Difficulty inspecting Processor Model on Windows

@jgstew I think you may need to revist the relevance for “DisplayFamily” at https://www.bigfix.me/analysis/details/2994710

if (15 != unique value of families of processors) then (unique value of families of processors) else (it as integer) of ((left shift 4 of (it as bit set) of unique value of extended families of processors) + ((it as bit set) of unique value of families of processors)) /* http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-vol-2a-manual.html DisplayFamily */

Per the Intel guide referenced:

The Extended Family ID needs to be examined only when the Family ID is 0FH. Integrate the fields into a display
using the following rule:
IF Family_ID ≠ 0FH
THEN DisplayFamily = Family_ID;
ELSE DisplayFamily = Extended_Family_ID + Family_ID;
(* Right justify and zero-extend 4-bit field. )
FI;
(
Show DisplayFamily as HEX field. *

There does not appear to be a need to left-shift the bits, and this “jibes” with what I’m seeing (and also appears to correspond with AMD processors). My Windows systems report AMD Opteron 8354 as Family 15, Extended Family 1; my Linux results show Family 16, and Family 16 corresponds with what I’m finding from CPUID websites. Your relevance that left-shifts the values ends up with value 0x1f when it should be 0x10 or decimal 16.

1 Like

That is probably the case, I never actually used this analysis for anything such that I validated the output, though I may have for a single test system.


Revisiting the Intel docs is painful, but here is from “Vol. 2A 3-205”

The Extended Family ID needs to be examined only when the Family ID is 0FH. Integrate the fields into a display using the following rule:

IF Family_ID ≠ 0FH
THEN DisplayFamily = Family_ID;
ELSE DisplayFamily = Extended_Family_ID + Family_ID;
(* Right justify and zero-extend 4-bit field. *)
FI;

Seems like I somehow mixed up parts of one with the one immediately after? Or maybe this part confused me: (* Right justify and zero-extend 4-bit field. *)

I wonder if this is correct for the ELSE case?

(it as integer) of (((it as bit set) of unique value of extended families of processors) + ((it as bit set) of unique value of families of processors))

It isn’t clear to me if it needs to be converted to a bit set before being added together, or if they can just be added together without that? or is it the same in either case?

Adding integers is not the same thing as converting integers to bit sets, adding, then converting back to integers:

Q: (item 0 of it + item 1 of it, (it as integer) of (item 0 of it as bit set + item 1 of it as bit set) ) of (random integer mod 1000, random integer mod 1000) of integers in (1,10)
A: 1201, 685
A: 822, 758
A: 651, 635
A: 938, 767
A: 1025, 1017
A: 1287, 1023
A: 375, 375
A: 1113, 857
A: 1156, 1011
A: 1547, 1019
T: 0.586 ms
I: plural ( integer, integer )

Mathematical unproof.

Not completely sure if I add them as integers, add them as hex, or add them as bitset to get the right answer.

I should have something more definitive by the weekend, but it looks like it’s just numeric addition and then padding the result to represent the hex as 2 digits.

1 Like

From CPUID - Wikipedia

Intel and AMD have suggested applications to display the family of a CPU as the sum of the “Family” and the “Extended Family” fields shown above, and the model as the sum of the “Model” and the 4-bit left-shifted “Extended Model” fields.[5]

If “Family” is different than 6 or 15, only the “Family” and “Model” fields should be used while the “Extended Family” and “Extended Model” bits are reserved.

If “Family” is set to 15, then “Extended Family” and the 4-bit left-shifted “Extended Model” should be added to the respective base values, and if “Family” is set to 6, then only the 4-bit left-shifted “Extended Model” should be added to “Model”.[6][7]

1 Like

Recreating CPUID in Relevance

I’ve spot-checked against at least 20 of my processor models, both Intel and AMD, and so far it looks correct that Model requires a left-shift and Family is just addition.

I’ll split the following into separate properties later, but for now I’m going back to my original task - identify Architecture and Processor Codenames, so when the news says “there’s a firmware for Skylake” I’ll know which systems that covers.

I hope this is helpful for others, AND I hope that others can help me. There are a lot of gaps in the following Family and Model lists. If anyone can add to the list, or tell me which ones I have wrong, I’d appreciate it (all the models in my environment are correct, but I don’t possess every model in this list). I’ll post this on Bigfix.me when I have it a bit more complete.

 /* https://software.intel.com/en-us/articles/intel-architecture-and -processor-identification-with-cpuid-model-and-family-numbers */ /* http://www.cpu-world.com*/ 
 (
   item 3 of it, item 4 of it
 )
 of 
 (
   "Example", "Family(hex)", "Model(hex)", "Microarchitecture Codename", "Processor Codename"; 
"GenuineIntel", "05", "09", "quark", "Clanton" ; 
"GenuineIntel", "06", "06", "Pentium II", "Dixon/Mendocino" ; 
"GenuineIntel", "06", "07", "Pentium III", "Katmai" ; 
"GenuineIntel", "06", "08", "Pentium III", "Coppermine" ; 
"GenuineIntel", "06", "09", "Pentium M uarch=modified p6", "Banias" ; 
"GenuineIntel", "06", "0B", "Pentium III", "Tualatin" ; 
"GenuineIntel", "06", "0D", "Pentium M uarch p6", "Dothan" ; 
"GenuineIntel", "06", "0E", "xeon yonah", "Sossaman/Yona" ; 
"GenuineIntel", "06", "0F", "Merom", "Clovertown/Conroe/Kentsfield/Merom/Tigerton/Woodcrest" ; 
"GenuineIntel", "06", "16", "Merom", "Merom Conroe" ; 
"GenuineIntel", "06", "17", "Penryn", "Yorkfield/Wolfdale/Penryn/Harpertown (DP)" ; 
"GenuineIntel", "06", "1A", "Nahalem", "Bloomfield/Nehalem EP" ;
"GenuineIntel", "06", "1C", "Atom", "Pineview/Silverthorne" ;
"GenuineIntel", "06", "1D", "Penryn", "Dunnington (MP)" ; 
"GenuineIntel", "06", "1E", "Nahalem","Clarksfield/Lynnfield/Jasper Forest" ; 
"GenuineIntel", "06", "25", "Westmere", "Arrandale/Clarksdale" ; 
"GenuineIntel", "06", "26", "Atom", "Lincroft" ; 
"GenuineIntel", "06", "27", "Atom Saltwell Core", "Penwell" ;
"GenuineIntel", "06", "2A", "SandyBridge", "SandyBridge"; 
"GenuineIntel", "06", "2C", "Westmere", "Gulftown/Westmere EP" ;
"GenuineIntel", "06", "2D", "SandyBridge", "Sandy Bridge E/EN/EP" ; 
"GenuineIntel", "06", "2E", "Nahalem", "Nehalem EX" ; 
"GenuineIntel", "06", "2F", "Westmere", "Westmere EX" ; 
"GenuineIntel", "06", "3A", "IvyBridge", "IvyBridge" ; 
"GenuineIntel", "06", "35", "Cloverview", "Cloverview" ; 
"GenuineIntel", "06", "36", "Atom", "Cedarview" ; 
"GenuineIntel", "06", "37", "Atom SoC Silvermont", "Bay Trail" ; 
"GenuineIntel", "06", "3A", "Ivy Bridge", "Ivy Bridge" ; 
"GenuineIntel", "06", "3C", "Haswell", "Haswell LGA1150" ; 
"GenuineIntel", "06", "3D", "Broadwell", "Broadwell" ; 
"GenuineIntel", "06", "3E", "Ivy Bridge", "Ivy Bridge E/EN/EP" ; 
"GenuineIntel", "06", "3F", "Haswell E", "Haswell E" ; 
"GenuineIntel", "06", "46", "Haswell", "Crystal Well" ; 
"GenuineIntel", "06", "4A", "Silvermont", "Merrifield" ; 
"GenuineIntel", "06", "4D", "Silvermont", "Avoton/Rangeley" ; 
"GenuineIntel", "06", "4f", "Broadwell", "Broadwell E" ; 
"GenuineIntel", "06", "5A", "Silvermont", "Moorefield" ; 
"GenuineIntel", "06", "5e", "Skylake", "Skylake" ; 
"GenuineIntel", "0B", "01", "Xeon Phi", "Knights Corner" ; 
"GenuineIntel", "0F", "01", "Pentium 4", "Willamette/Foster" ; 
"GenuineIntel", "0F", "02", "Pentium 4", "Gallatin/Northwood/Prestonia" ; 
"GenuineIntel", "0F", "03", "Prescott", "Prescott/Nocona/Irwindale" ; 
"GenuineIntel", "0F", "04", "Prescott", "Prescott/Nocona/Irwindale" ; 
"GenuineIntel", "0F", "06", "Presler", "Cedar Mill/Presler" ; 
"GenuineIntel", "0F", "07", "Pentium 4", "Irwindale" ; 
"GenuineIntel", "1F", "03", "Itanium-2", "Madison" ; 
"GenuineIntel", "20", "00", "Itanium", "Montecito" ; 
"GenuineIntel", "20", "01", "Itanium", "Montvale" ; 
"GenuineIntel", "20", "02", "Itanium", "Tukwila" ; 
"GenuineIntel", "21", "00", "Itanium", "Poulson"; 
"AuthenticAMD", "06", "0d", "QEMU", "QEMU Virtual Processor"; 
"AuthenticAMD", "10", "02", "K10", "Opteron Third Generation"; 
"AuthenticAMD", "10", "09", "K10", "Opteron 6100 series"; 
"AuthenticAMD", "15", "01", "Bulldozer", "Opteron 6200 series"; 
"AuthenticAMD", "15", "02", "Piledriver", "Opteron 6300 series"; 
"AuthenticAMD", "0f", "02", "K10", "Opteron Third Generation"; 
"AuthenticAMD", "0f", "09", "K10", "Opteron 6100 series"; 
"PowerPC_POWER6", "", "", "PowerPC", "POWER6"; 
"PowerPC_POWER7", "", "", "PowerPC", "POWER7"
 )
 whose
 (
   (
 (
   if
     exists property "vendor name" of type "processor" 
   then
     unique value of vendor names of processors 
   else
     unique value of families of processors as string
 )
 = item 0 of it
   )
  AND
   (
 item 1 of it = "" 
OR
 (
   if
     not exists property "family" of type "processor" 
   then
     false 
   else
     (
       (
         (
           (
             (
               if
                 (
                   exists families 
                   whose
                   (
                     it = 15
                   )
                   of processors
                 )
               then
                 (
                   (
                     it as integer
                   )
                   of 
                   (
                     unique value of families of processors + unique value of extended families of processors
                   )
                 )
               else
                 (
                   unique value of families of processors
                 )
             )
           )
           | 
           (
             unique value of families of processors
           )
         )
         = hexadecimal integer 
         (
           item 1 of it
         )
       )
     )
 )
   )
  AND
   (
 item 2 of it = "" 
OR
 (
   if
     not exists property "model" of type "processor" 
   then
     false 
   else
     (
       (
         (
           if
             (
               exists families 
               whose
               (
                 it = 6 
                OR
                 it = 15
               )
               of processors
             )
           then
             (
               it as integer
             )
             of 
             (
               (
                 left shift 4 of 
                 (
                   it as bit set
                 )
                 of unique value of extended models of processors
               )
               + 
               (
                 (
                   it as bit set
                 )
                 of unique value of models of processors
               )
             )
           else
             (
               unique value of models of processors
             )
         )
       )
       | 
       (
         unique value of models of processors
       )
     )
     = hexadecimal integer 
     (
       item 2 of it
     )
 )
   )
 )

Edit: Looks like PowerPC doesn’t have a ‘Family’ or ‘Model’ property, will do some more edge-case checks tomorrow.

Edit 2: Updated the query to handle PowerPC, matching the list against “families of processors as string” if the “vendor name of processor” property does not exist.

2 Likes

This makes my head hurt.

Nice! It definitely makes sense to investigate as separate and combined properties.

It is like a dream of mine to basically recreate CPU-Z / GPU-Z / Speccy in a client technician dashboard, plus other things.

The specific information mentioned comes from the CPUID instruction so therefore from the processor itself. Specifically from this request - see https://en.wikipedia.org/wiki/CPUID#EAX=1:_Processor_Info_and_Feature_Bits

There is also an “extended family” property of a processor so perhaps the other application is combining these elements which is also indicated is often done with the flag bits but we just provide the raw values for usage. See https://developer.bigfix.com/relevance/reference/processor.html#extended-family-of-processor-integer

Thanks, Alan. I just find it curious that Windows and Linux clients return the results differently.

The Linux client gives the return values in a single “model” and “family” value and doesn’t provide “extended model” or “extended family” at all, while the Windows client returns these as separate values.

I’d have to guess that the Linux client is retrieving this from some place that has already processed the result, from /proc/cpuinfo or similar; the values in /proc/cpuinfo appear to already be “cooked”.

And yes you found the source of the Linux inspector data :slight_smile:

We try to not “precombine” things in relevance giving as low as possible information so it can be used in some unexpected way at a later point

@JasonWalker your mappings look pretty comprehensive. Is there way to do this in relevance natively, for example have a retrieved property return something like this on the fly -

“GenuineIntel”, “06”, “5e”, “Skylake”, “Skylake”

OR even just Skylake if the processor is GenuineIntel, and the result of the relevance is 5e

q: (it as hexadecimal) of ( if (exists families whose(it = 6 OR it = 15) of processors) then (it as integer) of ((left shift 4 of (it as bit set) of unique value of extended models of processors) + ((it as bit set) of unique value of models of processors)) else NULL | unique value of models of processors )
A: 5e

Absolutely, you can create separate properties out of each part of the relevance. In fact in the analysis I use internally, I do just that - one property for “family of processor”, another for “extended family of processor”, etc.
I use this large lookup to map the results back to codenames. It’s native relevance, I’ve checked on Windows, Linux, and AIX (though “PowerPC_7” is probably a little less useful). I don’t have any Mac to test on but I expect it should work.

1 Like

If you mean a native property that would return “Skylake” without creating a lookup mapping, then…no, at least no property that I could find. I don’t think think the processors or bios have the “Skylake” -type codenames embedded anywhere.

I’m pretty sure that the CPUID utility needs to be updated for each new processor release for this same reason. You can retrieve model, extended model, family, and extended family right from the CPU but not codename mappings.

1 Like

@JasonWalker makes sense. We can probably do the lookup in SQL based on the results from the properties.

All i need i’m guessing is the Family (hex) and Model (hex) as RP’s. I have processor name already.

Do you have the Family (hex) and Model (hex) to share ? I see a bunch of relevance in the post, not sure which ones are the most current.

Great work though !

To handle them correctly, you have to merge “extended model” and “model” of processor, as well as “extended family” and “family” (on Windows anyway). I think the rules with how to merge are already discussed in this thread. In the end here are a couple of properties I have in my Analysis to deal with it:

Processor DisplayModel:
/* https://www.bigfix.me/analysis/details/2994710 */ /* http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-vol-2a-manual.html DisplayModel */ /* Also Linux 9.2.x lacks 'extended models of processors' so if there's an error failback to 'models of processors' */

((if (exists families whose(it = 6 OR it = 15) of processors) then (it as integer) of ((left shift 4 of (it as bit set) of unique value of extended models of processors) + ((it as bit set) of unique value of models of processors)) else (unique value of models of processors)) as hexadecimal) | (unique value of models of processors as hexadecimal)

Processor DisplayFamily:

/* https://www.bigfix.me/analysis/details/2994710 */ /* http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-vol-2a-manual.html DisplayModel */ /* Also Linux 9.2.x lacks 'extended models of processors' so if there's an error failback to 'models of processors' */

((if (exists families whose(it = 15) of processors) then (it as integer) of (unique value of families of processors + unique value of extended families of processors as hexadecimal) else (unique value of families of processors)) as hexadecimal) | (unique value of families of processors as hexadecimal)

1 Like

Thanks @JasonWalker and others who have contributed.

This has been an interesting thread and very instructive on some of the more esoteric bits of relevance that I’d not normally go anywhere near.

this is great work !

Thanks for this @JasonWalker
Im seeing Processor family 6 but Processor Models 4e, 8e, 9e and 45 that are reporting as “none”. Trying to find the Processor Family name.
From q: unique values of (name of it as string as trimmed string & “=” & it as string as trimmed string) of values of structures “processor_information” of smbios

I get the following. This is for a Family 6 Processor model 4e for instance. (Surface Book)
A: =4
A: asset_tag=To Be Filled By O.E.M.
A: core_count=2
A: core_enabled=2
A: current_speed=2500
A: external_clock=100
A: l1_cache_handle=9
A: l2_cache_handle=10
A: l3_cache_handle=11
A: max_speed=0
A: part_number=To Be Filled By O.E.M.
A: processor_characteristics=252
A: processor_family=198
A: processor_family_2=198
A: processor_id=-4617319920302815517
A: processor_manufacturer=Intel® Corporation
A: processor_type=3
A: processor_upgrade=51
A: processor_version=Intel® Core™ i7-6600U CPU @ 2.60GHz
A: serial_number=To Be Filled By O.E.M.
A: socket_designation=U3E1
A: status=65
A: thread_count=4
A: voltage=137
T: 1.374 ms

What do you get as results for “Model” and “Family” of these? And do you know what the Microarchitecture and Processor codenames should be?

/* https://www.bigfix.me/analysis/details/2994710 */ /* http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-vol-2a-manual.html DisplayModel */ /* Also Linux 9.2.x lacks 'extended models of processors' so if there's an error failback to 'models of processors' */

((if (exists families whose(it = 6 OR it = 15) of processors) then (it as integer) of ((left shift 4 of (it as bit set) of unique value of extended models of processors) + ((it as bit set) of unique value of models of processors)) else (unique value of models of processors)) as hexadecimal) | (unique value of models of processors as hexadecimal)

Processor DisplayFamily:

/* https://www.bigfix.me/analysis/details/2994710 */ /* http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-vol-2a-manual.html DisplayModel */ /* Also Linux 9.2.x lacks 'extended models of processors' so if there's an error failback to 'models of processors' */

((if (exists families whose(it = 15) of processors) then (it as integer) of (unique value of families of processors + unique value of extended families of processors as hexadecimal) else (unique value of families of processors)) as hexadecimal) | (unique value of families of processors as hexadecimal)

i get 4e and 6 respectively.
This is the snip from the Intel processor id tool
image (Its a Surface Book, but we do have Dells with the same 4e code returned.) The other codes in my post have all come from your Query code