Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

[Question] About Intel Processor Trace IP filtering range

duyptduypt Member Posts: 3

I just posted this question on intel forum but no one seem to be able to help so I repost it here. Please help me if you can.

https://community.intel.com/t5/Processors/Question-about-Intel-Processor-Trace/m-p/1310632#M53318

I'm choosing my CPU based on a very low level feature Intel Processor Trace(intelpt). The Combined Volume Set of Intel® 64 and IA-32 Architectures Software Developer’s Manulal said that each processor can have up to 4 intelpt filtering range. The number of supported range can be checked via CPUID(eax=14h, ecx=1). I looked at the 11gen core i9 in my office but it seems only support 2 range (not sure if I check correctly). My questions are:

  • Is there any processor support the maximum 4 ip filtering range ?
  • How can I check the number without the having to buy the actual processor (the value is documented in some specs some where ?)
  • How many range do the X-series/Xeon-W/Xeon scalelable famliy processor support ? It's best if you can give a detailed list of how many range each cpu supported.
    I attached the python3 script I use to check the value in the attachment. The script is fairly short and absolutely non-malicious. All it does is execute cpuid instruction and print out the result. The script should work on both Linux and windows. If you have any intel processor please help me run the script and feedback the value. Thanks alot

Comments

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 14,093

    I'm curious to know what you're doing that would seem to require 4 ranges.

    The Linux kernel has supported the intelpt feature nearly since the beginning (2015). All the Linux kernel code I can find is limited to 2 ranges. From that, I suspect there are no architectures that include 4.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

  • duyptduypt Member Posts: 3
    edited September 4

    I write fuzzer. If you check the The Combined Volume Set of Intel® 64 and IA-32 Architectures Software Developer’s Manulal. A processor can support up to 4 range. I also asked here https://github.com/trailofbits/Honeybee/issues/5. She mentioned that her laptop processor support 4 but I'm looking for a desktop CPU

  • rusakov2rusakov2 Member Posts: 54

    Ran your script on Xeon E5-2630 based desktop. It returned 0.

  • duyptduypt Member Posts: 3

    @rusakov2 said:
    Ran your script on Xeon E5-2630 based desktop. It returned 0.

    It's so old already. It might not support ip filtering at all

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 15 November 2021 Live, Online
Writing WDF Drivers TBD Live, Online
Developing Minifilters 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online