

1 Like

I opened up a case on this - TS000131554

1 Like

I wonder if 9.5 on linux would give the incorrect result?

I wonder if on linux it is getting the info from DMI while on windows it is getting it from SMBIOS or something like that.

Will be testing that in the case jgstew :smile:
looking at it now and will probably open an RTC for it tomorrow.

1 Like

In the case, I was pointed back to @jgstew’s analysis at https://www.bigfix.me/analysis/details/2994710

The model is broken up into two fields which have to be read separately (on Windows at least) which leads to

(if (exists families whose(it = 6 OR it = 15) of processors) then (it as integer) of ((left shift 4 of (it as bit set) of unique value of extended models of processors) + ((it as bit set) of unique value of models of processors)) else (unique value of models of processors)) as hexadecimal

This gives me correct results on Windows clients. Not sure about Linux - my Linux hosts are still on the 9.2.x client and don’t have an “extended model” property. But on these Linux clients the “model” property is already giving the correct value.

Does anyone have a 9.5.x Linux client where they could check the result for me?

So that is this? : https://www.bigfix.me/cdb/relevance/2999247

So many ways to get the same info.

Yes, the same (plus cast as hexadecimal). I just don’t have any Linux 9.5 clients yet to know whether this works on those.

As I read it, if ‘models of processors’ is already correct on Linux, then adding the extended model would make it incorrect.

A slight modification I’m using now, that seems to work on both Windows and Linux, is

((if (exists families whose(it = 6 OR it = 15) of processors) then (it as integer) of ((left shift 4 of (it as bit set) of unique value of extended models of processors) + ((it as bit set) of unique value of models of processors)) else (unique value of models of processors)) as hexadecimal) | (unique value of models of processors as hexadecimal)

According to http://support.bigfix.com/cgi-bin/inspectorsearch/single_inspector.cgi?cpx=p&keyphrase=extended+model+of+%26lt%3Bprocessor%26gt%3B&type=processor&win=WinSkip&lin=LinSkip&hpux=HPUXSkip&mac=MacSkip&aix=AIXSkip&sol=SolSkip&wm=WMSkip&ubu=UbuSkip&client=on&core=on&session=on&regex=on, the ‘extended model of processor’ and ‘extended family of processor’ are Windows-only; on Linux, these return error ‘’ and the “model of processor” property is already returning the correct value.

I’m using the pipe operator “|” to handle the error on Linux hosts and return the ‘model of processor’ result in that case.

1 Like

I ripped it apart and put it back together:

(it as hexadecimal) of ( if (exists families whose(it = 6 OR it = 15) of processors) then (it as integer) of ((left shift 4 of (it as bit set) of unique value of extended models of processors) + ((it as bit set) of unique value of models of processors)) else NULL | unique value of models of processors )

Probably not any more efficient, but less stuff. Should be equivalent.

@jgstew I think you may need to revist the relevance for “DisplayFamily” at https://www.bigfix.me/analysis/details/2994710

if (15 != unique value of families of processors) then (unique value of families of processors) else (it as integer) of ((left shift 4 of (it as bit set) of unique value of extended families of processors) + ((it as bit set) of unique value of families of processors)) /* http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-vol-2a-manual.html DisplayFamily */

Per the Intel guide referenced:

The Extended Family ID needs to be examined only when the Family ID is 0FH. Integrate the fields into a display
using the following rule:
IF Family_ID ≠ 0FH
THEN DisplayFamily = Family_ID;
ELSE DisplayFamily = Extended_Family_ID + Family_ID;
(* Right justify and zero-extend 4-bit field. )
FI;
(
Show DisplayFamily as HEX field. *

There does not appear to be a need to left-shift the bits, and this “jibes” with what I’m seeing (and also appears to correspond with AMD processors). My Windows systems report AMD Opteron 8354 as Family 15, Extended Family 1; my Linux results show Family 16, and Family 16 corresponds with what I’m finding from CPUID websites. Your relevance that left-shifts the values ends up with value 0x1f when it should be 0x10 or decimal 16.

1 Like

That is probably the case, I never actually used this analysis for anything such that I validated the output, though I may have for a single test system.


Revisiting the Intel docs is painful, but here is from “Vol. 2A 3-205”

The Extended Family ID needs to be examined only when the Family ID is 0FH. Integrate the fields into a display using the following rule:

IF Family_ID ≠ 0FH
THEN DisplayFamily = Family_ID;
ELSE DisplayFamily = Extended_Family_ID + Family_ID;
(* Right justify and zero-extend 4-bit field. *)
FI;

Seems like I somehow mixed up parts of one with the one immediately after? Or maybe this part confused me: (* Right justify and zero-extend 4-bit field. *)

I wonder if this is correct for the ELSE case?

(it as integer) of (((it as bit set) of unique value of extended families of processors) + ((it as bit set) of unique value of families of processors))

It isn’t clear to me if it needs to be converted to a bit set before being added together, or if they can just be added together without that? or is it the same in either case?

Adding integers is not the same thing as converting integers to bit sets, adding, then converting back to integers:

Q: (item 0 of it + item 1 of it, (it as integer) of (item 0 of it as bit set + item 1 of it as bit set) ) of (random integer mod 1000, random integer mod 1000) of integers in (1,10)
A: 1201, 685
A: 822, 758
A: 651, 635
A: 938, 767
A: 1025, 1017
A: 1287, 1023
A: 375, 375
A: 1113, 857
A: 1156, 1011
A: 1547, 1019
T: 0.586 ms
I: plural ( integer, integer )

Mathematical unproof.

Not completely sure if I add them as integers, add them as hex, or add them as bitset to get the right answer.

I should have something more definitive by the weekend, but it looks like it’s just numeric addition and then padding the result to represent the hex as 2 digits.

1 Like

From CPUID - Wikipedia

Intel and AMD have suggested applications to display the family of a CPU as the sum of the “Family” and the “Extended Family” fields shown above, and the model as the sum of the “Model” and the 4-bit left-shifted “Extended Model” fields.[5]

If “Family” is different than 6 or 15, only the “Family” and “Model” fields should be used while the “Extended Family” and “Extended Model” bits are reserved.

If “Family” is set to 15, then “Extended Family” and the 4-bit left-shifted “Extended Model” should be added to the respective base values, and if “Family” is set to 6, then only the 4-bit left-shifted “Extended Model” should be added to “Model”.[6][7]

1 Like

Recreating CPUID in Relevance

I’ve spot-checked against at least 20 of my processor models, both Intel and AMD, and so far it looks correct that Model requires a left-shift and Family is just addition.

I’ll split the following into separate properties later, but for now I’m going back to my original task - identify Architecture and Processor Codenames, so when the news says “there’s a firmware for Skylake” I’ll know which systems that covers.

I hope this is helpful for others, AND I hope that others can help me. There are a lot of gaps in the following Family and Model lists. If anyone can add to the list, or tell me which ones I have wrong, I’d appreciate it (all the models in my environment are correct, but I don’t possess every model in this list). I’ll post this on Bigfix.me when I have it a bit more complete.

 /* https://software.intel.com/en-us/articles/intel-architecture-and -processor-identification-with-cpuid-model-and-family-numbers */ /* http://www.cpu-world.com*/ 
 (
   item 3 of it, item 4 of it
 )
 of 
 (
   "Example", "Family(hex)", "Model(hex)", "Microarchitecture Codename", "Processor Codename"; 
"GenuineIntel", "05", "09", "quark", "Clanton" ; 
"GenuineIntel", "06", "06", "Pentium II", "Dixon/Mendocino" ; 
"GenuineIntel", "06", "07", "Pentium III", "Katmai" ; 
"GenuineIntel", "06", "08", "Pentium III", "Coppermine" ; 
"GenuineIntel", "06", "09", "Pentium M uarch=modified p6", "Banias" ; 
"GenuineIntel", "06", "0B", "Pentium III", "Tualatin" ; 
"GenuineIntel", "06", "0D", "Pentium M uarch p6", "Dothan" ; 
"GenuineIntel", "06", "0E", "xeon yonah", "Sossaman/Yona" ; 
"GenuineIntel", "06", "0F", "Merom", "Clovertown/Conroe/Kentsfield/Merom/Tigerton/Woodcrest" ; 
"GenuineIntel", "06", "16", "Merom", "Merom Conroe" ; 
"GenuineIntel", "06", "17", "Penryn", "Yorkfield/Wolfdale/Penryn/Harpertown (DP)" ; 
"GenuineIntel", "06", "1A", "Nahalem", "Bloomfield/Nehalem EP" ;
"GenuineIntel", "06", "1C", "Atom", "Pineview/Silverthorne" ;
"GenuineIntel", "06", "1D", "Penryn", "Dunnington (MP)" ; 
"GenuineIntel", "06", "1E", "Nahalem","Clarksfield/Lynnfield/Jasper Forest" ; 
"GenuineIntel", "06", "25", "Westmere", "Arrandale/Clarksdale" ; 
"GenuineIntel", "06", "26", "Atom", "Lincroft" ; 
"GenuineIntel", "06", "27", "Atom Saltwell Core", "Penwell" ;
"GenuineIntel", "06", "2A", "SandyBridge", "SandyBridge"; 
"GenuineIntel", "06", "2C", "Westmere", "Gulftown/Westmere EP" ;
"GenuineIntel", "06", "2D", "SandyBridge", "Sandy Bridge E/EN/EP" ; 
"GenuineIntel", "06", "2E", "Nahalem", "Nehalem EX" ; 
"GenuineIntel", "06", "2F", "Westmere", "Westmere EX" ; 
"GenuineIntel", "06", "3A", "IvyBridge", "IvyBridge" ; 
"GenuineIntel", "06", "35", "Cloverview", "Cloverview" ; 
"GenuineIntel", "06", "36", "Atom", "Cedarview" ; 
"GenuineIntel", "06", "37", "Atom SoC Silvermont", "Bay Trail" ; 
"GenuineIntel", "06", "3A", "Ivy Bridge", "Ivy Bridge" ; 
"GenuineIntel", "06", "3C", "Haswell", "Haswell LGA1150" ; 
"GenuineIntel", "06", "3D", "Broadwell", "Broadwell" ; 
"GenuineIntel", "06", "3E", "Ivy Bridge", "Ivy Bridge E/EN/EP" ; 
"GenuineIntel", "06", "3F", "Haswell E", "Haswell E" ; 
"GenuineIntel", "06", "46", "Haswell", "Crystal Well" ; 
"GenuineIntel", "06", "4A", "Silvermont", "Merrifield" ; 
"GenuineIntel", "06", "4D", "Silvermont", "Avoton/Rangeley" ; 
"GenuineIntel", "06", "4f", "Broadwell", "Broadwell E" ; 
"GenuineIntel", "06", "5A", "Silvermont", "Moorefield" ; 
"GenuineIntel", "06", "5e", "Skylake", "Skylake" ; 
"GenuineIntel", "0B", "01", "Xeon Phi", "Knights Corner" ; 
"GenuineIntel", "0F", "01", "Pentium 4", "Willamette/Foster" ; 
"GenuineIntel", "0F", "02", "Pentium 4", "Gallatin/Northwood/Prestonia" ; 
"GenuineIntel", "0F", "03", "Prescott", "Prescott/Nocona/Irwindale" ; 
"GenuineIntel", "0F", "04", "Prescott", "Prescott/Nocona/Irwindale" ; 
"GenuineIntel", "0F", "06", "Presler", "Cedar Mill/Presler" ; 
"GenuineIntel", "0F", "07", "Pentium 4", "Irwindale" ; 
"GenuineIntel", "1F", "03", "Itanium-2", "Madison" ; 
"GenuineIntel", "20", "00", "Itanium", "Montecito" ; 
"GenuineIntel", "20", "01", "Itanium", "Montvale" ; 
"GenuineIntel", "20", "02", "Itanium", "Tukwila" ; 
"GenuineIntel", "21", "00", "Itanium", "Poulson"; 
"AuthenticAMD", "06", "0d", "QEMU", "QEMU Virtual Processor"; 
"AuthenticAMD", "10", "02", "K10", "Opteron Third Generation"; 
"AuthenticAMD", "10", "09", "K10", "Opteron 6100 series"; 
"AuthenticAMD", "15", "01", "Bulldozer", "Opteron 6200 series"; 
"AuthenticAMD", "15", "02", "Piledriver", "Opteron 6300 series"; 
"AuthenticAMD", "0f", "02", "K10", "Opteron Third Generation"; 
"AuthenticAMD", "0f", "09", "K10", "Opteron 6100 series"; 
"PowerPC_POWER6", "", "", "PowerPC", "POWER6"; 
"PowerPC_POWER7", "", "", "PowerPC", "POWER7"
 )
 whose
 (
   (
 (
   if
     exists property "vendor name" of type "processor" 
   then
     unique value of vendor names of processors 
   else
     unique value of families of processors as string
 )
 = item 0 of it
   )
  AND
   (
 item 1 of it = "" 
OR
 (
   if
     not exists property "family" of type "processor" 
   then
     false 
   else
     (
       (
         (
           (
             (
               if
                 (
                   exists families 
                   whose
                   (
                     it = 15
                   )
                   of processors
                 )
               then
                 (
                   (
                     it as integer
                   )
                   of 
                   (
                     unique value of families of processors + unique value of extended families of processors
                   )
                 )
               else
                 (
                   unique value of families of processors
                 )
             )
           )
           | 
           (
             unique value of families of processors
           )
         )
         = hexadecimal integer 
         (
           item 1 of it
         )
       )
     )
 )
   )
  AND
   (
 item 2 of it = "" 
OR
 (
   if
     not exists property "model" of type "processor" 
   then
     false 
   else
     (
       (
         (
           if
             (
               exists families 
               whose
               (
                 it = 6 
                OR
                 it = 15
               )
               of processors
             )
           then
             (
               it as integer
             )
             of 
             (
               (
                 left shift 4 of 
                 (
                   it as bit set
                 )
                 of unique value of extended models of processors
               )
               + 
               (
                 (
                   it as bit set
                 )
                 of unique value of models of processors
               )
             )
           else
             (
               unique value of models of processors
             )
         )
       )
       | 
       (
         unique value of models of processors
       )
     )
     = hexadecimal integer 
     (
       item 2 of it
     )
 )
   )
 )

Edit: Looks like PowerPC doesn’t have a ‘Family’ or ‘Model’ property, will do some more edge-case checks tomorrow.

Edit 2: Updated the query to handle PowerPC, matching the list against “families of processors as string” if the “vendor name of processor” property does not exist.

2 Likes

This makes my head hurt.

Nice! It definitely makes sense to investigate as separate and combined properties.

It is like a dream of mine to basically recreate CPU-Z / GPU-Z / Speccy in a client technician dashboard, plus other things.