├── .gitmodules ├── README.md ├── bios_template ├── README.md ├── diff.py └── static_log.py ├── msr_document_parser ├── README.md ├── parser.py └── requirements.txt ├── msr_influences ├── README.md ├── data │ └── instructions │ │ ├── aes.csv │ │ ├── cpuid.csv │ │ ├── fence.csv │ │ ├── flush.csv │ │ ├── fp_arith.csv │ │ ├── fp_vector_arith.csv │ │ ├── int_arith.csv │ │ ├── int_vector_arith.csv │ │ ├── load.csv │ │ ├── misc.csv │ │ ├── moves.csv │ │ ├── prefetch.csv │ │ ├── random.csv │ │ ├── store.csv │ │ ├── stride_memory.csv │ │ └── time.csv ├── runner │ ├── CMakeLists.txt │ ├── common.cc │ ├── common.h │ ├── main.cc │ ├── phase1.cc │ ├── phase1.h │ ├── phase2.cc │ ├── phase2.h │ ├── phase3.cc │ ├── phase3.h │ ├── reserved_msr_bits.csv │ ├── unknown_msrs_formatted.csv │ ├── utils.cc │ └── utils.h └── scripts │ ├── invoke-nanobench_combined_dir-v2.sh │ └── prepare_system.sh ├── msr_scans ├── amd-ryzen-threadripper-1920x.csv ├── intel-core-i7-6700k.csv ├── intel-core-i7-8700k.csv ├── intel-core-i9-9900k.csv └── intel-xeon-silver-4208.csv ├── scripts └── sampling │ ├── README.md │ ├── msrs_analyze.py │ └── sample_all.sh └── use_cases ├── aesni_solver ├── Readme.md ├── cache_lookup.py ├── pt_0b65ba59651ff159c67f2185ef34c139.data ├── solve.py └── tables.py └── cpuidtrap ├── Makefile ├── bench.c ├── libfixcpuid.c ├── module ├── Makefile ├── fixcpuid.c └── fixcpuid.h └── test.c /.gitmodules: -------------------------------------------------------------------------------- 1 | [submodule "msr_scanner"] 2 | path = msr_scanner 3 | url = https://github.com/0xhilbert/msrevelio_scanner 4 | [submodule "msr_scanner_original"] 5 | path = msr_scanner_original 6 | url = https://github.com/rizerev/msrs.git 7 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | # Finding and Exploiting CPU Features using MSRTemplating 4 | 5 | This repository contains the source code for the MSRevilio framework from the Symposium on Security and Privacy 2022 paper [Finding and Exploiting CPU Features using MSRTemplating](https://andreaskogler.com/papers/msrtemplating.pdf) by [Andreas Kogler](https://andreaskogler.com), [Daniel Weber](https://twitter.com/weber_daniel), [Martin Haubenwallner](https://twitter.com/rizerev), [Moritz Lipp](https://mlq.me/), [Daniel Gruss](https://gruss.cc) and [Michael Schwarz](https://misc0110.net). 6 | 7 | This document gives a quick illustration of how to build and run the MSR scanner and additional analysis tools. 8 | 9 | ## Building the Tools 10 | 11 | ### Preparations 12 | 13 | First, check out the submodule: 14 | 15 | ``` 16 | git submodule update --recursive --init 17 | ``` 18 | 19 | ### Build and load the kernel module 20 | 21 | To build and load the kernel module, run the following commands: 22 | 23 | ``` 24 | cd msr_scanner/module 25 | make 26 | sudo insmod msrs.ko 27 | ``` 28 | 29 | ### Build tools 30 | 31 | To build the necessary tools, run the following commands: 32 | 33 | ``` 34 | cd msr_scanner/tools 35 | mkdir -p build 36 | CC=gcc-10 CXX=g++-10 cmake .. 37 | make 38 | ``` 39 | 40 | Note: This requires a c++ compiler with c++20 support. We suggest gcc-10 and g++-10. 41 | 42 | ## Run MSR detection 43 | 44 | ### Preperation 45 | 46 | To run the MSR scan, you need to allow to run kernel tasks for a long period: 47 | 48 | echo 0 | sudo tee /proc/sys/kernel/hung_task_timeout_secs 49 | 50 | ### Run Scanner 51 | 52 | To run the actual MSR scan that communicates with the kernel module, run the following command: 53 | 54 | ``` 55 | ./msr_scanner/tools/build/bin/msrs_detect 4 56 | ``` 57 | 58 | where `4` is the number of threads that will be started. 59 | 60 | ### Extract MSR list 61 | 62 | When the scan completes, you can extract the detected MSRs with the following command: 63 | 64 | ``` 65 | ./msr_scanner/tools/build/bin/msrs_ls > msrs.log 66 | ``` 67 | 68 | ## Analyze MSR list 69 | 70 | ### Sample MSRs 71 | 72 | To sample the MSRs over a period of time, you can run the following command: 73 | 74 | ``` 75 | ./scripts/sampling/sample_all.sh 76 | ``` 77 | 78 | An example: 79 | 80 | ``` 81 | ./scripts/sampling/sample_all.sh 1 msrs.log 82 | ``` 83 | 84 | This will create a `sample_all_1_${date}` file. 85 | 86 | ### Analyse samples 87 | 88 | To automatically scan the resulted log file for MSRs that change over time, run the following command: 89 | 90 | ``` 91 | python ./scripts/sampling/msrs_analyze.py sample_all_${duration}_${date} -a changes 92 | ``` 93 | 94 | ## Detect influences of MSR bits on instructions 95 | 96 | Chekout the README.md in [msr_influences](./msr_influences) 97 | 98 | ## BIOS Templating 99 | 100 | Chekout the README.md in [bios_template](./bios_template) 101 | 102 | 103 | # Warnings 104 | **Warning #1**: We are providing this code as-is. You are responsible for protecting yourself, your property and data, and others from any risks caused by this code. This code may cause unexpected and undesirable behavior to occur on your machine. 105 | 106 | **Warning #2**: This code is only for testing purposes. Do not run it on any production systems. Do not run it on any system that might be used by another person or entity. -------------------------------------------------------------------------------- /bios_template/README.md: -------------------------------------------------------------------------------- 1 | ## TL;DR 2 | * Use the msrs_detect and msrs_ls to get a list of available MSRs, save as msrs.txt 3 | * Load msr kernel module (sudo modprobe msr) 4 | * Run `sudo python3 static_log.py msrs.log ` to record all MSR values, store as "" 5 | * Enable/disable a feature in the BIOS 6 | * Run `sudo python3 static_log.py msrs.log ` to record all MSR values, store as "" 7 | * Repeat with as many features as you want (remember to always use a new tag!) 8 | * Run `python3 diff.py results.json` to see MSRs that have different values for different tags 9 | 10 | ## Example 11 | * Enable all features in BIOS 12 | * Run `sudo python3 static_log.py msrs.txt all` 13 | * Disable turbo boost 14 | * Run `sudo python3 static_log.py msrs.txt no-turbo` 15 | * Run `python3 diff.py results.json` 16 | ``` 17 | 1a0: 18 | - 850089: all 19 | - 4000850089: no-turbo 20 | ``` 21 | -------------------------------------------------------------------------------- /bios_template/diff.py: -------------------------------------------------------------------------------- 1 | import json 2 | import sys 3 | import re 4 | 5 | def extract_feature(x): 6 | return re.sub("[0-9]+", "", x) 7 | 8 | if __name__ == "__main__": 9 | db = json.load(open(sys.argv[1])) 10 | blacklist = [] 11 | try: 12 | blacklist = open(sys.argv[2]).read().strip().split("\n") 13 | except: 14 | pass 15 | recordings = len(db["name"]) 16 | features = list(set([ extract_feature(x) for x in db["name"] ])) 17 | print("[+] Found %d recordings" % recordings) 18 | msrs = [] 19 | for record in db["recordings"]: 20 | msrs += record.keys() 21 | msrs = list(set(msrs)) 22 | print("[+] Found %d MSRs" % len(msrs)) 23 | for msr in msrs: 24 | val = [] 25 | for i in range(recordings): 26 | val += db["recordings"][i][msr] 27 | if len(set(val)) > 1: 28 | hist = {} 29 | for i in range(recordings): 30 | v = db["recordings"][i][msr][0] 31 | hist[v] = hist.get(v, []) + [ extract_feature(db["name"][i]) ] 32 | # if a feature has more than one value -> delete it, "noise" 33 | for f in features: 34 | count = 0 35 | for v in hist: 36 | if f in hist[v]: 37 | count += 1 38 | if count > 1: 39 | for v in hist: 40 | if f in hist[v]: 41 | hist[v].remove(f) 42 | 43 | hist_filtered = {} 44 | for v in hist: 45 | fs = list(set(hist[v])) 46 | if len(fs) >= 1: 47 | hist_filtered[v] = fs 48 | 49 | if len(hist_filtered) > 1 and ("%x" % int(msr)) not in blacklist: 50 | print("%8x: " % int(msr)) 51 | for v in hist_filtered: 52 | print(" - %x: %s" % (v, ", ".join(hist_filtered[v]))) 53 | -------------------------------------------------------------------------------- /bios_template/static_log.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import struct 3 | import time 4 | import json 5 | 6 | REPEAT = 5 7 | 8 | def read_msr(msr_index, cpu_index=None): 9 | if cpu_index is not None: 10 | cpus = ["/dev/cpu/%d/msr" % cpu_index] 11 | else: 12 | cpus = sorted(list(glob.glob("/dev/cpu/*/msr"))) 13 | 14 | if not cpus: 15 | print("No CPUs found, did you run 'modprobe msr'?") 16 | return -1 17 | 18 | val = [] 19 | for cpu_msr in cpus: 20 | try: 21 | cpu_msr_dev = open(cpu_msr, "rb") 22 | except IOError: 23 | print("Unable to open %s for reading. You need to be root." % cpu_msr) 24 | return [-1] * len(cpus) 25 | try: 26 | cpu_msr_dev.seek(msr_index, 0) 27 | msr = cpu_msr_dev.read(8) 28 | msr_value = struct.unpack(" " % sys.argv[0]) 39 | sys.exit(1) 40 | 41 | msrs = open(sys.argv[1]).read().strip().split("\n") 42 | print("[+] Scanning %d MSRs" % len(msrs)) 43 | msr_val = {} 44 | for r in range(REPEAT): 45 | for msr in msrs: 46 | idx = int(msr, 16) 47 | msr_val[idx] = msr_val.get(idx, []) + [ read_msr(int(msr, 16), 0)[0] ] 48 | time.sleep(1) 49 | print("[+] Analyzing...") 50 | static = 0 51 | dynamic = 0 52 | for msr in msr_val: 53 | msr_val[msr] = list(set(msr_val[msr])) 54 | if len(msr_val[msr]) > 1: 55 | dynamic +=1 56 | msr_val[msr] = [-2] * REPEAT 57 | else: 58 | static += 1 59 | print("[+] %d static, %d dynamic" % (static, dynamic)) 60 | 61 | try: 62 | db = json.load(open("results.json")) 63 | except: 64 | db = {"recordings": [], "name": []} 65 | 66 | db["recordings"].append(msr_val) 67 | db["name"].append(sys.argv[2]) 68 | 69 | json.dump(db, open("results.json", "w")) 70 | 71 | 72 | -------------------------------------------------------------------------------- /msr_document_parser/README.md: -------------------------------------------------------------------------------- 1 | # Document Parser 2 | 3 | ## Preparations 4 | 5 | Install the required packages: 6 | 7 | ``` 8 | python3 -m pip install -r requirements.txt 9 | ``` 10 | 11 | ## Extract MSRs 12 | 13 | Execute: 14 | 15 | ``` 16 | python3 parser.py manual.pdf 17 | ``` 18 | 19 | ## Tested manuals: 20 | 21 | - **Open-Source Register Reference For AMD Family 17h Processors Models 00h-2Fh** 22 | - sha3=(ac6c836313a5bcecdc259aa92393e5c795c872a82f0c3aaf209c8548) 23 | 24 | - **BIOS and Kernel Developer’s Guide (BKDG) for AMD Family 15h Models 00h-0Fh Processors** 25 | - sha3=(3ceb5c7887b03277188e1451360b27bf0d4d9483e50d0b5be95dd0bd) 26 | 27 | - **Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 4: Model-Specific Registers** 28 | - sha3=(91ff0ef22d25e93ac344767c83b875cce7e258e296a499932a0ff4ce) -------------------------------------------------------------------------------- /msr_document_parser/parser.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | import re 4 | import json 5 | 6 | import click 7 | from poppler import load_from_file 8 | 9 | 10 | #re_msr_description_line = re.compile('(^\s*MSR[0-9A-F]+_[0-9A-F]+)([[0-9A-F]+...[0-9A-F]+][0-9A-F]?)?\ (\[.*\])\ (\(.*\))') 11 | re_amd_msr_description_line = re.compile('^\s*(MSR[0-9A-F]+_[0-9A-F]+)([0-9A-F]+...[0-9A-F]+)?\ (.*)') 12 | re_amd_msr_bitfield_line = re.compile('(^\s*[0-9]+(:[0-9]+)?)') 13 | re_amd_not_table_line = re.compile('^[a-zA-z]+.*$') 14 | 15 | 16 | def parse_amd(pdf_document, reserved): 17 | msrs = {} 18 | 19 | full_text = "" 20 | 21 | for page_idx in range(pdf_document.pages): 22 | page = pdf_document.create_page(page_idx) 23 | text = page.text() 24 | 25 | full_text += text 26 | 27 | # states 28 | begin_msr = False 29 | begin_bits = False 30 | 31 | # info 32 | msr_name = None 33 | msr_address = None 34 | bits = [] 35 | empty_line_counter = 0 36 | 37 | def end_of_msr(): 38 | nonlocal begin_bits 39 | nonlocal msr_name 40 | nonlocal msr_address 41 | nonlocal bits 42 | 43 | msr_address = msr_address.replace("_", "") 44 | 45 | msr = { 46 | 'name': msr_name, 47 | 'address': "0x" + msr_address, 48 | 'bits': bits 49 | } 50 | 51 | if msr_name and msr_address: 52 | if msr_address not in msrs: 53 | msrs[msr_address] = [] 54 | msrs[msr_address].append(msr) 55 | 56 | begin_bits = False 57 | msr_name = None 58 | msr_address = None 59 | bits = [] 60 | 61 | for line in full_text.split("\n"): 62 | # check if MSR begins 63 | match = re_amd_msr_description_line.findall(line) 64 | if match: 65 | if 'is an alias of' in line or 'is aliased to' in line: 66 | continue 67 | 68 | if begin_msr: 69 | end_of_msr() 70 | 71 | begin_msr = True 72 | msr_name = match[0][2] 73 | msr_address = match[0][0][3:] 74 | 75 | if match[0][1] != '': # multi-msr 76 | msr_address += match[0][1] 77 | 78 | continue 79 | 80 | # check rest of msr content 81 | if begin_msr is True: 82 | if 'Bits Description' in line: 83 | begin_bits = True 84 | continue 85 | 86 | if begin_bits is True: 87 | match = re_amd_msr_bitfield_line.findall(line) # description of bits 88 | if match: 89 | msr_bits = match[0][0].strip() 90 | if reserved: 91 | if 'Reserved.' in line: 92 | bits.append(msr_bits) 93 | else: 94 | bits.append(msr_bits) 95 | 96 | if len(line) == 0: 97 | empty_line_counter += 1 98 | 99 | if empty_line_counter > 10: 100 | empty_line_counter = 0 101 | end_of_msr() 102 | 103 | end_of_msr() 104 | 105 | combined = [] 106 | 107 | 108 | for nr, msrs in msrs.items(): 109 | mask = 0 110 | for msr in msrs: 111 | for rev in msr["bits"]: 112 | p = rev.split(":") 113 | if len(p) == 2: 114 | end, begin = int(p[0]), int(p[1]) 115 | 116 | elif len(p) == 1: 117 | end = begin = int(p[0]) 118 | 119 | t = (1 << (end+1)) - 1 120 | 121 | t2 = (1 << (begin)) - 1 122 | t = t & ~t2 123 | mask |= t 124 | names = {} 125 | for msr in msrs: 126 | if not msr["name"] in names: 127 | combined.append({ 128 | 'name': msr["name"], 129 | 'address': msr["address"], 130 | #'bits': msr["bits"], 131 | 'reserved_mask': hex(mask) 132 | }) 133 | names[msr["name"]] = 1 134 | 135 | return combined 136 | 137 | re_intel_msr_description_line = re.compile('^\s*([0-9A-F]+)H\s*[0-9]+\s*([^\s]*)\s*(.*)$') 138 | re_intel_msr_bitfield_line = re.compile('^\s*([0-9]+:?\ ?[0-9]+)\s+(.*)$') 139 | 140 | re_intel_msr_description_line_mline = [re.compile('^\s*([0-9A-F]+)_\s*((IA32_|MSR_)[^\s]*)\s*(.*)$'), re.compile('^\s*([0-9A-F]+)H(.*)$')] 141 | 142 | import subprocess 143 | 144 | def pdftotext(path): 145 | cp = subprocess.run(['pdftotext', '-layout', path, '-'], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, check=True, text=True) 146 | return cp.stdout 147 | 148 | 149 | def parse_intel(pdf_document, reserved): 150 | msrs = {} 151 | 152 | # states 153 | begin_msr = False 154 | begin_msr_table = False 155 | begin_bits = False 156 | 157 | # info 158 | msr_name = None 159 | msr_address = None 160 | bits = [] 161 | 162 | #for page_idx in range(pdf_document.pages): 163 | # page = pdf_document.create_page(page_idx) 164 | # text = page.text() 165 | 166 | text = pdftotext(pdf_document) 167 | 168 | 169 | multiline = False 170 | 171 | for line in text.split("\n"): 172 | # check if MSR begins 173 | if 'Register Name' in line or "MSR Name" in line: 174 | begin_msr_table = True 175 | continue 176 | elif not begin_msr_table: 177 | continue 178 | 179 | if multiline: 180 | match = re_intel_msr_description_line_mline[1].findall(line) 181 | if not match: 182 | print("error") 183 | exit(0) 184 | msr_address += match[0][0] 185 | #print(f"multiline address {msr_address}") 186 | multiline = False 187 | else: 188 | 189 | match = re_intel_msr_description_line.findall(line) 190 | 191 | if not match: 192 | match = re_intel_msr_description_line_mline[0].findall(line) 193 | if match: 194 | multiline = True 195 | 196 | 197 | if match: 198 | if begin_msr is True: 199 | msr = { 200 | 'name': msr_name, 201 | 'address': "0x" + msr_address, 202 | 'bits': bits 203 | } 204 | 205 | #if len(bits) > 0: 206 | if msr_address not in msrs: 207 | msrs[msr_address] = [] 208 | 209 | msrs[msr_address].append(msr) 210 | 211 | begin_bits = False 212 | msr_name = None 213 | msr_address = None 214 | bits = [] 215 | 216 | # new msr 217 | msr_name = match[0][1] 218 | msr_address = match[0][0] 219 | 220 | begin_msr = True 221 | continue 222 | 223 | # sometimes the manual refers to MAXPHYADDR, e.g., IA32_APIC_BASE description 224 | # we just replace that by the highest bit of an MSR 225 | line = line.replace("MAXPHYADDR", "63") 226 | match = re_intel_msr_bitfield_line.findall(line) # description of bits 227 | if match: 228 | if "309" in line: 229 | print(match) 230 | msr_bits = match[0][0].strip().replace(' ', '') 231 | if reserved: 232 | if msr_name == "MSR_PLATFORM_INFO" and "03: Reserved" in line: 233 | print(line, msr_bits) 234 | if 'Reserved' in line: 235 | bits.append(msr_bits) 236 | 237 | if msr_name is not None: 238 | msr = { 239 | 'name': msr_name, 240 | 'address': "0x" + msr_address, 241 | 'bits': bits 242 | } 243 | 244 | #if len(bits) > 0: 245 | if msr_address not in msrs: 246 | msrs[msr_address] = [] 247 | 248 | msrs[msr_address].append(msr) 249 | 250 | 251 | combined = [] 252 | 253 | 254 | for nr, msrs in msrs.items(): 255 | mask = 0 256 | for msr in msrs: 257 | for rev in msr["bits"]: 258 | p = rev.split(":") 259 | if len(p) == 2: 260 | end, begin = int(p[0]), int(p[1]) 261 | 262 | elif len(p) == 1: 263 | end = begin = int(p[0]) 264 | 265 | t = (1 << (end+1)) - 1 266 | 267 | t2 = (1 << (begin)) - 1 268 | t = t & ~t2 269 | mask |= t 270 | names = {} 271 | for msr in msrs: 272 | if not msr["name"] in names: 273 | combined.append({ 274 | 'name': msr["name"], 275 | 'address': msr["address"], 276 | #'bits': msr["bits"], 277 | 'reserved_mask': hex(mask) 278 | }) 279 | names[msr["name"]] = 1 280 | 281 | return combined 282 | 283 | 284 | @click.command() 285 | @click.argument('path', type=click.Path(exists=True)) 286 | @click.option('--reserved/--no-reserved', default=False) 287 | def main(path, reserved): 288 | pdf_document = load_from_file(path) 289 | 290 | if 'AMD' in pdf_document.author: 291 | msrs = parse_amd(pdf_document, reserved) 292 | elif 'Intel' in pdf_document.author: 293 | msrs = parse_intel(path, reserved) 294 | else: 295 | print("Could not detect PDF author") 296 | return -1 297 | 298 | 299 | for msr in msrs: 300 | print(json.dumps(msr)) 301 | 302 | if __name__ == "__main__": 303 | main() 304 | -------------------------------------------------------------------------------- /msr_document_parser/requirements.txt: -------------------------------------------------------------------------------- 1 | click==7.1.2 2 | python-poppler==0.2.2 3 | -------------------------------------------------------------------------------- /msr_influences/README.md: -------------------------------------------------------------------------------- 1 | # Checking for changes in instruction behavior 2 | 3 | ## Setup 4 | - Compile and load [nanoBench](https://github.com/andreas-abel/nanobench) kernel module 5 | - Load msrtools kernel module (`sudo modprobe msr`) 6 | - Change line 16 in `scripts/invoke-nanobench_combined_dir-v2.sh` to nanoBench installation folder 7 | - Works best on a system with fewer noise factors (see `scripts/prepare_system.sh`) 8 | 9 | ## Build Instructions 10 | ``` 11 | cd runner 12 | mkdir build 13 | cd build 14 | cmake .. 15 | make 16 | ``` 17 | 18 | ## Run 19 | Execute the following in the build folder: 20 | ``` 21 | sudo ./msr-uops-runner --calibrate --phase1 --phase2 --phase3 22 | ``` 23 | Afterward, the results should be stored in `flippable_msrs.csv`, `observed_sideeffects.csv`, and `traced_bits.csv` for Phase 1, Phase 2, and Phase 3, respectively. 24 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/aes.csv: -------------------------------------------------------------------------------- 1 | VAESDEC XMM1, XMM2, XMM3 2 | VAESDECLAST XMM1, XMM2, XMM3 3 | VAESENC XMM1, XMM2, XMM3 4 | VAESENCLAST XMM1, XMM2, XMM3 5 | VAESIMC XMM1, XMM2 6 | VAESKEYGENASSIST XMM1, XMM2, 2 7 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/cpuid.csv: -------------------------------------------------------------------------------- 1 | CPUID 2 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/fence.csv: -------------------------------------------------------------------------------- 1 | SFENCE 2 | LFENCE 3 | MFENCE 4 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/flush.csv: -------------------------------------------------------------------------------- 1 | CLFLUSH zmmword ptr [R14] 2 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/fp_arith.csv: -------------------------------------------------------------------------------- 1 | fld qword ptr [rsp + 24] 2 | fld qword ptr [rsp + 8] 3 | fld st(0) 4 | fmul qword ptr [rsp + 16] 5 | fadd st(0), st 6 | fdiv st, st(2) 7 | faddp st(1), st 8 | fmulp st(1), st 9 | fsubp st(1), st 10 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/fp_vector_arith.csv: -------------------------------------------------------------------------------- 1 | vaddpd ymm1, ymm1, ymm1 2 | vsubpd ymm1, ymm1, ymm1 3 | vmulpd ymm1, ymm1, ymm1 4 | vdivpd ymm1, ymm1, ymm1 5 | vsqrtpd ymm1, ymm1 6 | vmaxpd ymm1, ymm1, ymm1 7 | vminpd ymm1, ymm1, ymm1 8 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/int_arith.csv: -------------------------------------------------------------------------------- 1 | add rax, rbx 2 | sub rax, rbx 3 | and rax, rbc 4 | or rax, rbc 5 | mul rax 6 | xor rbx, rbx 7 | inc rbx 8 | idiv rbx 9 | SAL rbx, 8 10 | SAR rbx, 8 11 | SAL rbx, cl 12 | SAR rbx, cl 13 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/int_vector_arith.csv: -------------------------------------------------------------------------------- 1 | vpaddq ymm1, ymm1, ymm1 2 | vpsubq ymm1, ymm1, ymm1 3 | vpmuludq ymm1, ymm1, ymm1 4 | vpsllq ymm1, ymm1, xmm1 5 | vpsrlq ymm1, ymm1, xmm1 6 | vpxor ymm2, ymm1, ymm2 7 | vpand ymm2, ymm1, ymm2 8 | vpor ymm2, ymm1, ymm2 9 | vpabsb ymm2, ymm1 10 | vpcmpgtq ymm1, ymm2, ymm3 11 | vpermilpd YMM1, YMM2, 3 12 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/load.csv: -------------------------------------------------------------------------------- 1 | VMOVAPD YMM2, ymmword ptr [R14] 2 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/misc.csv: -------------------------------------------------------------------------------- 1 | BSWAP ECX 2 | BSWAP RCX 3 | XCHG qword ptr [R14], RDX 4 | MOV RCX, 65 5 | MOV RDI, R14 6 | MOV RSI, R14 7 | rep movsb byte ptr es:[rdi], byte ptr [rsi] 8 | MOV RCX, 65 9 | MOV RDI, R14 10 | MOV RSI, R14 11 | rep stosb byte ptr es:[rdi], al 12 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/moves.csv: -------------------------------------------------------------------------------- 1 | VMOVAPD XMM1, xmmword ptr [R14] 2 | VMOVAPD xmmword ptr [R14], XMM2 3 | VMOVDDUP YMM1, ymmword ptr [R14] 4 | VMOVHPD XMM1, XMM2, qword ptr [R14] 5 | VMOVLPD XMM1, XMM2, qword ptr [R14] 6 | VMOVNTDQ xmmword ptr [R14], XMM2 7 | VMOVNTDQ ymmword ptr [R14], YMM2 8 | VMOVQ XMM1, qword ptr [R14] 9 | VMOVQ qword ptr [R14], XMM2 10 | VMOVSHDUP YMM1, ymmword ptr [R14] 11 | VMOVSLDUP YMM1, ymmword ptr [R14] 12 | VMOVUPD XMM1, xmmword ptr [R14] 13 | VMOVUPD xmmword ptr [R14], XMM2 14 | VMOVUPD YMM1, ymmword ptr [R14] 15 | VMOVUPD ymmword ptr [R14], YMM2 16 | MOVBE RCX, qword ptr [R14] 17 | MOVBE qword ptr [R14], RDX 18 | MOVHPS XMM1, qword ptr [R14] 19 | MOVHPS qword ptr [R14], XMM2 20 | MOVLPS XMM1, qword ptr [R14] 21 | MOVLPS qword ptr [R14], XMM2 22 | MOVDQU XMM1, xmmword ptr [R14] 23 | MOVDQU xmmword ptr [R14], XMM2 24 | MOVHPD XMM1, qword ptr [R14] 25 | MOVHPD qword ptr [R14], XMM2 26 | MOVLPD XMM1, qword ptr [R14] 27 | MOVLPD qword ptr [R14], XMM2 28 | MOVNTDQ xmmword ptr [R14], XMM2 29 | MOVNTI dword ptr [R14], EDX 30 | MOVNTI qword ptr [R14], RDX 31 | MOVNTPD xmmword ptr [R14], XMM2 32 | MOVUPD XMM1, xmmword ptr [R14] 33 | MOVUPD xmmword ptr [R14], XMM2 34 | MOVSHDUP XMM1, xmmword ptr [R14] 35 | MOVSLDUP XMM1, xmmword ptr [R14] 36 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/prefetch.csv: -------------------------------------------------------------------------------- 1 | PREFETCHW zmmword ptr [R14] 2 | PREFETCH zmmword ptr [R14] 3 | PREFETCHNTA zmmword ptr [R14] 4 | PREFETCHT0 zmmword ptr [R14] 5 | PREFETCHT1 zmmword ptr [R14] 6 | PREFETCHT2 zmmword ptr [R14] 7 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/random.csv: -------------------------------------------------------------------------------- 1 | RDRAND RBX 2 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/store.csv: -------------------------------------------------------------------------------- 1 | VMOVAPD ymmword ptr [R14], YMM2 2 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/stride_memory.csv: -------------------------------------------------------------------------------- 1 | MOV EAX, dword ptr [R14] 2 | MOV RAX, qword ptr [R14+128] 3 | MOV RAX, qword ptr [R14+256] 4 | MOV RAX, qword ptr [R14+384] 5 | MOV RAX, qword ptr [R14+512] 6 | MOV RAX, qword ptr [R14+680] 7 | MOV RAX, qword ptr [R14+768] 8 | MOV RAX, qword ptr [R14+896] 9 | MOV RAX, qword ptr [R14+1024] 10 | MOV RAX, qword ptr [R14+1024] 11 | MOV RAX, qword ptr [R14+1024] 12 | MOV RAX, qword ptr [R14+1024] 13 | MOV RAX, qword ptr [R14+1024] 14 | MOV RAX, qword ptr [R14+1024] 15 | MOV RAX, qword ptr [R14+1024] 16 | MOV RAX, qword ptr [R14+1024] 17 | MOV RAX, qword ptr [R14+1024] 18 | -------------------------------------------------------------------------------- /msr_influences/data/instructions/time.csv: -------------------------------------------------------------------------------- 1 | RDTSC 2 | RDTSCP 3 | -------------------------------------------------------------------------------- /msr_influences/runner/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required(VERSION 3.10) 2 | project(msr-uops) 3 | 4 | find_package(Threads REQUIRED) 5 | 6 | # set default build type to release if nothing else is specified 7 | set(default_build_type "Release") 8 | if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES) 9 | message(STATUS "Setting build type to '${default_build_type}' as none was specified.") 10 | # overwrite empty build type 11 | set(CMAKE_BUILD_TYPE "${default_build_type}") 12 | endif() 13 | 14 | 15 | set(CMAKE_CXX_STANDARD 17) 16 | set(CMAKE_CXX_STANDARD_REQUIRED ON) 17 | set(CMAKE_CXX_EXTENSIONS OFF) 18 | set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wall -Werror -Wextra -pedantic") 19 | 20 | set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -O3 -DDEBUGMODE=0") 21 | 22 | set(CMAKE_CXX_FLAGS_RELWITHDEBINFO "${CMAKE_CXX_FLAGS_RELWITHDEBINFO} -DDEBUGMODE=1 -ggdb") 23 | 24 | set(CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} -DDEBUGMODE=1") 25 | set(CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} -D_GLIBCXX_DEBUG") # enable debug features in libcstd++ 26 | set(CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} -fsanitize=address -fsanitize=undefined") 27 | set(CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} -fsanitize-recover=address") 28 | 29 | add_executable(msr-uops-runner 30 | utils.h utils.cc 31 | main.cc utils.h phase2.cc phase2.h phase1.cc phase1.h phase3.cc phase3.h common.cc common.h) 32 | 33 | target_link_libraries(msr-uops-runner PRIVATE Threads::Threads) 34 | -------------------------------------------------------------------------------- /msr_influences/runner/common.cc: -------------------------------------------------------------------------------- 1 | #include "common.h" 2 | 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | // 9 | // external constants 10 | // 11 | const std::string kInstructionFolder = "../../data/instructions"; 12 | const int kBitWindowSize = 4; 13 | // 14 | // internal constants 15 | // 16 | const std::string kPathToNanobenchScript = "../../scripts/invoke-nanobench_combined_dir-v2.sh"; 17 | constexpr double kUpperThresholdDifference = 1.1; // 20% more than reference 18 | constexpr double kLowerThresholdDifference = 0.9; // 20% less than reference 19 | constexpr double kMinimalAbsoluteDifference = 1.0; 20 | constexpr int kConsecutiveRunsForCalibration = 15; 21 | constexpr int kMSRMaxBitSize = 64; 22 | static_assert(kUpperThresholdDifference > 1.0, "Upper threshold has illegal value!"); 23 | static_assert(kLowerThresholdDifference < 1.0, "Lower threshold has illegal value!"); 24 | 25 | int CountBitsToCheck(const std::vector& msrs) { 26 | int bits = 0; 27 | for (const msr_context& msr : msrs) { 28 | bits += msr.bits_to_check.size(); 29 | } 30 | return bits; 31 | } 32 | 33 | void SetCPUAffinity(int cpu) { 34 | cpu_set_t cpuset; 35 | 36 | CPU_ZERO(&cpuset); 37 | CPU_SET(cpu, &cpuset); 38 | int s = pthread_setaffinity_np(pthread_self(), sizeof(cpuset), &cpuset); 39 | if (s != 0) { 40 | fprintf(stderr, "could not set cpu affinity!\n"); 41 | exit(-1); 42 | } 43 | } 44 | 45 | int FlipBits(uint32_t msr, 46 | uint64_t bitmask_to_flip, 47 | bool restore_old_value, 48 | bool accept_write_only_msrs, 49 | const MSRInterface& msr_interface) { 50 | 51 | uint64_t old_value; 52 | int err = msr_interface.Read(msr, &old_value); 53 | if (err && !accept_write_only_msrs) { 54 | PrintWarningMessage("Could not read value of MSR " + ToHex(msr) + "."); 55 | return 1; 56 | } 57 | if (err && !restore_old_value) { 58 | // in case of write-only MSRs we assume the MSR is initially 0 59 | old_value = 0; 60 | } 61 | if (err && restore_old_value) { 62 | // in case of write-only MSRs we need to flip back the value (flip back iff restore) 63 | old_value = bitmask_to_flip; 64 | } 65 | uint64_t new_value = old_value ^bitmask_to_flip; 66 | PrintInfoMessage("Writing value " + ToHex(new_value) + " to MSR " + ToHex(msr)); 67 | err = msr_interface.Write(msr, new_value); 68 | if (err) { 69 | PrintWarningMessage("Could not write value of MSR " + ToHex(msr) + "."); 70 | return 2; 71 | } 72 | return 0; 73 | } 74 | 75 | int RecordPMCs(uint32_t core_id, const std::string& instruction_folder, 76 | const std::string& output_file) { 77 | std::string cmd = kPathToNanobenchScript; 78 | cmd += " "; 79 | cmd += std::to_string(core_id); 80 | cmd += " "; 81 | cmd += instruction_folder; 82 | cmd += " "; 83 | cmd += output_file; 84 | int ret = system(cmd.c_str()); 85 | if (ret != 0) { 86 | PrintErrorMessage("Failed executing command '" + cmd + "'"); 87 | return 1; 88 | } 89 | return 0; 90 | } 91 | 92 | std::string CreatePMCReferenceThresholdMapKey(const std::string& testname, 93 | const std::string& pmcname) { 94 | std::string key = testname; 95 | key += "--"; 96 | key += pmcname; 97 | return key; 98 | } 99 | 100 | std::string CreatePMCReferenceThresholdMapKey(const PMCReferenceThreshold& threshold) { 101 | return CreatePMCReferenceThresholdMapKey(threshold.test_name, threshold.pmc_name); 102 | } 103 | 104 | PMCReferenceThresholdMap CreatePMCReferenceThresholds( 105 | uint32_t core_id, 106 | const std::string& instruction_folder) { 107 | std::string reference_output("TODO_reference_output"); 108 | int err = RecordPMCs(core_id, instruction_folder, reference_output); 109 | if (err) { 110 | PrintErrorMessage("Error recording reference state. Aborting!"); 111 | exit(1); 112 | } 113 | std::unordered_map reference_thresholds; 114 | 115 | std::ifstream fd(reference_output); 116 | if (!fd.is_open()) { 117 | PrintErrorMessage("Could not open " + reference_output + ". Aborting!"); 118 | exit(1); 119 | } 120 | 121 | std::string line; 122 | std::getline(fd, line); 123 | std::vector header = SplitString(line, ';'); 124 | if (header[0] != "NAME") { 125 | PrintErrorMessage("Invalid file format of nanoBench result. Aborting!"); 126 | exit(1); 127 | } 128 | 129 | while (std::getline(fd, line)) { 130 | std::vector splitted_line = SplitString(line, ';'); 131 | std::string testname = splitted_line[0]; 132 | for (size_t i = 1; i < splitted_line.size(); i++) { 133 | if (splitted_line[i].empty()) { 134 | PrintErrorMessage( 135 | "NanoBench result is missing or has improper formatting. Aborting!"); 136 | exit(1); 137 | } 138 | std::string pmc_name = header[i]; 139 | std::string key = CreatePMCReferenceThresholdMapKey(testname, pmc_name); 140 | double reference_value = std::stod(splitted_line[i]); 141 | double upper_threshold = reference_value;// * kUpperThresholdDifference; 142 | double lower_threshold = reference_value;// * kLowerThresholdDifference; 143 | //if (reference_value + kMinimalAbsoluteDifference > upper_threshold) { 144 | // upper_threshold = reference_value + kMinimalAbsoluteDifference; 145 | //} 146 | //if (reference_value - kMinimalAbsoluteDifference < lower_threshold) { 147 | // lower_threshold = reference_value - kMinimalAbsoluteDifference; 148 | //} 149 | PMCReferenceThreshold pmc_reference_threshold(testname, 150 | pmc_name, 151 | reference_value, 152 | lower_threshold, 153 | upper_threshold); 154 | reference_thresholds[key] = pmc_reference_threshold; 155 | } 156 | } 157 | return reference_thresholds; 158 | } 159 | 160 | void WriteOutPMCThresholds(const std::string& filename, 161 | const PMCReferenceThresholdMap& pmc_reference_thresholds) { 162 | std::ofstream fd(filename); 163 | if (!fd.is_open()) { 164 | PrintErrorMessage("Could not open" + filename + "! Aborting!"); 165 | exit(1); 166 | } 167 | std::string headerline = PMCReferenceThreshold::GetCSVHeaderline(); 168 | fd << headerline << std::endl; 169 | for (const auto& key_with_threshold : pmc_reference_thresholds) { 170 | PMCReferenceThreshold threshold = key_with_threshold.second; 171 | fd << threshold.ToCSV() << std::endl; 172 | } 173 | } 174 | 175 | PMCReferenceThresholdMap ReadInPMCThresholds(const std::string& filename) { 176 | std::ifstream fd(filename); 177 | if (!fd.is_open()) { 178 | PrintErrorMessage("Could not open " + filename + "! Aborting! " 179 | "Try running --calibrate"); 180 | exit(1); 181 | } 182 | std::string headerline = PMCReferenceThreshold::GetCSVHeaderline(); 183 | std::string line; 184 | std::getline(fd, line); 185 | if (line != headerline) { 186 | PrintErrorMessage("File " + filename + " has an incorrect format"); 187 | exit(1); 188 | } 189 | PMCReferenceThresholdMap pmc_reference_threshold_map; 190 | while (std::getline(fd, line)) { 191 | PMCReferenceThreshold threshold; 192 | threshold.LoadFromCSV(line); 193 | std::string key = CreatePMCReferenceThresholdMapKey(threshold); 194 | pmc_reference_threshold_map[key] = threshold; 195 | } 196 | return pmc_reference_threshold_map; 197 | } 198 | 199 | PMCDifferences CheckForPMCDifference(PMCReferenceThresholdMap reference_threshold_map, 200 | const std::string& test_results) { 201 | std::ifstream fd(test_results); 202 | if (!fd.is_open()) { 203 | PrintErrorMessage("Could not open " + test_results + ". Aborting!"); 204 | exit(1); 205 | } 206 | 207 | std::string line; 208 | std::getline(fd, line); 209 | std::vector header = SplitString(line, ';'); 210 | if (header[0] != "NAME") { 211 | PrintErrorMessage("Invalid file format of nanoBench result. Aborting!"); 212 | exit(1); 213 | } 214 | 215 | std::vector> results; 216 | while (std::getline(fd, line)) { 217 | std::vector splitted_line = SplitString(line, ';'); 218 | std::string test_name = splitted_line[0]; 219 | for (size_t i = 1; i < splitted_line.size(); i++) { 220 | if (splitted_line[i].empty()) { 221 | PrintErrorMessage("Invalid file format of nanoBench result. Aborting!"); 222 | exit(1); 223 | } 224 | double value = std::stod(splitted_line[i]); 225 | std::string pmc_name = header[i]; 226 | std::string ref_key = CreatePMCReferenceThresholdMapKey(test_name, pmc_name); 227 | 228 | // manually increase thresholds for different PMCs 229 | // TODO: outline this logic to a separate configuration file 230 | double minimal_difference = kMinimalAbsoluteDifference; 231 | if (pmc_name == "RDTSC" || pmc_name.find("Cycles") != std::string::npos 232 | || pmc_name.find("cycles") != std::string::npos) { 233 | // atleast 100 cycle diff 234 | minimal_difference = 100.0; 235 | } 236 | if (pmc_name.find("RETIRED") != std::string::npos) { 237 | // atleast 3 retired loads diff 238 | minimal_difference = 3.0; 239 | } 240 | 241 | PMCReferenceThreshold reference_threshold = reference_threshold_map[ref_key]; 242 | if (value < reference_threshold.lower_threshold || 243 | value > reference_threshold.upper_threshold) { 244 | if (std::abs(value - reference_threshold.reference_value) < minimal_difference) { 245 | // ignore values whose difference is too low 246 | continue; 247 | } 248 | PrintSuccessMessage("Difference in " + reference_threshold.test_name 249 | + ":" + reference_threshold.pmc_name); 250 | PrintSuccessMessage("Observed: " + std::to_string(value) 251 | + " (reference: " 252 | + std::to_string(reference_threshold.reference_value) + ")"); 253 | results.emplace_back(reference_threshold, value); 254 | } 255 | } 256 | } 257 | return results; 258 | } 259 | 260 | void CalibrateReferenceThresholds(const std::string& pmc_threshold_file, 261 | uint32_t core_id, 262 | uint32_t maximum_calibrate_tries) { 263 | MSRInterface msr_interface(core_id); 264 | std::string pmc_test_results("TODO_pmc_calibrate_results"); 265 | 266 | PMCReferenceThresholdMap pmc_reference_thresholds = 267 | CreatePMCReferenceThresholds(core_id, kInstructionFolder); 268 | 269 | int successful_subsequent_runs = 0; 270 | for (uint32_t i = 0; i < maximum_calibrate_tries && 271 | successful_subsequent_runs < kConsecutiveRunsForCalibration; i++) { 272 | int err = RecordPMCs(core_id, kInstructionFolder, pmc_test_results); 273 | if (err) { 274 | PrintErrorMessage("Error recording PMC events. Aborting"); 275 | return; 276 | } 277 | std::vector> diffs = 278 | CheckForPMCDifference(pmc_reference_thresholds, pmc_test_results); 279 | if (diffs.empty()) { 280 | successful_subsequent_runs += 1; 281 | } else { 282 | // we still observed differences hence we adjust thresholds 283 | successful_subsequent_runs = 0; 284 | for (const std::pair& diff : diffs) { 285 | PMCReferenceThreshold threshold = diff.first; 286 | double detected_value = diff.second; 287 | if (detected_value > threshold.upper_threshold) { 288 | double old_value = threshold.upper_threshold; 289 | double new_value = 290 | std::max(detected_value, threshold.upper_threshold * kUpperThresholdDifference); 291 | threshold.upper_threshold = new_value; 292 | PrintInfoMessage("Updated upper threshold " + threshold.pmc_name 293 | + ": " + threshold.test_name 294 | + " from " + std::to_string(old_value) 295 | + " to " + std::to_string(new_value)); 296 | } else { 297 | double old_value = threshold.lower_threshold; 298 | double new_value = 299 | std::min(detected_value, threshold.lower_threshold * kLowerThresholdDifference); 300 | if (std::fabs(old_value - new_value) <= std::numeric_limits::epsilon()) { 301 | // handle special cases such as very low values or the value 0 302 | new_value = old_value - 1; 303 | } 304 | threshold.lower_threshold = new_value; 305 | PrintInfoMessage("Updated lower threshold " + threshold.pmc_name 306 | + ": " + threshold.test_name 307 | + " from " + std::to_string(old_value) 308 | + " to " + std::to_string(new_value)); 309 | } 310 | // update thresholds with new values 311 | std::string key = CreatePMCReferenceThresholdMapKey(threshold); 312 | pmc_reference_thresholds[key] = threshold; 313 | } 314 | } 315 | } 316 | if (successful_subsequent_runs != kConsecutiveRunsForCalibration) { 317 | PrintErrorMessage("Could not finish calibration of PMC thresholds."); 318 | exit(0); 319 | } 320 | PrintSuccessMessage("Successfully calibrated PMC thresholds."); 321 | WriteOutPMCThresholds(pmc_threshold_file, pmc_reference_thresholds); 322 | } 323 | 324 | /// For given bitpositions calculate all values that represent permutations of these bits 325 | /// WARNING: lists can contain duplicates 326 | std::vector BitPositionsToAllPossibleBitmasks(std::vector bit_positions) { 327 | std::vector bitmasks; 328 | if (bit_positions.empty()) { 329 | // return empty list 330 | return bitmasks; 331 | } 332 | if (bit_positions.size() == 1) { 333 | uint64_t num1 = 1ull << bit_positions[0]; 334 | uint64_t num2 = 0; 335 | bitmasks.emplace_back(num1); 336 | bitmasks.emplace_back(num2); 337 | } else { 338 | // remove last element and get recursive results 339 | uint64_t current_bit_position = bit_positions.back(); 340 | bit_positions.pop_back(); 341 | std::vector child_bitmasks = BitPositionsToAllPossibleBitmasks(bit_positions); 342 | for (uint64_t child_bitmask : child_bitmasks) { 343 | // take cursive number and add one state for each possible value of the current bit 344 | uint64_t bitmask1 = child_bitmask | (1ull << current_bit_position); 345 | uint64_t bitmask2 = child_bitmask; 346 | bitmasks.emplace_back(bitmask1); 347 | bitmasks.emplace_back(bitmask2); 348 | } 349 | } 350 | return bitmasks; 351 | } 352 | 353 | /// turns flippable bitmask into list of bitmasks that represent possible values for potential enums 354 | /// e.g. CreateSlidingBitwindowMasks(0b111, 2) = [0b000, 0b001, 0b010, 0b011, 355 | /// (0b000), (0b010), 0b100, 0b110] 356 | /// \param flip_bitmask bitmask of flippable bits 357 | /// \param window_size number of bits that are considered as one value 358 | std::vector CreateSlidingBitwindowMasks(uint64_t flip_bitmask, uint64_t window_size) { 359 | std::vector bit_positions; 360 | for (uint64_t bit = 0; bit < 64; bit++) { 361 | if ((flip_bitmask >> bit) & 1ull) { 362 | bit_positions.emplace_back(bit); 363 | } 364 | } 365 | std::vector bitmasks; 366 | if (window_size > bit_positions.size()) { 367 | window_size = bit_positions.size(); 368 | } 369 | for (size_t window_pos = 0; window_pos <= bit_positions.size() - window_size; window_pos++) { 370 | auto window_begin = bit_positions.begin() + window_pos; 371 | auto window_end = bit_positions.begin() + window_pos + window_size; 372 | std::vector child_bitmasks = BitPositionsToAllPossibleBitmasks( 373 | std::vector(window_begin, window_end)); 374 | bitmasks.insert(bitmasks.end(), child_bitmasks.begin(), child_bitmasks.end()); 375 | } 376 | // remove duplicates 377 | std::sort(bitmasks.begin(), bitmasks.end()); 378 | bitmasks.erase(std::unique(bitmasks.begin(), bitmasks.end()), bitmasks.end()); 379 | return bitmasks; 380 | } 381 | 382 | std::vector CreateAllPossibleUnifiedBitmasks(uint64_t window_size) { 383 | std::vector bitmasks; 384 | for (uint64_t windowvalue = 0; windowvalue < std::pow(2, window_size); windowvalue++) { 385 | uint64_t bitmask = 0; 386 | for (uint64_t offset = 0; offset < kMSRMaxBitSize; offset += window_size) { 387 | bitmask |= windowvalue << offset; 388 | } 389 | bitmasks.emplace_back(bitmask); 390 | } 391 | return bitmasks; 392 | } 393 | 394 | /// Creating masks to test multiple bitwindows at once 395 | std::vector CreateUnifiedBitwindowMasks(uint64_t flip_bitmask, uint64_t window_size) { 396 | std::vector bit_positions; 397 | for (uint64_t bit = 0; bit < 64; bit++) { 398 | if ((flip_bitmask >> bit) & 1ull) { 399 | bit_positions.emplace_back(bit); 400 | } 401 | } 402 | 403 | std::vector possible_unified_bitmasks = CreateAllPossibleUnifiedBitmasks(window_size); 404 | std::vector flippable_bitmasks; 405 | for (uint64_t possible_bitmask : possible_unified_bitmasks) { 406 | uint64_t bitmask = 0; 407 | for (uint64_t bitposition = 0; bitposition < 64; bitposition++) { 408 | if ((flip_bitmask >> bitposition) & 1ull) { // skip non-flippable bits 409 | bitmask |= (possible_bitmask & 1ull) << bitposition; // take last bit possible mask 410 | possible_bitmask >>= 1ull; // cut of last mask bit as we already used it 411 | } 412 | } 413 | flippable_bitmasks.emplace_back(bitmask); 414 | } 415 | // remove duplicates (can happen as resulting masks are smaller than original ones) 416 | std::sort(flippable_bitmasks.begin(), flippable_bitmasks.end()); 417 | flippable_bitmasks.erase(std::unique(flippable_bitmasks.begin(), flippable_bitmasks.end()), 418 | flippable_bitmasks.end()); 419 | return flippable_bitmasks; 420 | } 421 | 422 | PMCDifferences UnionSideEffects(PMCDifferences observed1, PMCDifferences observed2) { 423 | PMCDifferences union_diffs; 424 | for (auto&[thresholds1, observed_value1] : observed1) { 425 | std::string effect1 = thresholds1.test_name + "---" + thresholds1.pmc_name; 426 | for (auto&[thresholds2, observed_value2] : observed2) { 427 | std::string effect2 = thresholds2.test_name + "---" + thresholds2.pmc_name; 428 | if (effect1 == effect2) { 429 | // we just keep the first value (shouldn't matter much) 430 | union_diffs.emplace_back(thresholds1, observed_value1); 431 | } 432 | } 433 | } 434 | return union_diffs; 435 | } 436 | -------------------------------------------------------------------------------- /msr_influences/runner/common.h: -------------------------------------------------------------------------------- 1 | #ifndef MSR_UOPS_RUNNERV2_COMMON_H_ 2 | #define MSR_UOPS_RUNNERV2_COMMON_H_ 3 | 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | 12 | #include "utils.h" 13 | 14 | // 15 | // global constants 16 | // 17 | extern const std::string kInstructionFolder; 18 | extern const int kBitWindowSize; 19 | 20 | // 21 | // datastructures 22 | // 23 | struct msr_context { 24 | uint32_t address; 25 | std::string name; 26 | std::vector bits_to_check; 27 | }; 28 | 29 | int CountBitsToCheck(const std::vector& msrs); 30 | 31 | struct PMCReferenceThreshold { 32 | std::string test_name; 33 | std::string pmc_name; 34 | double reference_value; 35 | double lower_threshold; 36 | double upper_threshold; 37 | PMCReferenceThreshold() = default; 38 | PMCReferenceThreshold(std::string test_name_value, 39 | std::string pmc_name_value, 40 | double ref_value, 41 | double lower_threshold_value, 42 | double upper_threshold_value) 43 | : test_name(std::move(test_name_value)), 44 | pmc_name(std::move(pmc_name_value)), 45 | reference_value(ref_value), 46 | lower_threshold(lower_threshold_value), 47 | upper_threshold(upper_threshold_value) {} 48 | 49 | static std::string GetCSVHeaderline() { 50 | return "testname;pmcname;reference_value;lower_threshold;upper_threshold"; 51 | } 52 | static size_t GetCSVLength() { 53 | std::string headerline = GetCSVHeaderline(); 54 | return std::count(headerline.begin(), headerline.end(), ';') + 1; 55 | } 56 | 57 | std::string ToCSV() const { 58 | std::stringstream ss; 59 | ss << test_name << ";" << pmc_name << ";" 60 | << std::to_string(reference_value) << ";" 61 | << std::to_string(lower_threshold) << ";" 62 | << std::to_string(upper_threshold); 63 | return ss.str(); 64 | } 65 | 66 | int LoadFromCSV(const std::string& csv_line) { 67 | auto splitted_line = SplitString(csv_line, ';'); 68 | return LoadFromCSV(splitted_line); 69 | } 70 | 71 | int LoadFromCSV(std::vector csv_line_splitted) { 72 | if (csv_line_splitted.size() != 5) { 73 | return 1; 74 | } 75 | test_name = csv_line_splitted[0]; 76 | pmc_name = csv_line_splitted[1]; 77 | try { 78 | reference_value = std::stod(csv_line_splitted[2]); 79 | lower_threshold = std::stod(csv_line_splitted[3]); 80 | upper_threshold = std::stod(csv_line_splitted[4]); 81 | } catch (...) { 82 | return 1; 83 | } 84 | return 0; 85 | } 86 | }; 87 | 88 | class MSRInterface { 89 | public: 90 | explicit MSRInterface(uint32_t core_id) { 91 | this->core_id_ = core_id; 92 | char buffer[100]; 93 | snprintf(buffer, sizeof(buffer), "/dev/cpu/%u/msr", core_id); 94 | fd_ = open(buffer, O_RDWR); 95 | if (fd_ < 0) { 96 | PrintErrorMessage("Could not open MSR dev on core " + ToHex(core_id) + ". Aborting!"); 97 | exit(1); 98 | } 99 | } 100 | 101 | ~MSRInterface() { 102 | close(fd_); 103 | } 104 | 105 | int Read(uint32_t msr, uint64_t* value) const { 106 | return pread(fd_, value, sizeof(uint64_t), msr) != sizeof(uint64_t); 107 | } 108 | 109 | int Write(uint32_t msr, uint64_t value) const { 110 | return pwrite(fd_, &value, sizeof(uint64_t), msr) != sizeof(uint64_t); 111 | } 112 | 113 | uint32_t GetCoreID() const { 114 | return core_id_; 115 | } 116 | 117 | private: 118 | int fd_; 119 | uint32_t core_id_; 120 | }; 121 | 122 | // 123 | // type declarations 124 | // 125 | using PMCDifferences = std::vector>; 126 | using PMCReferenceThresholdMap = std::unordered_map; 127 | 128 | // 129 | // functions 130 | // 131 | void SetCPUAffinity(int cpu); 132 | int FlipBits(uint32_t msr, 133 | uint64_t bitmask_to_flip, 134 | bool restore_old_value, 135 | bool accept_write_only_msrs, 136 | const MSRInterface& msr_interface); 137 | int RecordPMCs(uint32_t core_id, const std::string& instruction_folder, 138 | const std::string& output_file); 139 | std::string CreatePMCReferenceThresholdMapKey(const std::string& testname, 140 | const std::string& pmcname); 141 | std::string CreatePMCReferenceThresholdMapKey(const PMCReferenceThreshold& threshold); 142 | PMCReferenceThresholdMap CreatePMCReferenceThresholds( 143 | uint32_t core_id, 144 | const std::string& instruction_folder); 145 | void WriteOutPMCThresholds(const std::string& filename, 146 | const PMCReferenceThresholdMap& pmc_reference_thresholds); 147 | PMCReferenceThresholdMap ReadInPMCThresholds(const std::string& filename); 148 | PMCDifferences CheckForPMCDifference(PMCReferenceThresholdMap reference_threshold_map, 149 | const std::string& test_results); 150 | void CalibrateReferenceThresholds(const std::string& pmc_threshold_file, 151 | uint32_t core_id, 152 | uint32_t maximum_calibrate_tries); 153 | 154 | 155 | /// turns flippable bitmask into list of bitmasks that represent possible values for potential enums 156 | /// e.g. BitmaskToPossibleBitWindows(0b111, 2) = [0b000, 0b001, 0b010, 0b011, 157 | /// (0b000), (0b010), 0b100, 0b110] 158 | /// \param flip_bitmask bitmask of flippable bits 159 | /// \param window_size number of bits that are considered as one value 160 | std::vector CreateSlidingBitwindowMasks(uint64_t flip_bitmask, 161 | uint64_t window_size); 162 | 163 | /// Creating masks to test multiple bitwindows at once 164 | std::vector CreateUnifiedBitwindowMasks(uint64_t flip_bitmask, uint64_t window_size); 165 | 166 | // Calculate the union of two runs of side effects 167 | PMCDifferences UnionSideEffects(PMCDifferences observed1, PMCDifferences observed2); 168 | #endif // MSR_UOPS_RUNNERV2_COMMON_H_ 169 | -------------------------------------------------------------------------------- /msr_influences/runner/main.cc: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | #include "utils.h" 11 | #include "phase1.h" 12 | #include "phase2.h" 13 | #include "phase3.h" 14 | 15 | constexpr int kCoreForMeasurements = 3; 16 | //const std::string kUnknownMSRsFile("../../test_msrs_formatted"); // just for debugging 17 | const std::string kUnknownMSRsFile("../unknown_msrs_formatted.csv"); 18 | //const std::string kUnknownMSRsFile("../../wo_msrs_formatted"); 19 | //const std::string kUnknownMSRsFile("../../reserved_msr_bits.csv"); 20 | const std::string kFlippableMSRsFile("./flippable_msrs.csv"); 21 | const std::string kPMCThresholdsFile("./pmc_thresholds.csv"); 22 | const std::string kPMCDifferencesFile("./observed_sideeffects.csv"); 23 | const std::string kTracedBitsFile("./traced_bits.csv"); 24 | 25 | std::vector ParseBitsToCheck(const std::string& bits_to_check_encoded) { 26 | // example input: 9-63,24-63,9-22,6-7,1-4 27 | std::vector bits; 28 | auto ranges = SplitString(bits_to_check_encoded, ','); 29 | for (const std::string& range : ranges) { 30 | std::vector splitted_range = SplitString(range, '-'); 31 | if (splitted_range.size() != 2) { 32 | PrintErrorMessage("Ill-formatted bit range ('" + range + "'). Aborting!"); 33 | exit(1); 34 | } 35 | try { 36 | uint8_t begin = std::stoi(splitted_range[0], nullptr, 0); 37 | uint8_t end = std::stoi(splitted_range[1], nullptr, 0); 38 | for (int bit = begin; bit <= end; bit++) { 39 | bits.push_back(bit); 40 | } 41 | } catch (const std::invalid_argument& e) { 42 | PrintErrorMessage("Ill-formatted bit range ('" + range + "'). Aborting!"); 43 | exit(1); 44 | } 45 | } 46 | // sort bits to make further computations easier to follow 47 | std::sort(bits.begin(), bits.end()); 48 | return bits; 49 | } 50 | 51 | std::vector ParseMSRFile(const std::string& filename) { 52 | std::ifstream fd(filename); 53 | if (!fd.is_open()) { 54 | std::cerr << "Failed reading file " << filename << std::endl; 55 | std::exit(1); 56 | } 57 | 58 | std::vector parsed_msrs; 59 | std::string line; 60 | std::stringstream ss; 61 | std::string headerline = "msr;name;bits-to-check"; 62 | std::getline(fd, line); 63 | if (line != headerline) { 64 | PrintErrorMessage("File " + filename + " has an incorrect format"); 65 | exit(1); 66 | } 67 | 68 | while (std::getline(fd, line)) { 69 | auto splitted_line = SplitString(line, ';'); 70 | msr_context msr; 71 | msr.address = (std::stoul(splitted_line[0], nullptr, 16)); 72 | msr.name = splitted_line[1]; 73 | msr.bits_to_check = ParseBitsToCheck(splitted_line[2]); 74 | parsed_msrs.push_back(msr); 75 | } 76 | std::cout << "[+] Read " << parsed_msrs.size() << " MSRs from MSR-File" << std::endl; 77 | return parsed_msrs; 78 | } 79 | 80 | struct CommandLineArguments { 81 | bool phase1 = false; 82 | bool phase2 = false; 83 | bool phase3 = false; 84 | bool calibrate = false; 85 | bool msr = false; 86 | bool keep_write_only_msrs = false; 87 | uint32_t msr_value; 88 | }; 89 | 90 | void PrintHelp(char** argv) { 91 | std::cout << "USAGE: " << argv[0] << " [OPTION]" << std::endl 92 | << "Possible Arguments:" << std::endl 93 | << "--phase1 \t Search for bits that are flippable" << std::endl 94 | << "--phase2 \t Search for side effects of flipped bits" << std::endl 95 | << "--phase3 \t Trace side effects to single bit flips" << std::endl 96 | << "--calibrate \t Calibrate thresholds for phase2" << std::endl 97 | << "--keepwo \t Keep write-only MSRs (during phase1)" << std::endl 98 | << "--msr \t Test only specific MSR" << std::endl 99 | << "--help/-h \t Print usage" << std::endl; 100 | } 101 | 102 | CommandLineArguments ParseArguments(int argc, char** argv) { 103 | CommandLineArguments command_line_arguments; 104 | const struct option long_options[] = { 105 | {"phase1", no_argument, nullptr, '1'}, 106 | {"phase2", no_argument, nullptr, '2'}, 107 | {"phase3", no_argument, nullptr, '3'}, 108 | {"msr", required_argument, nullptr, 'm'}, 109 | {"help", no_argument, nullptr, 'h'}, 110 | {"calibrate", no_argument, nullptr, 'c'}, 111 | {"keepwo", no_argument, nullptr, 'k'}, 112 | {nullptr, 0, nullptr, 0} 113 | }; 114 | 115 | int option_index; 116 | int c; 117 | while ((c = getopt_long(argc, argv, "h", long_options, &option_index)) != -1) { 118 | switch (c) { 119 | case '0': 120 | break; 121 | case '1': 122 | command_line_arguments.phase1 = true; 123 | break; 124 | case '2': 125 | command_line_arguments.phase2 = true; 126 | break; 127 | case '3': 128 | command_line_arguments.phase3 = true; 129 | break; 130 | case 'c': 131 | command_line_arguments.calibrate = true; 132 | break; 133 | case 'k': 134 | command_line_arguments.keep_write_only_msrs = true; 135 | break; 136 | case 'm': 137 | command_line_arguments.msr = true; 138 | try { 139 | command_line_arguments.msr_value = std::stoll(optarg, nullptr, 0); 140 | } catch (const std::invalid_argument& e) { 141 | std::cout << "[-] Expected number as argument for --msr" << std::endl; 142 | exit(0); 143 | } catch (const std::out_of_range& e) { 144 | std::cout << "[-] Illegal msr value for --msr" << std::endl; 145 | exit(0); 146 | } 147 | break; 148 | case 'h': 149 | case '?': 150 | case ':': 151 | PrintHelp(argv); 152 | exit(0); 153 | default: 154 | std::cerr << "[-] Argument parsing failed. Aborting!" << std::endl; 155 | exit(1); 156 | } 157 | } 158 | return command_line_arguments; 159 | } 160 | 161 | int main(int argc, char* argv[]) { 162 | 163 | if (argc == 1) { 164 | PrintHelp(argv); 165 | exit(0); 166 | } 167 | CommandLineArguments command_line_arguments = ParseArguments(argc, argv); 168 | 169 | // 170 | // PHASE 1 171 | // 172 | if (command_line_arguments.phase1) { 173 | std::vector msrs; 174 | if (command_line_arguments.msr) { 175 | PrintInfoMessage("Phase1: Testing only MSR " + 176 | std::to_string(command_line_arguments.msr_value)); 177 | msr_context msr; 178 | msr.address = command_line_arguments.msr_value; 179 | msr.name = ""; 180 | // test all bits (0-63) 181 | std::vector bits_to_check(64); 182 | std::iota(bits_to_check.begin(), bits_to_check.end(), 0); 183 | msr.bits_to_check = bits_to_check; 184 | msrs.push_back(msr); 185 | } else { 186 | msrs = ParseMSRFile(kUnknownMSRsFile); 187 | } 188 | 189 | PrintInfoMessage("Searching for flippable bits"); 190 | Phase1Results phase1_results = SearchFlippableBits(msrs, 191 | kCoreForMeasurements, 192 | command_line_arguments.keep_write_only_msrs); 193 | for (auto& result : phase1_results) { 194 | std::cout << ToHex(result.msr) 195 | << " - " << ErrorCodeToString(result.error_code); 196 | if (result.error_code == ErrorCode::kSuccess) { 197 | std::cout << " - " << result.flip_bitmask; 198 | } 199 | std::cout << std::endl; 200 | } 201 | WriteOutFlippableBits(kFlippableMSRsFile, phase1_results); 202 | PrintStatisticsForWritableBits(phase1_results); 203 | PrintInfoMessage("Result stored in " + kFlippableMSRsFile); 204 | } 205 | 206 | // 207 | // CALIBRATE 208 | // 209 | if (command_line_arguments.calibrate) { 210 | PrintInfoMessage("Calibrating thresholds for PMC differences..."); 211 | CalibrateReferenceThresholds(kPMCThresholdsFile, kCoreForMeasurements, 250); 212 | } 213 | 214 | // 215 | // PHASE 2 216 | // 217 | if (command_line_arguments.phase2) { 218 | Phase1Results phase1_results = ReadInFlippableBits(kFlippableMSRsFile); 219 | PrintInfoMessage("Read " + std::to_string(phase1_results.size()) 220 | + " MSR flip bitmasks"); 221 | 222 | if (command_line_arguments.msr) { 223 | PrintInfoMessage("Phase2: Testing only MSR " + 224 | ToHex(command_line_arguments.msr_value)); 225 | Phase1Results tmp_results; 226 | bool found = false; 227 | for (auto& result : phase1_results) { 228 | if (result.msr == command_line_arguments.msr_value) { 229 | tmp_results.push_back(result); 230 | found = true; 231 | } 232 | } 233 | if (!found) { 234 | PrintErrorMessage("[-] Could not found flip information for specified MSR. " 235 | "You may want to add '--phase1'."); 236 | exit(1); 237 | } 238 | phase1_results = tmp_results; 239 | } 240 | 241 | PrintInfoMessage("Checking for side effects..."); 242 | Phase2Results p2results = SearchForSideEffects( 243 | phase1_results, 244 | kPMCThresholdsFile, 245 | command_line_arguments.keep_write_only_msrs, 246 | kCoreForMeasurements); 247 | WriteOutSideEffects(kPMCDifferencesFile, p2results); 248 | PrintInfoMessage("Result stored in " + kPMCDifferencesFile); 249 | } 250 | 251 | // 252 | // PHASE 3 253 | // 254 | if (command_line_arguments.phase3) { 255 | Phase1Results phase1_results = ReadInFlippableBits(kFlippableMSRsFile); 256 | Phase2Results phase2_results = ReadInSideEffects(kPMCDifferencesFile); 257 | PrintInfoMessage("Read " + std::to_string(phase1_results.size()) 258 | + " MSR flip bitmasks"); 259 | PrintInfoMessage("Read " + std::to_string(phase2_results.size()) 260 | + " MSRs with side effects"); 261 | 262 | if (command_line_arguments.msr) { 263 | PrintInfoMessage("Phase3: Testing only MSR " + 264 | ToHex(command_line_arguments.msr_value)); 265 | Phase1Results p1_tmp_results; 266 | Phase2Results p2_tmp_results; 267 | bool p1_found = false; 268 | bool p2_found = false; 269 | for (auto& result : phase1_results) { 270 | if (result.msr == command_line_arguments.msr_value) { 271 | p1_tmp_results.push_back(result); 272 | p1_found = true; 273 | } 274 | } 275 | for (auto& result : phase2_results) { 276 | if (result.msr == command_line_arguments.msr_value) { 277 | p2_tmp_results.push_back(result); 278 | p2_found = true; 279 | } 280 | } 281 | if (!p1_found) { 282 | PrintErrorMessage("[-] Could not found phase1 information for specified MSR. " 283 | "You may want to add '--phase1'."); 284 | exit(1); 285 | } 286 | if (!p2_found) { 287 | PrintErrorMessage("[-] Could not found phase2 information for specified MSR. " 288 | "You may want to add '--phase2'."); 289 | exit(1); 290 | } 291 | phase1_results = p1_tmp_results; 292 | phase2_results = p2_tmp_results; 293 | } 294 | 295 | PrintInfoMessage("Tracing side effects to flipped bits..."); 296 | Phase3Results phase3_results = TraceSideEffectsToBits(phase1_results, 297 | phase2_results, 298 | kPMCThresholdsFile, 299 | command_line_arguments.keep_write_only_msrs, 300 | kCoreForMeasurements); 301 | WriteOutTracedBits(kTracedBitsFile, phase3_results); 302 | PrintInfoMessage("Result stored in " + kTracedBitsFile); 303 | } 304 | 305 | return 0; 306 | } 307 | -------------------------------------------------------------------------------- /msr_influences/runner/phase1.cc: -------------------------------------------------------------------------------- 1 | #include "phase1.h" 2 | 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | std::string ErrorCodeToString(ErrorCode error_code) { 11 | switch (error_code) { 12 | case ErrorCode::kSuccess: 13 | return "Success"; 14 | case ErrorCode::kInitialReadError: 15 | return "InitialReadError"; 16 | case ErrorCode::kReadAfterFailedWriteError: 17 | return "ReadAfterFailedWriteError"; 18 | case ErrorCode::kReadAfterSuccessfulWriteError: 19 | return "ReadAfterSuccessfulWriteError"; 20 | case ErrorCode::kRestoreError: 21 | return "RestoreError"; 22 | case ErrorCode::kValueChangeAfterFailedWriteError: 23 | return "ValueChangeAfterFailedWriteError"; 24 | } 25 | // unreachable 26 | std::abort(); 27 | } 28 | 29 | ErrorCode StringToErrorCode(const std::string& error_code) { 30 | if (error_code == "Success") { 31 | return ErrorCode::kSuccess; 32 | } else if (error_code == "InitialReadError") { 33 | return ErrorCode::kInitialReadError; 34 | } else if (error_code == "ReadAfterFailedWriteError") { 35 | return ErrorCode::kReadAfterFailedWriteError; 36 | } else if (error_code == "ReadAfterSuccessfulWriteError") { 37 | return ErrorCode::kReadAfterSuccessfulWriteError; 38 | } else if (error_code == "RestoreError") { 39 | return ErrorCode::kRestoreError; 40 | } else if (error_code == "ValueChangeAfterFailedWriteError") { 41 | return ErrorCode::kValueChangeAfterFailedWriteError; 42 | } else { 43 | PrintErrorMessage("The string '" 44 | + error_code + "' is not a viable ErrorCode representation"); 45 | std::abort(); 46 | } 47 | } 48 | 49 | void PrintStatisticsForWritableBits(const Phase1Results& results) { 50 | int writable_bits_sum = 0; 51 | std::vector writable_bits; 52 | uint64_t exhaustive_search_space = 0; 53 | uint64_t actual_search_space = 0; 54 | uint64_t writable_msrs = 0; 55 | for (Phase1Result result : results) { 56 | int bits = Popcount(result.flip_bitmask); 57 | if (bits) { writable_msrs++; } 58 | writable_bits.emplace_back(bits); 59 | writable_bits_sum += bits; 60 | exhaustive_search_space += std::pow(2, bits); 61 | actual_search_space += std::pow(2, kBitWindowSize) * bits; 62 | } 63 | 64 | int bits_avg, bits_min, bits_max; 65 | double bits_median; 66 | if (!writable_bits.empty()) { 67 | bits_avg = writable_bits_sum / writable_bits.size(); 68 | bits_min = *std::min_element(writable_bits.begin(), writable_bits.end()); 69 | bits_max = *std::max_element(writable_bits.begin(), writable_bits.end()); 70 | bits_median = median(writable_bits); 71 | } else { 72 | bits_avg = 0; 73 | bits_min = 0; 74 | bits_max = 0; 75 | bits_median = 0; 76 | } 77 | if (!writable_bits.empty()) { 78 | } 79 | 80 | PrintInfoMessage("Found " + std::to_string(writable_bits_sum) + " writable bits in " 81 | + std::to_string(writable_msrs) + " MSRs. " + 82 | "Tested " + std::to_string(results.size()) + " MSRs."); 83 | PrintInfoMessage("Bits per MSR: " + std::to_string(bits_avg) + " (average)"); 84 | PrintInfoMessage("Bits per MSR: " + std::to_string(bits_median) + " (median)"); 85 | PrintInfoMessage("Bits per MSR: " + std::to_string(bits_min) + " (min)"); 86 | PrintInfoMessage("Bits per MSR: " + std::to_string(bits_max) + " (max)"); 87 | PrintInfoMessage("Exhaustive search space: " + std::to_string(exhaustive_search_space) 88 | + " values"); 89 | PrintInfoMessage("Actual search space: " + std::to_string(actual_search_space) 90 | + " values"); 91 | 92 | } 93 | 94 | ErrorCode CheckFlippableBits(const msr_context& msr, 95 | const MSRInterface& msr_interface, 96 | bool keep_write_only_msrs, 97 | uint64_t* flippable_bits) { 98 | uint64_t original_value; 99 | *flippable_bits = 0; 100 | int err = msr_interface.Read(msr.address, &original_value); 101 | if (err && !keep_write_only_msrs) { 102 | return ErrorCode::kInitialReadError; 103 | } 104 | if (err) { 105 | // in case of write-only MSRs we assume the MSR is initially 0 106 | original_value = 0; 107 | } 108 | 109 | for (int bit_pos : msr.bits_to_check) { 110 | uint64_t modified_value = original_value ^(((uint64_t) 1) << bit_pos); 111 | PrintInfoMessage("Writing " + ToHex(modified_value) + " to MSR " + ToHex(msr.address)); 112 | err = msr_interface.Write(msr.address, modified_value); 113 | if (err) { 114 | // write failed 115 | uint64_t after_fail_value; 116 | err = msr_interface.Read(msr.address, &after_fail_value); 117 | if (err) { 118 | continue; 119 | //return ErrorCode::kReadAfterFailedWriteError; 120 | } 121 | if (original_value != after_fail_value) { 122 | continue; 123 | //return ErrorCode::kValueChangeAfterFailedWriteError; 124 | } 125 | } else { 126 | // write did not fault 127 | uint64_t after_write_value; 128 | err = msr_interface.Read(msr.address, &after_write_value); 129 | if (err && !keep_write_only_msrs) { 130 | continue; 131 | //return ErrorCode::kReadAfterSuccessfulWriteError; 132 | } 133 | 134 | if (after_write_value == modified_value || (err && keep_write_only_msrs)) { 135 | // write successful 136 | err = msr_interface.Write(msr.address, original_value); 137 | if (err) { 138 | return ErrorCode::kRestoreError; 139 | } 140 | 141 | *flippable_bits ^= (((uint64_t) 1) << bit_pos); 142 | } 143 | } 144 | } 145 | return ErrorCode::kSuccess; 146 | } 147 | 148 | Phase1Results SearchFlippableBits(const std::vector& msrs, 149 | uint32_t core_id, 150 | bool keep_write_only_msrs) { 151 | Phase1Results results; 152 | MSRInterface msr_interface(core_id); 153 | for (msr_context msr : msrs) { 154 | std::cout << std::hex << "[*] checking MSR " << ToHex(msr.address) << std::endl; 155 | 156 | // excluded msrs TODO: clean up 157 | if (msr.address == 0xc0000101 || // cpu freeze 158 | msr.address == 0x1b || // cpu freeze 159 | msr.address == 0x2e0 || // cpu freeze 160 | msr.address == 0xc0000080 || // os restart 161 | msr.address == 0x1a0 // os restart 162 | ) { 163 | PrintWarningMessage("Skipping MSR because it breaks things."); 164 | continue; 165 | } 166 | uint64_t flip_bitmask; 167 | ErrorCode ec = CheckFlippableBits(msr, msr_interface, keep_write_only_msrs, &flip_bitmask); 168 | results.emplace_back(msr.address, ec, flip_bitmask); 169 | } 170 | return results; 171 | } 172 | 173 | void WriteOutFlippableBits(const std::string& filename, const Phase1Results& flip_results) { 174 | std::ofstream fd(filename); 175 | if (!fd.is_open()) { 176 | PrintErrorMessage("Could not open" + filename + "! Aborting!"); 177 | exit(1); 178 | } 179 | std::string headerline = "msr;errorcode;flipmask"; 180 | fd << headerline << std::endl; 181 | for (auto& result : flip_results) { 182 | uint32_t msr = result.msr; 183 | uint64_t flipmask = result.flip_bitmask; 184 | std::string err_code = ErrorCodeToString(result.error_code); 185 | if (result.error_code != ErrorCode::kSuccess) { 186 | flipmask = 0; 187 | } 188 | fd << ToHex(msr) << ";" << err_code << ";" << ToHex(flipmask) << std::endl; 189 | } 190 | } 191 | 192 | Phase1Results ReadInFlippableBits(const std::string& filename) { 193 | std::ifstream fd(filename); 194 | if (!fd.is_open()) { 195 | PrintErrorMessage("Could not open " + filename + "! Aborting! Try running --phase1"); 196 | exit(1); 197 | } 198 | 199 | std::string headerline = "msr;errorcode;flipmask"; 200 | std::string line; 201 | std::getline(fd, line); 202 | if (line != headerline) { 203 | PrintErrorMessage("File " + filename + " has an incorrect format"); 204 | exit(1); 205 | } 206 | 207 | Phase1Results results; 208 | while (std::getline(fd, line)) { 209 | std::vector line_splitted = SplitString(line, ';'); 210 | if (line_splitted.size() != 3) { 211 | PrintErrorMessage("[-] Could not parse line of " + filename + ". Aborting!"); 212 | exit(1); 213 | } 214 | uint32_t msr = std::stoull(line_splitted[0], 0, 16); 215 | ErrorCode ec = StringToErrorCode(line_splitted[1]); 216 | uint64_t flip_bitmask = std::stoull(line_splitted[2], 0, 16); 217 | results.emplace_back(msr, ec, flip_bitmask); 218 | } 219 | return results; 220 | } 221 | -------------------------------------------------------------------------------- /msr_influences/runner/phase1.h: -------------------------------------------------------------------------------- 1 | #ifndef MSR_UOPS_RUNNERV2_PHASE1_H_ 2 | #define MSR_UOPS_RUNNERV2_PHASE1_H_ 3 | 4 | #include 5 | #include 6 | 7 | #include "common.h" 8 | #include "utils.h" 9 | 10 | enum class ErrorCode { 11 | kSuccess, 12 | kInitialReadError, 13 | kReadAfterFailedWriteError, 14 | kValueChangeAfterFailedWriteError, 15 | kReadAfterSuccessfulWriteError, 16 | kRestoreError 17 | }; 18 | 19 | struct Phase1Result { 20 | uint32_t msr; 21 | ErrorCode error_code; 22 | uint64_t flip_bitmask; 23 | 24 | Phase1Result(uint32_t msr_value, ErrorCode error_code_value, uint64_t flip_bitmask_value) 25 | : msr(msr_value), error_code(error_code_value), flip_bitmask(flip_bitmask_value) {} 26 | }; 27 | using Phase1Results = std::vector; 28 | 29 | void PrintStatisticsForWritableBits(const Phase1Results& results); 30 | 31 | std::string ErrorCodeToString(ErrorCode error_code); 32 | ErrorCode StringToErrorCode(const std::string& error_code); 33 | 34 | Phase1Results SearchFlippableBits(const std::vector& msrs, 35 | uint32_t core_id, 36 | bool keep_write_only_msrs); 37 | 38 | void WriteOutFlippableBits(const std::string& filename, const Phase1Results& flip_results); 39 | Phase1Results ReadInFlippableBits(const std::string& filename); 40 | 41 | #endif // MSR_UOPS_RUNNERV2_PHASE1_H_ 42 | -------------------------------------------------------------------------------- /msr_influences/runner/phase2.cc: -------------------------------------------------------------------------------- 1 | #include "phase2.h" 2 | 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #include "common.h" 12 | #include "utils.h" 13 | 14 | void WriteOutSideEffects(const std::string& filename, const Phase2Results& results) { 15 | std::ofstream fd(filename); 16 | if (!fd.is_open()) { 17 | PrintErrorMessage("Could not open " + filename + "! Aborting! "); 18 | exit(1); 19 | } 20 | std::string headerline = "msr;flipped_bits;(" + PMCReferenceThreshold::GetCSVHeaderline() 21 | + ";observed_value;)*"; 22 | fd << headerline << std::endl; 23 | for (const Phase2Result& result : results) { 24 | fd << ToHex(result.msr) << ";" << ToHex(result.flipped_bits); 25 | for (auto&[thresholds, observed_value] : result.observed_sideeffects) { 26 | fd << ";" << thresholds.ToCSV() << ";" << observed_value; 27 | } 28 | fd << std::endl; 29 | } 30 | } 31 | 32 | Phase2Results ReadInSideEffects(const std::string& filename) { 33 | std::ifstream fd(filename); 34 | if (!fd.is_open()) { 35 | PrintErrorMessage("Could not open " + filename + "! Aborting! Try running --phase2"); 36 | exit(1); 37 | } 38 | std::string headerline = "msr;flipped_bits;(" + PMCReferenceThreshold::GetCSVHeaderline() 39 | + ";observed_value;)*"; 40 | std::string line; 41 | std::getline(fd, line); 42 | if (line != headerline) { 43 | PrintErrorMessage("File " + filename + " has an incorrect format (0)"); 44 | exit(1); 45 | } 46 | 47 | // PMCReferenceCSV;observed_value 48 | size_t threshold_csv_length = PMCReferenceThreshold::GetCSVLength(); 49 | size_t variable_csv_block_length = threshold_csv_length + 1; 50 | Phase2Results results; 51 | while (std::getline(fd, line)) { 52 | auto line_splitted = SplitString(line, ';'); 53 | if ((line_splitted.size() - 2) % variable_csv_block_length != 0) { 54 | PrintErrorMessage("File " + filename + " has an incorrect format (1)"); 55 | exit(1); 56 | } 57 | PMCDifferences observed_sideeffects; 58 | try { 59 | uint32_t msr = std::stoull(line_splitted[0], nullptr, 16); 60 | uint32_t flipped_bits = std::stoull(line_splitted[1], nullptr, 16); 61 | if (line_splitted.size() > 2) { 62 | for (size_t i = 2; // skip msr and flipped_bits entry 63 | i < line_splitted.size() - threshold_csv_length; 64 | i += variable_csv_block_length) { 65 | PMCReferenceThreshold reference_threshold; 66 | std::vector threshold_csv(line_splitted.begin() + i, 67 | line_splitted.begin() + i + threshold_csv_length); 68 | int err = reference_threshold.LoadFromCSV(threshold_csv); 69 | if (err) { 70 | PrintErrorMessage("File " + filename + " has an incorrect format (2)"); 71 | exit(1); 72 | } 73 | double observed_value = std::stod(line_splitted[i + threshold_csv_length]); 74 | observed_sideeffects.emplace_back(reference_threshold, observed_value); 75 | } 76 | } 77 | results.emplace_back(msr, observed_sideeffects, flipped_bits); 78 | } catch (std::exception& e) { 79 | PrintErrorMessage(e.what()); 80 | PrintErrorMessage("File " + filename + " has an incorrect format (3)"); 81 | exit(1); 82 | } 83 | } // while (std::getline(fd, line)) { 84 | return results; 85 | } 86 | 87 | PMCDifferences CheckForSideEffects(const Phase1Result& msr_test_result, 88 | uint64_t bits_to_flip, 89 | uint32_t core_id, 90 | bool keep_write_only_msrs, 91 | const MSRInterface& msr_interface, 92 | const std::string& instruction_folder, 93 | const PMCReferenceThresholdMap& reference_threshold_map) { 94 | PMCDifferences empty_vector; 95 | if (msr_test_result.flip_bitmask == 0 || msr_test_result.error_code != ErrorCode::kSuccess) { 96 | // in this case we cannot flip anything 97 | return empty_vector; 98 | } 99 | 100 | std::string pmc_test_results("TODO_phase2_pmc_test_results"); 101 | 102 | // flip all flippable bits 103 | //int err = FlipBits(msr_test_result.msr, msr_test_result.flip_bitmask, msr_interface); 104 | int err = FlipBits(msr_test_result.msr, 105 | bits_to_flip, 106 | false, 107 | keep_write_only_msrs, 108 | msr_interface); 109 | if (err) { 110 | PrintWarningMessage("Skipping MSR " + ToHex(msr_test_result.msr) + "."); 111 | return empty_vector; 112 | } 113 | 114 | // measure PMCs 115 | err = RecordPMCs(core_id, instruction_folder, pmc_test_results); 116 | if (err) { 117 | PrintWarningMessage("Error recording PMC events. Skipping MSR."); 118 | return empty_vector; 119 | } 120 | 121 | // flip back all flippable bits 122 | //err = FlipBits(msr_test_result.msr, msr_test_result.flip_bitmask, msr_interface); 123 | err = FlipBits(msr_test_result.msr, 124 | bits_to_flip, 125 | true, 126 | keep_write_only_msrs, 127 | msr_interface); 128 | if (err) { 129 | PrintErrorMessage("Error resetting state. Aborting!"); 130 | exit(1); 131 | } 132 | 133 | return CheckForPMCDifference(reference_threshold_map, pmc_test_results); 134 | } 135 | 136 | Phase2Results SearchForSideEffects(const Phase1Results& test_results, 137 | const std::string& pmc_threshold_file, 138 | bool keep_write_only_msrs, 139 | uint32_t core_id) { 140 | MSRInterface msr_interface(core_id); 141 | PMCReferenceThresholdMap pmc_reference_thresholds = ReadInPMCThresholds(pmc_threshold_file); 142 | 143 | Phase2Results phase_2_results; 144 | for (Phase1Result msr_test_result : test_results) { 145 | PrintInfoMessage("Checking MSR " + ToHex(msr_test_result.msr)); 146 | // TODO: export this 'if' into some config or so 147 | if (msr_test_result.msr == 0x140) { 148 | PrintWarningMessage("Skipping MSR because it breaks nanoBench."); 149 | continue; 150 | } 151 | 152 | // get all possible bit windows that we should flip 153 | //std::vector list_to_flip = CreateSlidingBitwindowMasks( 154 | // msr_test_result.flip_bitmask, 155 | // kBitWindowSize); 156 | std::vector list_to_flip = CreateUnifiedBitwindowMasks( 157 | msr_test_result.flip_bitmask, 158 | kBitWindowSize); 159 | for (uint64_t bits_to_flip : list_to_flip) { 160 | if (bits_to_flip == 0) { 161 | // ignore cases in which we would not flip anything 162 | continue; 163 | } 164 | 165 | PMCDifferences observed_sideeffects_run1 = 166 | CheckForSideEffects(msr_test_result, 167 | bits_to_flip, 168 | core_id, 169 | keep_write_only_msrs, 170 | msr_interface, 171 | kInstructionFolder, 172 | pmc_reference_thresholds); 173 | 174 | PMCDifferences observed_sideeffects_run2; 175 | PMCDifferences observed_sideeffects_union12; 176 | if (!observed_sideeffects_run1.empty()) { 177 | observed_sideeffects_run2 = CheckForSideEffects(msr_test_result, 178 | bits_to_flip, 179 | core_id, 180 | keep_write_only_msrs, 181 | msr_interface, 182 | kInstructionFolder, 183 | pmc_reference_thresholds); 184 | observed_sideeffects_union12 = UnionSideEffects(observed_sideeffects_run1, 185 | observed_sideeffects_run2); 186 | } 187 | PMCDifferences observed_sideeffects_run3; 188 | PMCDifferences observed_sideeffects_union123; 189 | if (!observed_sideeffects_union12.empty()) { 190 | observed_sideeffects_run3 = CheckForSideEffects(msr_test_result, 191 | bits_to_flip, 192 | core_id, 193 | keep_write_only_msrs, 194 | msr_interface, 195 | kInstructionFolder, 196 | pmc_reference_thresholds); 197 | observed_sideeffects_union123 = UnionSideEffects(observed_sideeffects_union12, 198 | observed_sideeffects_run3); 199 | } 200 | 201 | if (!observed_sideeffects_union123.empty()) { 202 | PrintSuccessMessage("Found difference for MSR " + ToHex(msr_test_result.msr) 203 | + " by flipping bits " + ToHex(bits_to_flip)); 204 | phase_2_results.emplace_back(msr_test_result.msr, 205 | observed_sideeffects_union123, 206 | bits_to_flip); 207 | // we break as we only want to add an "interesting" msr one single time 208 | break; 209 | } 210 | } 211 | } 212 | return phase_2_results; 213 | } 214 | 215 | -------------------------------------------------------------------------------- /msr_influences/runner/phase2.h: -------------------------------------------------------------------------------- 1 | #ifndef MSR_UOPS_RUNNERV2_PHASE2_H_ 2 | #define MSR_UOPS_RUNNERV2_PHASE2_H_ 3 | 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | #include "phase1.h" 11 | #include "common.h" 12 | 13 | struct Phase2Result { 14 | uint32_t msr; 15 | PMCDifferences observed_sideeffects; 16 | uint64_t flipped_bits = 0; 17 | Phase2Result(uint32_t msr_value, 18 | PMCDifferences observed_sideeffects_value) 19 | : msr(msr_value), 20 | observed_sideeffects(std::move(observed_sideeffects_value)) {} 21 | Phase2Result(uint32_t msr_value, 22 | PMCDifferences observed_sideeffects_value, 23 | uint64_t flipped_bits_value) 24 | : msr(msr_value), 25 | observed_sideeffects(std::move(observed_sideeffects_value)), 26 | flipped_bits(flipped_bits_value) {} 27 | }; 28 | using Phase2Results = std::vector; 29 | 30 | Phase2Results SearchForSideEffects(const Phase1Results& test_results, 31 | const std::string& pmc_threshold_file, 32 | bool keep_write_only_msrs, 33 | uint32_t core_id); 34 | void CalibrateReferenceThresholds(const std::string& pmc_threshold_file, 35 | uint32_t core_id, 36 | uint32_t maximum_calibrate_tries); 37 | 38 | Phase2Results ReadInSideEffects(const std::string& filename); 39 | void WriteOutSideEffects(const std::string& filename, const Phase2Results& results); 40 | 41 | #endif // MSR_UOPS_RUNNERV2_PHASE2_H_ 42 | -------------------------------------------------------------------------------- /msr_influences/runner/phase3.cc: -------------------------------------------------------------------------------- 1 | #include "phase3.h" 2 | 3 | #include 4 | #include 5 | 6 | #include "phase1.h" 7 | #include "phase2.h" 8 | 9 | void WriteOutTracedBits(const std::string& filename, const Phase3Results& results) { 10 | std::ofstream fd(filename); 11 | if (!fd.is_open()) { 12 | PrintErrorMessage("Could not open " + filename + "! Aborting! "); 13 | exit(1); 14 | } 15 | 16 | std::string headerline = "msr;flipped_bits;" + PMCReferenceThreshold::GetCSVHeaderline() 17 | + ";observed_value;"; 18 | fd << headerline << std::endl; 19 | for (const Phase3Result& result : results) { 20 | for (auto&[thresholds, observed_value] : result.observed_sideeffects) { 21 | fd << ToHex(result.msr) << ";" << ToHex(result.flipped_bits); 22 | fd << ";" << thresholds.ToCSV() << ";" << observed_value; 23 | fd << std::endl; 24 | } 25 | } 26 | } 27 | 28 | PMCDifferences CheckBitSideeffects(uint32_t msr, 29 | uint64_t bits_to_flip, 30 | bool keep_write_only_msrs, 31 | const std::string& instruction_folder, 32 | const PMCReferenceThresholdMap& reference_threshold_map, 33 | const MSRInterface& msr_interface, 34 | uint32_t core_id) { 35 | PMCDifferences empty_vector; 36 | 37 | // flip target bits 38 | int err = FlipBits(msr, bits_to_flip, false, keep_write_only_msrs, msr_interface); 39 | if (err) { 40 | PrintWarningMessage("Could not flip flippable bits. Skipping bits."); 41 | return empty_vector; 42 | } 43 | 44 | // measure PMCs 45 | std::string pmc_test_results("TODO_phase3_pmc_test_results"); 46 | err = RecordPMCs(core_id, instruction_folder, pmc_test_results); 47 | if (err) { 48 | PrintWarningMessage("Error recording PMC events. Skipping bit."); 49 | return empty_vector; 50 | } 51 | 52 | // flip back all flippable bits 53 | err = FlipBits(msr, bits_to_flip, true, keep_write_only_msrs, msr_interface); 54 | if (err) { 55 | PrintErrorMessage("Error resetting state. Aborting!"); 56 | exit(1); 57 | } 58 | return CheckForPMCDifference(reference_threshold_map, pmc_test_results); 59 | } 60 | 61 | Phase3Results TraceSideEffectsToBits(const Phase1Results& phase1_results, 62 | const Phase2Results& phase2_results, 63 | const std::string& pmc_threshold_file, 64 | bool keep_write_only_msrs, 65 | uint32_t core_id) { 66 | MSRInterface msr_interface(core_id); 67 | PMCReferenceThresholdMap pmc_reference_thresholds = ReadInPMCThresholds(pmc_threshold_file); 68 | // create bitmask mapping 69 | std::unordered_map msr_to_flippable_bits; 70 | for (Phase1Result res : phase1_results) { 71 | msr_to_flippable_bits[res.msr] = res.flip_bitmask; 72 | } 73 | 74 | Phase3Results phase3_results; 75 | for (const Phase2Result& phase2_result : phase2_results) { 76 | uint32_t msr = phase2_result.msr; 77 | PrintInfoMessage("Checking MSR " + ToHex(msr)); 78 | std::vector bitwindows = CreateSlidingBitwindowMasks(msr_to_flippable_bits[msr], 79 | kBitWindowSize); 80 | for (uint64_t bits_to_flip : bitwindows) { 81 | if (bits_to_flip == 0) { 82 | // ignore cases in which we would not flip anything 83 | continue; 84 | } 85 | PrintInfoMessage("Checking MSR " + ToHex(msr) + " - bits " + ToHex(bits_to_flip)); 86 | PMCDifferences observed_sideeffects_run1 = CheckBitSideeffects(msr, 87 | bits_to_flip, 88 | keep_write_only_msrs, 89 | kInstructionFolder, 90 | pmc_reference_thresholds, 91 | msr_interface, 92 | core_id); 93 | 94 | PMCDifferences observed_sideeffects_run2; 95 | PMCDifferences observed_sideeffects_union12; 96 | if (!observed_sideeffects_run1.empty()) { 97 | 98 | observed_sideeffects_run2 = CheckBitSideeffects(msr, 99 | bits_to_flip, 100 | keep_write_only_msrs, 101 | kInstructionFolder, 102 | pmc_reference_thresholds, 103 | msr_interface, 104 | core_id); 105 | observed_sideeffects_union12 = UnionSideEffects(observed_sideeffects_run1, 106 | observed_sideeffects_run2); 107 | } 108 | PMCDifferences observed_sideeffects_run3; 109 | PMCDifferences observed_sideeffects_union123; 110 | if (!observed_sideeffects_union12.empty()) { 111 | observed_sideeffects_run3 = CheckBitSideeffects(msr, 112 | bits_to_flip, 113 | keep_write_only_msrs, 114 | kInstructionFolder, 115 | pmc_reference_thresholds, 116 | msr_interface, 117 | core_id); 118 | observed_sideeffects_union123 = UnionSideEffects(observed_sideeffects_union12, 119 | observed_sideeffects_run3); 120 | } 121 | 122 | if (!observed_sideeffects_union123.empty()) { 123 | PrintSuccessMessage("Found difference for MSR " + ToHex(msr) 124 | + " - bits " + ToHex(bits_to_flip)); 125 | phase3_results.emplace_back(msr, bits_to_flip, observed_sideeffects_union123); 126 | } 127 | } 128 | } 129 | return phase3_results; 130 | } -------------------------------------------------------------------------------- /msr_influences/runner/phase3.h: -------------------------------------------------------------------------------- 1 | #ifndef MSR_UOPS_RUNNERV2_PHASE3_H_ 2 | #define MSR_UOPS_RUNNERV2_PHASE3_H_ 3 | 4 | #include "phase1.h" 5 | #include "phase2.h" 6 | 7 | struct Phase3Result { 8 | uint32_t msr; 9 | uint64_t flipped_bits; 10 | PMCDifferences observed_sideeffects; 11 | Phase3Result(uint32_t msr_value, 12 | uint64_t flipped_bits_val, 13 | PMCDifferences observed_sideeffects_value) 14 | : msr(msr_value), 15 | flipped_bits(flipped_bits_val), 16 | observed_sideeffects(std::move(observed_sideeffects_value)) {} 17 | }; 18 | using Phase3Results = std::vector; 19 | 20 | Phase3Results TraceSideEffectsToBits(const Phase1Results& phase1_results, 21 | const Phase2Results& phase2_results, 22 | const std::string& pmc_threshold_file, 23 | bool keep_write_only_msrs, 24 | uint32_t core_id); 25 | void WriteOutTracedBits(const std::string& filename, const Phase3Results& results); 26 | 27 | #endif // MSR_UOPS_RUNNERV2_PHASE3_H_ 28 | -------------------------------------------------------------------------------- /msr_influences/runner/reserved_msr_bits.csv: -------------------------------------------------------------------------------- 1 | msr;name;bits-to-check 2 | 17;MSR_PLATFORM_ID;53-63,13-49,0-7 3 | A1;MSR_SMRR_PHYSMASK;32-63,0-10 4 | CD;MSR_FSB_FREQ;3-63 5 | E7;IA32_MPERF;3-63 6 | 17A;IA32_MCG_STATUS;3-63 7 | 198;MSR_PERF_STATUS;47-63,45-45,32-39,16-30 8 | 19D;MSR_THERM2_CTL;16-63,0-15 9 | 1C9;MSR_LASTBRANCH_TOS;40-63 10 | 38D;IA32_FIXED_CTR_CTRL;8-63 11 | 17;MSR_PLATFORM_ID;13-63,0-7 12 | CD;MSR_FSB_FREQ;3-63 13 | 17A;IA32_MCG_STATUS;3-63 14 | 198;MSR_PERF_STATUS;45-63,16-39 15 | 1C9;MSR_LASTBRANCH_TOS;35-63,24-33,21-21,19-19,14-15 16 | 2A;MSR_EBL_CR_POWERON;0-63 17 | 34;MSR_SMI_COUNT;32-63 18 | E4;MSR_PMG_IO_CAPTURE_BASE;19-63 19 | 13C;MSR_FEATURE_CONFIG;2-63 20 | 17A;IA32_MCG_STATUS;3-63 21 | 187;IA32_PERFEVTSEL1;32-63,21-21 22 | 1A2;MSR_TEMPERATURE_TARGET;30-63,0-15 23 | 17;MSR_PLATFORM_ID;33-63,13-49,0-7 24 | 3A;IA32_FEATURE_CONTROL;1-1 25 | CE;MSR_PLATFORM_INFO;16-63,0-7 26 | 11E;MSR_BBL_CR_CTL3;24-63,9-22,1-7,16-63,11-14 27 | 1C8;MSR_LBR_SELECT;9-63,39-63,35-37,24-33,19-21 28 | 606;MSR_RAPL_POWER_UNIT;20-63,13-15,4-7 29 | 610;MSR_PKG_POWER_LIMIT;24-63 30 | 1A4;MSR_MISC_FEATURE_CONTROL;3-63,1-1 31 | 606;MSR_RAPL_POWER_UNIT;20-63,13-15,4-7 32 | CD;MSR_FSB_FREQ;5-63 33 | E2;MSR_PKG_CST_CONFIG_CONTROL;16-63,11-14,3-9 34 | 17;MSR_PLATFORM_ID;33-63,0-49 35 | 3A;IA32_FEATURE_CONTROL;19-63 36 | 17D;MSR_SMM_MCA_CAP;60-63,0-57,16-63,11-14 37 | 1A4;MSR_MISC_FEATURE_CONTROL;3-63,1-1,39-63,35-37,24-33,19-21 38 | 1C9;MSR_LASTBRANCH_TOS;10-63 39 | 1FC;MSR_POWER_CTL;2-63,0-0 40 | 38E;IA32_PERF_GLOBAL_STATUS;56-57,35-54,4-31 41 | 391;IA32_PERF_GLOBAL_STATUS_SET;63-63,56-57,35-54,4-31 42 | 4E0;MSR_SMM_FEATURE_CONTROL;3-63,1-1 43 | 500;IA32_SGX_SVN_STATUS;24-63,1-15 44 | 571;IA32_RTIT_STATUS;49-63,6-31,3-3,40-63,28-31,23-23,18-18,12-12 45 | 572;IA32_RTIT_CR3_MATCH;0-4 46 | 606;MSR_RAPL_POWER_UNIT;20-63,13-15,4-7 47 | 60B;MSR_PKGC_IRTL1;16-63,13-14 48 | 60C;MSR_PKGC_IRTL2;16-63,13-14 49 | 614;MSR_PKG_POWER_INFO;55-63,47-47,31-31,15-15 50 | 64C;MSR_TURBO_ACTIVATION_RATIO;32-63,8-30 51 | 680;MSR_LASTBRANCH_0_FROM_IP;31-63 52 | C8F;IA32_PQR_ASSOC;34-63,0-31 53 | D10;IA32_L2_QOS_MASK_0;8-63 54 | D11;IA32_L2_QOS_MASK_1;8-63 55 | D13;IA32_L2_QOS_MASK_3;20-63,8-63 56 | 3A;IA32_FEATURE_CONTROL;19-63 57 | 3F1;MSR_PEBS_ENABLE;35-63,4-31 58 | 680;MSR_LASTBRANCH_0_FROM_IP;40-63,28-31,23-23,18-18 59 | 33;MSR_TEST_CTRL;31-31,30-30,0-28 60 | CF;IA32_CORE_CAPABILITIES;6-63,0-4 61 | 3F1;MSR_PEBS_ENABLE;63-63 62 | 14C8;;48-63 63 | 17;MSR_PLATFORM_ID;53-63,0-49 64 | 34;MSR_SMI_COUNT;32-63 65 | E4;MSR_PMG_IO_CAPTURE_BASE;19-63,31-63 66 | 186;IA32_PERFEVTSEL0;32-63,3-63 67 | 198;IA32_PERF_STATUS;16-63 68 | 19A;IA32_CLOCK_MODULATION;5-63,0-0 69 | 1A2;MSR_TEMPERATURE_TARGET;24-63,0-15,39-63,35-37 70 | 1A4;MSR_MISC_FEATURE_CONTROL;4-63 71 | 1AA;MSR_MISC_PWR_MGMT;2-63 72 | 1AC;MSR_TURBO_POWER_CURRENT_LIMIT;32-63 73 | 1AD;MSR_TURBO_RATIO_LIMIT;32-63 74 | 1C9;MSR_LASTBRANCH_TOS;9-63 75 | 1FC;MSR_POWER_CTL;2-63,0-0 76 | 345;IA32_PERF_CAPABILITIES;13-63 77 | 3F1;MSR_PEBS_ENABLE;36-63,4-31 78 | 3F6;MSR_PEBS_LD_LAT;36-63 79 | 301;MSR_GQ_SNOOP_MESF;8-63,32-63 80 | 13C;MSR_FEATURE_CONFIG;2-63 81 | 1AD;MSR_TURBO_RATIO_LIMIT;48-63 82 | 13C;MSR_FEATURE_CONFIG;2-63 83 | 34;MSR_SMI_COUNT;32-63 84 | CE;MSR_PLATFORM_INFO;48-63,30-39,16-27,0-7 85 | E4;MSR_PMG_IO_CAPTURE_BASE;19-63,29-63,16-24,11-14 86 | 13C;MSR_FEATURE_CONFIG;2-63 87 | 17A;IA32_MCG_STATUS;3-63 88 | 198;IA32_PERF_STATUS;16-63 89 | 19A;IA32_CLOCK_MODULATION;5-63 90 | 1A2;MSR_TEMPERATURE_TARGET;24-63,0-15,39-63,35-37,24-33,19-21 91 | 1A6;MSR_OFFCORE_RSP_0;4-63 92 | 1C8;MSR_LBR_SELECT;9-63 93 | 1DD;MSR_LER_FROM_LIP;15-63 94 | 38D;IA32_FIXED_CTR_CTRL;13-63 95 | 38E;IA32_PERF_GLOBAL_STATUS;35-60,8-31 96 | 390;IA32_PERF_GLOBAL_OVF_CTRL;35-60,8-31,35-63,8-31 97 | 3F6;MSR_PEBS_LD_LAT;36-63,36-62 98 | 410;IA32_MC4_CTL;2-63 99 | 60D;MSR_PKG_C2_RESIDENCY;16-63 100 | 1AD;MSR_TURBO_RATIO_LIMIT;32-63 101 | 391;MSR_UNC_PERF_GLOBAL_CTRL;32-63,5-18 102 | 392;MSR_UNC_PERF_GLOBAL_STATUS;4-63,2-2 103 | 395;MSR_UNC_PERF_FIXED_CTR;48-63,23-63,21-21 104 | 396;MSR_UNC_CBO_CONFIG;4-63 105 | 1AD;MSR_TURBO_RATIO_LIMIT;2-63 106 | 39C;MSR_PEBS_NUM_ALT;1-63 107 | 639;MSR_PP0_ENERGY_STATUS;29-63 108 | 648;MSR_CONFIG_TDP_NOMINAL;8-63 109 | 649;MSR_CONFIG_TDP_LEVEL1;63-63,47-47,24-31,15-15 110 | 64A;MSR_CONFIG_TDP_LEVEL2;63-63,47-47,24-31,15-15 111 | 64C;MSR_TURBO_ACTIVATION_RATIO;32-63,8-30,32-63,2-30 112 | 4F;MSR_PPIN;2-63 113 | 179;IA32_MCG_CAP;27-63,25-25,12-15,16-63,11-14 114 | 17F;MSR_ERROR_CONTROL;2-63,0-0 115 | 1A2;MSR_TEMPERATURE_TARGET;28-63,0-15 116 | 285;IA32_MC5_CTL2;32-63 117 | 3A;IA32_FEATURE_CONTROL;16-63 118 | 179;IA32_MCG_CAP;25-63,12-15 119 | 1AE;MSR_TURBO_RATIO_LIMIT1;56-62,4-63 120 | 41B;IA32_MC6_MISC;32-63,9-15,36-63 121 | 186;IA32_PERFEVTSEL0;56-63 122 | 1D9;IA32_DEBUGCTL;15-63,2-5,9-63 123 | 60C;MSR_PKGC_IRTL2;16-63,13-14,16-63,13-14 124 | 649;MSR_CONFIG_TDP_LEVEL1;63-63,24-31,15-15,8-63 125 | 64A;MSR_CONFIG_TDP_LEVEL2;63-63,24-31,15-15 126 | 64B;MSR_CONFIG_TDP_CONTROL;32-63,2-30 127 | C80;IA32_DEBUG_INTERFACE;32-63,8-30 128 | 17D;MSR_SMM_MCA_CAP;60-63,0-57,29-63,16-24,11-14 129 | 1AD;MSR_TURBO_RATIO_LIMIT;32-63 130 | 392;MSR_UNC_PERF_GLOBAL_STATUS;4-63,2-2,32-63 131 | 394;MSR_UNC_PERF_FIXED_CTRL;23-63,21-21,0-19 132 | 395;MSR_UNC_PERF_FIXED_CTR;48-63 133 | 396;MSR_UNC_CBO_CONFIG;4-63 134 | 395;MSR_UNC_PERF_FIXED_CTR;48-63 135 | 4E0;MSR_SMM_FEATURE_CONTROL;3-63,1-1 136 | 606;MSR_RAPL_POWER_UNIT;20-63,13-15,4-7 137 | 700;MSR_UNC_CBO_0_PERFEVTSEL0;30-63 138 | E2;MSR_PKG_CST_CONFIG_CONTROL;29-63,16-24,11-14,4-9 139 | 631;MSR_PKG_C9_RESIDENCY;60-63 140 | 632;MSR_PKG_C10_RESIDENCY;60-63 141 | 53;MSR_THREAD_ID_INFO;8-63,32-63 142 | 179;IA32_MCG_CAP;27-63,12-15 143 | 17D;MSR_SMM_MCA_CAP;60-63,0-57 144 | 17F;MSR_ERROR_CONTROL;2-63,0-0 145 | 606;MSR_RAPL_POWER_UNIT;20-63,13-15,4-7 146 | 619;MSR_DRAM_ENERGY_STATUS;32-63 147 | 620;MSR;7-7,15-63 148 | C8E;IA32_QM_CTR;42-63,8-31 149 | C8F;IA32_PQR_ASSOC;10-63 150 | 38E;IA32_PERF_GLOBAL_STATUS;56-60,35-54,4-31 151 | 560;IA32_RTIT_OUTPUT_BASE;0-6,56-60,35-54 152 | 561;IA32_RTIT_OUTPUT_MASK_PTRS;0-6 153 | 570;IA32_RTIT_CTL;14-63,13-13,12-12,9-9,4-6,1-1 154 | 572;IA32_RTIT_CR3_MATCH;0-4,6-63 155 | 620;MSR;7-7,15-63 156 | 639;MSR_PP0_ENERGY_STATUS;48-63 157 | 4E;MSR_PPIN_CTL;2-63 158 | 179;IA32_MCG_CAP;27-63,12-15,31-63 159 | 17D;MSR_SMM_MCA_CAP;60-63,0-57 160 | 1AD;MSR_TURBO_RATIO_LIMIT;28-63 161 | 618;MSR_DRAM_POWER_LIMIT;20-63 162 | 619;MSR_DRAM_ENERGY_STATUS;32-63 163 | 620;MSR;7-7,15-63 164 | 770;IA32_PM_ENABLE;32-63 165 | 774;IA32_HWP_REQUEST;24-63 166 | 777;IA32_HWP_STATUS;3-63,0-1 167 | C8F;IA32_PQR_ASSOC;52-63,10-31,42-63 168 | C90;IA32_L3_QOS_MASK_0;20-63 169 | C91;IA32_L3_QOS_MASK_1;20-63 170 | C92;IA32_L3_QOS_MASK_2;20-63 171 | C93;IA32_L3_QOS_MASK_3;20-63 172 | C94;IA32_L3_QOS_MASK_4;20-63 173 | C95;IA32_L3_QOS_MASK_5;20-63 174 | C97;IA32_L3_QOS_MASK_7;20-63,20-63 175 | C98;IA32_L3_QOS_MASK_8;20-63 176 | C99;IA32_L3_QOS_MASK_9;20-63 177 | C9A;IA32_L3_QOS_MASK_10;20-63 178 | C9B;IA32_L3_QOS_MASK_11;20-63 179 | C9C;IA32_L3_QOS_MASK_12;20-63 180 | C9D;IA32_L3_QOS_MASK_13;20-63 181 | C9F;IA32_L3_QOS_MASK_15;20-63,20-63 182 | 1AC;MSR_TURBO_RATIO_LIMIT3;0-62 183 | 1AC;MSR_TURBO_RATIO_LIMIT3;0-62 184 | 1AD;MSR_TURBO_RATIO_LIMIT;32-63,32-63 185 | 300;MSR_SGXOWNEREPOCH0;21-63 186 | 390;IA32_PERF_GLOBAL_STATUS_RESET;56-57,35-54,8-31 187 | 392;IA32_PERF_GLOBAL_INUSE;63-63,56-57,35-54,8-31 188 | 3F7;MSR_PEBS_FRONTEND;23-63,5-7,3-3 189 | 500;IA32_SGX_SVN_STATUS;24-63,1-15 190 | 570;IA32_RTIT_CTL;40-63,28-31,23-23,18-18,12-12,4-6 191 | 572;IA32_RTIT_CR3_MATCH;0-4 192 | 64D;MSR_PLATFORM_ENERGY_COUNTER;32-63 193 | 652;MSR_PKG_HDC_CONFIG;3-63,30-63 194 | 690;MSR_LASTBRANCH_16_FROM_IP;49-62,24-31 195 | 6D0;MSR_LASTBRANCH_16_TO_IP;28-63,25-25 196 | 777;IA32_HWP_STATUS;43-63 197 | 394;MSR_UNC_PERF_FIXED_CTRL;23-63,21-21,0-19 198 | 395;MSR_UNC_PERF_FIXED_CTR;44-63 199 | 396;MSR_UNC_CBO_CONFIG;4-63 200 | E01;MSR_UNC_PERF_GLOBAL_CTRL;32-63,5-18 201 | 80;MSR_TRACE_HUB_STH_ACPIBAR_BASE;1-17 202 | 1F4;MSR_PRMRR_PHYS_BASE;46-63,3-11 203 | 1F5;MSR_PRMRR_PHYS_MASK;46-63,0-9 204 | 2F4;MSR_UNCORE_PRMRR_PHYS_BASE;0-11 205 | 2F5;MSR_UNCORE_PRMRR_PHYS_MASK;39-63,0-9 206 | 3A;IA32_FEATURE_CONTROL;21-63 207 | 354;MSR_BR_DETECT_COUNTER_CONFIG_i;48-63,26-31 208 | 3F8;MSR_PKG_C3_RESIDENCY;16-63 209 | 620;MSR_RING_RATIO_LIMIT;15-63,7-7 210 | 394;MSR_UNC_PERF_FIXED_CTRL;23-63,21-21,0-19 211 | 395;MSR_UNC_PERF_FIXED_CTR;48-63 212 | 396;MSR_UNC_CBO_CONFIG;4-63 213 | E01;MSR_UNC_PERF_GLOBAL_CTRL;32-63,5-18 214 | 33;MSR_TEST_CTRL;31-31,30-30,0-28 215 | A0;MSR_BIOS_MCU_ERRORCODE;16-30 216 | 151;MSR_BIOS_DONE;2-31 217 | 1F1;MSR_CRASHLOG_CONTROL;1-63 218 | 2A0;MSR_PRMRR_BASE_0;52-63,4-11 219 | 3F2;MSR_PEBS_DATA_CFG;4-23,25-63 220 | 541;MSR_CORE_UARCH_CTL;1-31 221 | 65E;MSR_FAST_UNCORE_MSRS_STATUS;1-31 222 | 65F;MSR_FAST_UNCORE_MSRS_CAPABILITY;4-31 223 | A0;MSR_BIOS_MCU_ERRORCODE;16-31 224 | CF;IA32_CORE_CAPABILITIES;7-31,4-4,1-1,32-63 225 | 492;IA32_VMX_PROCBASED_CTLS3;1-63 226 | 981;IA32_TME_CAPABILITY;63-63,13-30 227 | C82;IA32_L2_QOS_CFG;1-31 228 | D91;IA32_COPY_LOCAL_TO_PLATFORM1;20-31 229 | 3A;IA32_FEATURE_CONTROL;21-63 230 | 4F;MSR_PPIN;2-63 231 | CE;MSR_PLATFORM_INFO;48-63,31-39,24-27,16-22,0-7 232 | 17D;MSR_SMM_MCA_CAP;60-63,0-57 233 | 1A2;MSR_TEMPERATURE_TARGET;28-63,0-15,32-63,23-26 234 | 619;MSR_DRAM_ENERGY_STATUS;32-63 235 | 620;MSR;7-7,15-63 236 | C8D;IA32_QM_EVTSEL;42-63,8-31 237 | C90;IA32_L3_QOS_MASK_0;20-63,52-63,10-31 238 | C91;IA32_L3_QOS_MASK_1;20-63 239 | C92;IA32_L3_QOS_MASK_2;20-63 240 | C93;IA32_L3_QOS_MASK_3;20-63 241 | C94;IA32_L3_QOS_MASK_4;20-63 242 | C95;IA32_L3_QOS_MASK_5;20-63 243 | C96;IA32_L3_QOS_MASK_6;20-63 244 | C98;IA32_L3_QOS_MASK_8;20-63,20-63 245 | C99;IA32_L3_QOS_MASK_9;20-63 246 | C9A;IA32_L3_QOS_MASK_10;20-63 247 | C9B;IA32_L3_QOS_MASK_11;20-63 248 | C9C;IA32_L3_QOS_MASK_12;20-63 249 | C9D;IA32_L3_QOS_MASK_13;20-63 250 | C9F;IA32_L3_QOS_MASK_15;20-63,20-63 251 | 619;MSR_DRAM_ENERGY_STATUS;32-63 252 | 34;MSR_SMI_COUNT;32-63 253 | 4E;MSR_PPIN_CTL;2-63 254 | E4;MSR_PMG_IO_CAPTURE_BASE;23-63,30-63,27-27 255 | 13C;MSR_FEATURE_CONFIG;2-63 256 | 174;IA32_SYSENTER_CS;2-63 257 | 17D;MSR_SMM_MCA_CAP;60-63,32-55 258 | 187;IA32_PERFEVTSEL1;32-63 259 | 19C;IA32_THERM_STATUS;32-63,23-26,12-15 260 | 1A2;MSR_TEMPERATURE_TARGET;30-63,0-15,39-63,35-37,24-33,19-21,13-15,8-10,4-6,1-2 261 | 1A4;MSR_MISC_FEATURE_CONTROL;2-63 262 | 1C8;MSR_LBR_SELECT;9-63 263 | 1DD;MSR_LER_FROM_LIP;15-31,13-13 264 | 60D;MSR_PKG_C2_RESIDENCY;20-63,13-15,4-7 265 | 690;MSR_CORE_PERF_LIMIT_REASONS;9-63,7-7,2-5 266 | 2C;MSR_EBC_FREQUENCY_ID;24-63,0-20,25-63 267 | 18A;MSR_MCG_MISC;1-63 268 | 1D7;MSR_LER_FROM_LIP;32-63,19-63 269 | 1D8;MSR_LER_TO_LIP;32-63 270 | 3F2;MSR_PEBS_MATRIX_VERT;27-63 271 | 11E;MSR_BBL_CR_CTL3;24-63,9-22,1-7 272 | 186;IA32_PERFEVTSEL0;3-63 273 | 19D;MSR_THERM2_CTL;16-63,0-15 274 | 600;IA32_DS_AREA;12-63,0-10,32-63 275 | 40;MSR_LASTBRANCH_0;19-19,1-1,15-15 276 | 119;MSR_BBL_CR_CTL;0-63 277 | 179;IA32_MCG_CAP;9-63,24-63,9-22,6-7,1-4 278 | 198;IA32_PERF_STATUS;3-63 279 | 19D;MSR_THERM2_CTL;16-63,0-15 280 | 600;IA32_DS_AREA;32-63 281 | 17;IA32_PLATFORM_ID;61-63,57-59,0-49 282 | 1B;APIC_BASE;32-63,9-10,0-7 283 | 33;MSR_TEST_CTRL;0-29,28-63 284 | 174;SYSENTER_CS_MSR;11-11 285 | 1D9;DEBUGCTLMSR;7-31 286 | -------------------------------------------------------------------------------- /msr_influences/runner/unknown_msrs_formatted.csv: -------------------------------------------------------------------------------- 1 | msr;name;bits-to-check 2 | 1a0;UNDOCUMENTED;0-63 3 | 1b;UNDOCUMENTED;0-63 4 | 2a;UNDOCUMENTED;0-63 5 | c0000101;UNDOCUMENTED;0-63 6 | c0000080;UNDOCUMENTED;0-63 7 | 2e;UNDOCUMENTED;0-63 8 | 33;UNDOCUMENTED;0-63 9 | 34;UNDOCUMENTED;0-63 10 | 35;UNDOCUMENTED;0-63 11 | 3e;UNDOCUMENTED;0-63 12 | 95;UNDOCUMENTED;0-63 13 | ce;UNDOCUMENTED;0-63 14 | e2;UNDOCUMENTED;0-63 15 | e3;UNDOCUMENTED;0-63 16 | e4;UNDOCUMENTED;0-63 17 | 102;UNDOCUMENTED;0-63 18 | 103;UNDOCUMENTED;0-63 19 | 104;UNDOCUMENTED;0-63 20 | 110;UNDOCUMENTED;0-63 21 | 123;UNDOCUMENTED;0-63 22 | 13a;UNDOCUMENTED;0-63 23 | 13c;UNDOCUMENTED;0-63 24 | 140;UNDOCUMENTED;0-63 25 | 142;UNDOCUMENTED;0-63 26 | 150;UNDOCUMENTED;0-63 27 | 19d;UNDOCUMENTED;0-63 28 | 1a1;UNDOCUMENTED;0-63 29 | 1a2;UNDOCUMENTED;0-63 30 | 1a4;UNDOCUMENTED;0-63 31 | 1a6;UNDOCUMENTED;0-63 32 | 1a7;UNDOCUMENTED;0-63 33 | 1a8;UNDOCUMENTED;0-63 34 | 1aa;UNDOCUMENTED;0-63 35 | 1ad;UNDOCUMENTED;0-63 36 | 1c6;UNDOCUMENTED;0-63 37 | 1c8;UNDOCUMENTED;0-63 38 | 1c9;UNDOCUMENTED;0-63 39 | 1db;UNDOCUMENTED;0-63 40 | 1dc;UNDOCUMENTED;0-63 41 | 1dd;UNDOCUMENTED;0-63 42 | 1de;UNDOCUMENTED;0-63 43 | 1f0;UNDOCUMENTED;0-63 44 | 1fc;UNDOCUMENTED;0-63 45 | 2e0;UNDOCUMENTED;0-63 46 | 2e7;UNDOCUMENTED;0-63 47 | 305;UNDOCUMENTED;0-63 48 | 393;UNDOCUMENTED;0-63 49 | 394;UNDOCUMENTED;0-63 50 | 395;UNDOCUMENTED;0-63 51 | 396;UNDOCUMENTED;0-63 52 | 397;UNDOCUMENTED;0-63 53 | 3b0;UNDOCUMENTED;0-63 54 | 3b1;UNDOCUMENTED;0-63 55 | 3b2;UNDOCUMENTED;0-63 56 | 3b3;UNDOCUMENTED;0-63 57 | 3f0;UNDOCUMENTED;0-63 58 | 3f6;UNDOCUMENTED;0-63 59 | 3f8;UNDOCUMENTED;0-63 60 | 3f9;UNDOCUMENTED;0-63 61 | 3fa;UNDOCUMENTED;0-63 62 | 3fc;UNDOCUMENTED;0-63 63 | 3fd;UNDOCUMENTED;0-63 64 | 3fe;UNDOCUMENTED;0-63 65 | 4e0;UNDOCUMENTED;0-63 66 | 4e2;UNDOCUMENTED;0-63 67 | 4e3;UNDOCUMENTED;0-63 68 | 601;UNDOCUMENTED;0-63 69 | 603;UNDOCUMENTED;0-63 70 | 606;UNDOCUMENTED;0-63 71 | 60a;UNDOCUMENTED;0-63 72 | 60b;UNDOCUMENTED;0-63 73 | 60c;UNDOCUMENTED;0-63 74 | 60d;UNDOCUMENTED;0-63 75 | 610;UNDOCUMENTED;0-63 76 | 611;UNDOCUMENTED;0-63 77 | 613;UNDOCUMENTED;0-63 78 | 614;UNDOCUMENTED;0-63 79 | 615;UNDOCUMENTED;0-63 80 | 618;UNDOCUMENTED;0-63 81 | 619;UNDOCUMENTED;0-63 82 | 61b;UNDOCUMENTED;0-63 83 | 61d;UNDOCUMENTED;0-63 84 | 620;UNDOCUMENTED;0-63 85 | 621;UNDOCUMENTED;0-63 86 | 622;UNDOCUMENTED;0-63 87 | 623;UNDOCUMENTED;0-63 88 | 638;UNDOCUMENTED;0-63 89 | 639;UNDOCUMENTED;0-63 90 | 63a;UNDOCUMENTED;0-63 91 | 640;UNDOCUMENTED;0-63 92 | 641;UNDOCUMENTED;0-63 93 | 642;UNDOCUMENTED;0-63 94 | 648;UNDOCUMENTED;0-63 95 | 649;UNDOCUMENTED;0-63 96 | 64a;UNDOCUMENTED;0-63 97 | 64b;UNDOCUMENTED;0-63 98 | 64c;UNDOCUMENTED;0-63 99 | 680;UNDOCUMENTED;0-63 100 | 681;UNDOCUMENTED;0-63 101 | 682;UNDOCUMENTED;0-63 102 | 683;UNDOCUMENTED;0-63 103 | 684;UNDOCUMENTED;0-63 104 | 685;UNDOCUMENTED;0-63 105 | 686;UNDOCUMENTED;0-63 106 | 687;UNDOCUMENTED;0-63 107 | 688;UNDOCUMENTED;0-63 108 | 689;UNDOCUMENTED;0-63 109 | 68a;UNDOCUMENTED;0-63 110 | 68b;UNDOCUMENTED;0-63 111 | 68c;UNDOCUMENTED;0-63 112 | 68d;UNDOCUMENTED;0-63 113 | 68e;UNDOCUMENTED;0-63 114 | 68f;UNDOCUMENTED;0-63 115 | 690;UNDOCUMENTED;0-63 116 | 6b0;UNDOCUMENTED;0-63 117 | 6b1;UNDOCUMENTED;0-63 118 | 6c0;UNDOCUMENTED;0-63 119 | 6c1;UNDOCUMENTED;0-63 120 | 6c2;UNDOCUMENTED;0-63 121 | 6c3;UNDOCUMENTED;0-63 122 | 6c4;UNDOCUMENTED;0-63 123 | 6c5;UNDOCUMENTED;0-63 124 | 6c6;UNDOCUMENTED;0-63 125 | 6c7;UNDOCUMENTED;0-63 126 | 6c8;UNDOCUMENTED;0-63 127 | 6c9;UNDOCUMENTED;0-63 128 | 6ca;UNDOCUMENTED;0-63 129 | 6cb;UNDOCUMENTED;0-63 130 | 6cc;UNDOCUMENTED;0-63 131 | 6cd;UNDOCUMENTED;0-63 132 | 6ce;UNDOCUMENTED;0-63 133 | 6cf;UNDOCUMENTED;0-63 134 | 700;UNDOCUMENTED;0-63 135 | 701;UNDOCUMENTED;0-63 136 | 702;UNDOCUMENTED;0-63 137 | 703;UNDOCUMENTED;0-63 138 | 704;UNDOCUMENTED;0-63 139 | 705;UNDOCUMENTED;0-63 140 | 706;UNDOCUMENTED;0-63 141 | 707;UNDOCUMENTED;0-63 142 | 708;UNDOCUMENTED;0-63 143 | 709;UNDOCUMENTED;0-63 144 | 710;UNDOCUMENTED;0-63 145 | 711;UNDOCUMENTED;0-63 146 | 712;UNDOCUMENTED;0-63 147 | 713;UNDOCUMENTED;0-63 148 | 714;UNDOCUMENTED;0-63 149 | 715;UNDOCUMENTED;0-63 150 | 716;UNDOCUMENTED;0-63 151 | 717;UNDOCUMENTED;0-63 152 | 718;UNDOCUMENTED;0-63 153 | 719;UNDOCUMENTED;0-63 154 | 720;UNDOCUMENTED;0-63 155 | 721;UNDOCUMENTED;0-63 156 | 722;UNDOCUMENTED;0-63 157 | 723;UNDOCUMENTED;0-63 158 | 724;UNDOCUMENTED;0-63 159 | 725;UNDOCUMENTED;0-63 160 | 726;UNDOCUMENTED;0-63 161 | 727;UNDOCUMENTED;0-63 162 | 728;UNDOCUMENTED;0-63 163 | 729;UNDOCUMENTED;0-63 164 | 730;UNDOCUMENTED;0-63 165 | 731;UNDOCUMENTED;0-63 166 | 732;UNDOCUMENTED;0-63 167 | 733;UNDOCUMENTED;0-63 168 | 734;UNDOCUMENTED;0-63 169 | 735;UNDOCUMENTED;0-63 170 | 736;UNDOCUMENTED;0-63 171 | 737;UNDOCUMENTED;0-63 172 | 738;UNDOCUMENTED;0-63 173 | 739;UNDOCUMENTED;0-63 174 | 740;UNDOCUMENTED;0-63 175 | 741;UNDOCUMENTED;0-63 176 | 742;UNDOCUMENTED;0-63 177 | 743;UNDOCUMENTED;0-63 178 | 744;UNDOCUMENTED;0-63 179 | 745;UNDOCUMENTED;0-63 180 | 746;UNDOCUMENTED;0-63 181 | 747;UNDOCUMENTED;0-63 182 | 748;UNDOCUMENTED;0-63 183 | 749;UNDOCUMENTED;0-63 184 | -------------------------------------------------------------------------------- /msr_influences/runner/utils.cc: -------------------------------------------------------------------------------- 1 | #include "utils.h" 2 | 3 | #include 4 | #include 5 | 6 | #include 7 | #include 8 | 9 | 10 | std::vector SplitString(const std::string& input_str, char delimiter) { 11 | std::string delims; 12 | delims += delimiter; 13 | std::vector results; 14 | 15 | // pre-reserve for performance reasons 16 | results.reserve(2); 17 | 18 | std::string::const_iterator start = input_str.begin(); 19 | std::string::const_iterator end = input_str.end(); 20 | std::string::const_iterator next = std::find(start, end, delimiter); 21 | while (next != end) { 22 | results.emplace_back(start, next); 23 | start = next + 1; 24 | next = std::find(start, end, delimiter); 25 | } 26 | results.emplace_back(start, next); 27 | return results; 28 | } 29 | 30 | std::string ToHex(uint64_t number) { 31 | std::stringstream ss; 32 | ss << std::hex << "0x" << number; 33 | return ss.str(); 34 | } 35 | 36 | int Popcount(uint64_t number) { 37 | int count = 0; 38 | while (number != 0) { 39 | count += static_cast(number & 1ull); 40 | number >>= 1u; 41 | } 42 | return count; 43 | } 44 | 45 | void PrintInfoMessage(const std::string& message) { 46 | std::stringstream msg_stream; 47 | // change color 48 | msg_stream << "\033[33m"; 49 | //AddTimestamp(msg_stream); 50 | msg_stream << "[*] " << message; 51 | // change color back to normal 52 | msg_stream << "\033[0m"; 53 | std::cout << msg_stream.str() << std::endl; 54 | } 55 | 56 | void PrintSuccessMessage(const std::string& message) { 57 | std::stringstream msg_stream; 58 | // change color 59 | msg_stream << "\033[92m"; 60 | //AddTimestamp(msg_stream); 61 | msg_stream << "[+] " << message; 62 | // change color back to normal 63 | msg_stream << "\033[0m"; 64 | std::cout << msg_stream.str() << std::endl; 65 | } 66 | 67 | void PrintWarningMessage(const std::string& message) { 68 | std::stringstream msg_stream; 69 | // change color 70 | msg_stream << "\033[93m"; 71 | //AddTimestamp(msg_stream); 72 | msg_stream << "[+] " << message; 73 | // change color back to normal 74 | msg_stream << "\033[0m"; 75 | std::cout << msg_stream.str() << std::endl; 76 | } 77 | 78 | void PrintErrorMessage(const std::string& message) { 79 | std::stringstream msg_stream; 80 | // change color 81 | msg_stream << "\033[31m"; 82 | //AddTimestamp(msg_stream); 83 | msg_stream << "[-] " << message; 84 | // change color back to normal 85 | msg_stream << "\033[0m"; 86 | std::cerr << msg_stream.str() << std::endl; 87 | } 88 | -------------------------------------------------------------------------------- /msr_influences/runner/utils.h: -------------------------------------------------------------------------------- 1 | #ifndef MSR_UOPS_RUNNERV2_UTILS_H_ 2 | #define MSR_UOPS_RUNNERV2_UTILS_H_ 3 | 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | 12 | void PrintInfoMessage(const std::string& message); 13 | void PrintSuccessMessage(const std::string& message); 14 | void PrintWarningMessage(const std::string& message); 15 | void PrintErrorMessage(const std::string& message); 16 | 17 | std::vector SplitString(const std::string& input_str, char delimiter); 18 | std::string ToHex(uint64_t number); 19 | 20 | int Popcount(uint64_t number); 21 | 22 | /// Calculates the median of a given vector 23 | /// \tparam T type of the vector elements 24 | /// \param values list of values 25 | /// \return median 26 | template 27 | double median(std::vector values) { 28 | if (values.empty()) { 29 | return 0; 30 | } 31 | std::sort(values.begin(), values.end()); 32 | if (values.size() % 2 == 0) { 33 | return static_cast((values[(values.size() - 1) / 2] + values[values.size() / 2])) / 2; 34 | } else { 35 | return values[values.size() / 2]; 36 | } 37 | } 38 | 39 | #endif // MSR_UOPS_RUNNERV2_UTILS_H_ 40 | -------------------------------------------------------------------------------- /msr_influences/scripts/invoke-nanobench_combined_dir-v2.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # directories 4 | invoke_directory=`pwd` 5 | script_directory=$invoke_directory/`dirname "$0"` 6 | 7 | cfg=configs/cfg_Skylake_all.txt 8 | #cfg=configs/cfg_Zen_all.txt 9 | 10 | core=$1 11 | input_dir=$2 12 | output=$3 13 | 14 | loop_count=10 15 | 16 | nanobench_dir=/home/user/tools/nanoBench/ 17 | 18 | retvalue=0 19 | # get names of counters 20 | cd $nanobench_dir 21 | printf "NAME;" > $invoke_directory/$output 22 | sudo ./kernel-nanoBench.sh -cpu $core -asm_init "shr R14, 5; shl R14,5" -asm "add RAX, RAX" -config $cfg | cut -d':' -f1 | tr '\n' ';' | sed 's/.$//' >> $invoke_directory/$output 23 | errcode=${PIPESTATUS[0]} 24 | if [ $errcode -ne 0 ]; then 25 | retvalue=$errcode 26 | fi 27 | printf "\n" >> $invoke_directory/$output 28 | 29 | #sudo cpupower freequency-set -c $core -f 4.0Ghz -r 30 | 31 | for file in $invoke_directory/$input_dir/*.csv; do 32 | 33 | name="$(basename -- $file)" 34 | data=$(cat $file) 35 | 36 | echo "[*] invoke-nanoBench: running $name" 37 | printf "$name;" >> $invoke_directory/$output 38 | sudo ./kernel-nanoBench.sh -cpu $core -asm_init "shr R14, 5; shl R14,5" -asm "$data" -config $cfg -df -n_measurements $loop_count -unroll_count 100 | cut -d':' -f2 | tr '\n' ';' | sed 's/.$//' >> $invoke_directory/$output 39 | errcode=${PIPESTATUS[0]} 40 | if [ $errcode -ne 0 ]; then 41 | retvalue=$errcode 42 | fi 43 | printf "\n" >> $invoke_directory/$output 44 | done; 45 | exit $retvalue 46 | 47 | 48 | 49 | 50 | 51 | -------------------------------------------------------------------------------- /msr_influences/scripts/prepare_system.sh: -------------------------------------------------------------------------------- 1 | #! /bin/sh 2 | 3 | # load kernel modules 4 | sudo modprobe msr 5 | sudo insmod ~/tools/nanoBench/kernel/nb.ko 6 | 7 | 8 | # reduce noise on system 9 | #sudo ~/tools/nanoBench/disable-HT.sh 10 | echo "performance" | sudo tee /sys/devices/system/cpu/cpu3/cpufreq/scaling_governor 11 | 12 | # disable crosstalk mitigations 13 | sudo wrmsr -a 0x123 0x1 14 | 15 | # stop GUI 16 | sudo init 3 17 | -------------------------------------------------------------------------------- /msr_scans/intel-core-i7-6700k.csv: -------------------------------------------------------------------------------- 1 | 0,RW 2 | 1,RW 3 | 6,RW 4 | 10,RW 5 | 17,R 6 | 1b,RW 7 | 20,R 8 | 21,R 9 | 22,R 10 | 23,R 11 | 2a,R 12 | 2e,RW 13 | 33,RW 14 | 34,R 15 | 35,R 16 | 3a,R 17 | 3b,RW 18 | 3e,RW 19 | 59,R 20 | 7a,RW 21 | 80,RW 22 | 8b,RW 23 | 95,RW 24 | 9b,R 25 | c1,RW 26 | c2,RW 27 | c3,RW 28 | c4,RW 29 | ce,R 30 | e2,RW 31 | e4,RW 32 | e7,RW 33 | e8,RW 34 | fe,R 35 | 102,RW 36 | 103,RW 37 | 104,RW 38 | 110,R 39 | 118,R 40 | 11f,RW 41 | 121,R 42 | 139,W 43 | 13a,R 44 | 13c,R 45 | 13d,RW 46 | 140,RW 47 | 150,RW 48 | 174,RW 49 | 175,RW 50 | 176,RW 51 | 179,R 52 | 17a,RW 53 | 186,RW 54 | 187,RW 55 | 188,RW 56 | 189,RW 57 | 194,RW 58 | 198,R 59 | 199,RW 60 | 19a,RW 61 | 19b,RW 62 | 19c,RW 63 | 19d,R 64 | 1a0,RW 65 | 1a1,R 66 | 1a2,RW 67 | 1a4,RW 68 | 1a6,RW 69 | 1a7,RW 70 | 1a8,RW 71 | 1aa,RW 72 | 1ad,RW 73 | 1b0,RW 74 | 1b1,RW 75 | 1b2,RW 76 | 1c6,R 77 | 1c8,RW 78 | 1c9,RW 79 | 1d9,RW 80 | 1da,R 81 | 1db,R 82 | 1dc,R 83 | 1dd,RW 84 | 1de,RW 85 | 1e0,RW 86 | 1f0,R 87 | 1f2,R 88 | 1f3,R 89 | 1f4,R 90 | 1f5,R 91 | 1fb,R 92 | 1fc,RW 93 | 200,RW 94 | 201,RW 95 | 202,RW 96 | 203,RW 97 | 204,RW 98 | 205,RW 99 | 206,RW 100 | 207,RW 101 | 208,RW 102 | 209,RW 103 | 20a,RW 104 | 20b,RW 105 | 20c,RW 106 | 20d,RW 107 | 20e,RW 108 | 20f,RW 109 | 210,RW 110 | 211,RW 111 | 212,RW 112 | 213,RW 113 | 250,RW 114 | 258,RW 115 | 259,RW 116 | 268,RW 117 | 269,RW 118 | 26a,RW 119 | 26b,RW 120 | 26c,RW 121 | 26d,RW 122 | 26e,RW 123 | 26f,RW 124 | 277,RW 125 | 280,RW 126 | 281,RW 127 | 282,RW 128 | 283,RW 129 | 284,RW 130 | 285,RW 131 | 286,RW 132 | 287,RW 133 | 288,RW 134 | 289,RW 135 | 2e0,R 136 | 2e6,W 137 | 2e7,RW 138 | 2f4,R 139 | 2f5,R 140 | 2ff,RW 141 | 300,W 142 | 301,W 143 | 302,RW 144 | 305,R 145 | 309,RW 146 | 30a,RW 147 | 30b,RW 148 | 345,R 149 | 38d,RW 150 | 38e,R 151 | 38f,RW 152 | 390,RW 153 | 391,RW 154 | 392,R 155 | 393,RW 156 | 394,RW 157 | 395,RW 158 | 396,R 159 | 397,RW 160 | 3b0,RW 161 | 3b1,RW 162 | 3b2,RW 163 | 3b3,RW 164 | 3f1,RW 165 | 3f6,RW 166 | 3f7,RW 167 | 3f8,R 168 | 3f9,R 169 | 3fa,R 170 | 3fc,R 171 | 3fd,R 172 | 3fe,R 173 | 400,RW 174 | 401,RW 175 | 402,RW 176 | 403,RW 177 | 404,RW 178 | 405,RW 179 | 406,RW 180 | 407,RW 181 | 408,RW 182 | 409,RW 183 | 40a,RW 184 | 40b,RW 185 | 40c,RW 186 | 40d,RW 187 | 40e,RW 188 | 40f,RW 189 | 410,RW 190 | 411,RW 191 | 412,RW 192 | 413,RW 193 | 414,RW 194 | 415,R 195 | 416,RW 196 | 417,RW 197 | 418,RW 198 | 419,RW 199 | 41a,R 200 | 41b,R 201 | 41c,RW 202 | 41d,RW 203 | 41e,R 204 | 41f,R 205 | 420,RW 206 | 421,RW 207 | 422,R 208 | 423,R 209 | 424,RW 210 | 425,RW 211 | 426,R 212 | 427,R 213 | 480,R 214 | 481,R 215 | 482,R 216 | 483,R 217 | 484,R 218 | 485,R 219 | 486,R 220 | 487,R 221 | 488,R 222 | 489,R 223 | 48a,R 224 | 48b,R 225 | 48c,R 226 | 48d,R 227 | 48e,R 228 | 48f,R 229 | 490,R 230 | 491,R 231 | 4c1,RW 232 | 4c2,RW 233 | 4c3,RW 234 | 4c4,RW 235 | 4e0,R 236 | 4e2,R 237 | 4e3,R 238 | 500,R 239 | 503,RW 240 | 560,RW 241 | 561,RW 242 | 570,RW 243 | 571,RW 244 | 572,RW 245 | 580,RW 246 | 581,RW 247 | 582,RW 248 | 583,RW 249 | 600,RW 250 | 601,RW 251 | 603,RW 252 | 606,R 253 | 607,RW 254 | 608,RW 255 | 609,RW 256 | 60a,RW 257 | 60b,RW 258 | 60c,RW 259 | 60d,R 260 | 610,RW 261 | 611,R 262 | 613,R 263 | 614,R 264 | 615,RW 265 | 618,RW 266 | 619,R 267 | 61b,R 268 | 61d,R 269 | 620,RW 270 | 621,R 271 | 622,RW 272 | 623,R 273 | 630,R 274 | 631,R 275 | 632,R 276 | 633,RW 277 | 634,RW 278 | 635,RW 279 | 636,RW 280 | 637,R 281 | 638,RW 282 | 639,R 283 | 63a,RW 284 | 640,RW 285 | 641,R 286 | 642,RW 287 | 648,R 288 | 649,R 289 | 64a,R 290 | 64b,R 291 | 64c,RW 292 | 64d,R 293 | 64e,R 294 | 64f,RW 295 | 652,RW 296 | 653,R 297 | 655,R 298 | 656,R 299 | 658,R 300 | 659,R 301 | 65a,R 302 | 65b,R 303 | 65c,RW 304 | 680,RW 305 | 681,RW 306 | 682,RW 307 | 683,RW 308 | 684,RW 309 | 685,RW 310 | 686,RW 311 | 687,RW 312 | 688,RW 313 | 689,RW 314 | 68a,RW 315 | 68b,RW 316 | 68c,RW 317 | 68d,RW 318 | 68e,RW 319 | 68f,RW 320 | 690,RW 321 | 691,RW 322 | 692,RW 323 | 693,RW 324 | 694,RW 325 | 695,RW 326 | 696,RW 327 | 697,RW 328 | 698,RW 329 | 699,RW 330 | 69a,RW 331 | 69b,RW 332 | 69c,RW 333 | 69d,RW 334 | 69e,RW 335 | 69f,RW 336 | 6b0,RW 337 | 6b1,RW 338 | 6c0,RW 339 | 6c1,RW 340 | 6c2,RW 341 | 6c3,RW 342 | 6c4,RW 343 | 6c5,RW 344 | 6c6,RW 345 | 6c7,RW 346 | 6c8,RW 347 | 6c9,RW 348 | 6ca,RW 349 | 6cb,RW 350 | 6cc,RW 351 | 6cd,RW 352 | 6ce,RW 353 | 6cf,RW 354 | 6d0,RW 355 | 6d1,RW 356 | 6d2,RW 357 | 6d3,RW 358 | 6d4,RW 359 | 6d5,RW 360 | 6d6,RW 361 | 6d7,RW 362 | 6d8,RW 363 | 6d9,RW 364 | 6da,RW 365 | 6db,RW 366 | 6dc,RW 367 | 6dd,RW 368 | 6de,RW 369 | 6df,RW 370 | 6e0,RW 371 | 700,RW 372 | 701,RW 373 | 702,RW 374 | 703,RW 375 | 704,RW 376 | 705,RW 377 | 706,RW 378 | 707,RW 379 | 708,RW 380 | 709,RW 381 | 710,RW 382 | 711,RW 383 | 712,RW 384 | 713,RW 385 | 714,RW 386 | 715,RW 387 | 716,RW 388 | 717,RW 389 | 718,RW 390 | 719,RW 391 | 720,RW 392 | 721,RW 393 | 722,RW 394 | 723,RW 395 | 724,RW 396 | 725,RW 397 | 726,RW 398 | 727,RW 399 | 728,RW 400 | 729,RW 401 | 730,RW 402 | 731,RW 403 | 732,RW 404 | 733,RW 405 | 734,RW 406 | 735,RW 407 | 736,RW 408 | 737,RW 409 | 738,RW 410 | 739,RW 411 | 740,RW 412 | 741,RW 413 | 742,RW 414 | 743,RW 415 | 744,RW 416 | 745,RW 417 | 746,RW 418 | 747,RW 419 | 748,RW 420 | 749,RW 421 | 770,RW 422 | 773,RW 423 | 83f,W 424 | c80,R 425 | c8f,RW 426 | c90,RW 427 | c91,RW 428 | c92,RW 429 | c93,RW 430 | d90,RW 431 | da0,RW 432 | db0,RW 433 | db1,RW 434 | db2,R 435 | dc0,RW 436 | dc1,RW 437 | dc2,RW 438 | dc3,RW 439 | dc4,RW 440 | dc5,RW 441 | dc6,RW 442 | dc7,RW 443 | dc8,RW 444 | dc9,RW 445 | dca,RW 446 | dcb,RW 447 | dcc,RW 448 | dcd,RW 449 | dce,RW 450 | dcf,RW 451 | dd0,RW 452 | dd1,RW 453 | dd2,RW 454 | dd3,RW 455 | dd4,RW 456 | dd5,RW 457 | dd6,RW 458 | dd7,RW 459 | dd8,RW 460 | dd9,RW 461 | dda,RW 462 | ddb,RW 463 | ddc,RW 464 | ddd,RW 465 | dde,RW 466 | ddf,RW 467 | e01,RW 468 | e02,RW 469 | c0000080,RW 470 | c0000081,RW 471 | c0000082,RW 472 | c0000083,RW 473 | c0000084,RW 474 | c0000100,RW 475 | c0000101,RW 476 | c0000102,RW 477 | c0000103,RW 478 | -------------------------------------------------------------------------------- /msr_scans/intel-core-i7-8700k.csv: -------------------------------------------------------------------------------- 1 | 0,RW 2 | 1,R 3 | 6,RW 4 | 10,RW 5 | 17,R 6 | 1b,RW 7 | 20,R 8 | 21,R 9 | 22,R 10 | 23,R 11 | 2a,R 12 | 2e,RW 13 | 33,RW 14 | 34,R 15 | 35,R 16 | 3a,R 17 | 3b,RW 18 | 3e,RW 19 | 48,RW 20 | 49,W 21 | 59,R 22 | 7a,RW 23 | 80,RW 24 | 8b,RW 25 | 8c,R 26 | 8d,R 27 | 8e,R 28 | 8f,R 29 | 95,RW 30 | 9b,R 31 | c1,RW 32 | c2,RW 33 | c3,RW 34 | c4,RW 35 | ce,R 36 | e2,RW 37 | e4,RW 38 | e7,RW 39 | e8,RW 40 | fe,R 41 | 102,RW 42 | 103,RW 43 | 104,RW 44 | 10b,W 45 | 10f,RW 46 | 110,R 47 | 118,R 48 | 11f,RW 49 | 121,R 50 | 139,W 51 | 13a,R 52 | 13c,R 53 | 13d,RW 54 | 140,RW 55 | 150,RW 56 | 174,RW 57 | 175,RW 58 | 176,RW 59 | 179,R 60 | 17a,RW 61 | 186,RW 62 | 187,RW 63 | 188,RW 64 | 189,RW 65 | 194,RW 66 | 198,R 67 | 199,RW 68 | 19a,RW 69 | 19b,RW 70 | 19c,RW 71 | 19d,R 72 | 1a0,RW 73 | 1a1,R 74 | 1a2,RW 75 | 1a4,RW 76 | 1a6,RW 77 | 1a7,RW 78 | 1a8,RW 79 | 1aa,RW 80 | 1ad,RW 81 | 1b1,RW 82 | 1b2,RW 83 | 1c6,R 84 | 1c8,RW 85 | 1c9,RW 86 | 1d9,RW 87 | 1da,R 88 | 1db,R 89 | 1dc,R 90 | 1dd,RW 91 | 1de,RW 92 | 1e0,RW 93 | 1f0,R 94 | 1f2,R 95 | 1f3,R 96 | 1f4,R 97 | 1f5,R 98 | 1fb,R 99 | 1fc,RW 100 | 200,RW 101 | 201,RW 102 | 202,RW 103 | 203,RW 104 | 204,RW 105 | 205,RW 106 | 206,RW 107 | 207,RW 108 | 208,RW 109 | 209,RW 110 | 20a,RW 111 | 20b,RW 112 | 20c,RW 113 | 20d,RW 114 | 20e,RW 115 | 20f,RW 116 | 210,RW 117 | 211,RW 118 | 212,RW 119 | 213,RW 120 | 250,RW 121 | 258,RW 122 | 259,RW 123 | 268,RW 124 | 269,RW 125 | 26a,RW 126 | 26b,RW 127 | 26c,RW 128 | 26d,RW 129 | 26e,RW 130 | 26f,RW 131 | 277,RW 132 | 280,RW 133 | 281,RW 134 | 282,RW 135 | 283,RW 136 | 284,RW 137 | 285,RW 138 | 286,RW 139 | 287,RW 140 | 288,RW 141 | 289,RW 142 | 28a,RW 143 | 28b,RW 144 | 2e0,R 145 | 2e6,W 146 | 2e7,RW 147 | 2f4,R 148 | 2f5,R 149 | 2ff,RW 150 | 300,W 151 | 301,W 152 | 302,RW 153 | 305,R 154 | 309,RW 155 | 30a,RW 156 | 30b,RW 157 | 345,R 158 | 38d,RW 159 | 38e,R 160 | 38f,RW 161 | 390,RW 162 | 391,RW 163 | 392,R 164 | 393,RW 165 | 394,RW 166 | 395,RW 167 | 396,R 168 | 397,RW 169 | 3b0,RW 170 | 3b1,RW 171 | 3b2,RW 172 | 3b3,RW 173 | 3f1,RW 174 | 3f6,RW 175 | 3f7,RW 176 | 3f8,R 177 | 3f9,R 178 | 3fa,R 179 | 3fc,R 180 | 3fd,R 181 | 3fe,R 182 | 400,RW 183 | 401,R 184 | 402,RW 185 | 403,RW 186 | 404,RW 187 | 405,RW 188 | 406,RW 189 | 407,RW 190 | 408,RW 191 | 409,RW 192 | 40a,RW 193 | 40b,RW 194 | 40c,RW 195 | 40d,RW 196 | 40e,RW 197 | 40f,RW 198 | 410,RW 199 | 411,R 200 | 412,R 201 | 413,R 202 | 414,RW 203 | 415,R 204 | 416,RW 205 | 417,RW 206 | 418,RW 207 | 419,RW 208 | 41a,R 209 | 41b,R 210 | 41c,RW 211 | 41d,RW 212 | 41e,R 213 | 41f,R 214 | 420,RW 215 | 421,RW 216 | 422,R 217 | 423,R 218 | 424,RW 219 | 425,RW 220 | 426,R 221 | 427,R 222 | 428,RW 223 | 429,RW 224 | 42a,R 225 | 42b,R 226 | 42c,RW 227 | 42d,RW 228 | 42e,R 229 | 42f,R 230 | 480,R 231 | 481,R 232 | 482,R 233 | 483,R 234 | 484,R 235 | 485,R 236 | 486,R 237 | 487,R 238 | 488,R 239 | 489,R 240 | 48a,R 241 | 48b,R 242 | 48c,R 243 | 48d,R 244 | 48e,R 245 | 48f,R 246 | 490,R 247 | 491,R 248 | 4c1,RW 249 | 4c2,RW 250 | 4c3,RW 251 | 4c4,RW 252 | 4e0,R 253 | 4e2,R 254 | 4e3,R 255 | 500,R 256 | 503,RW 257 | 560,RW 258 | 561,RW 259 | 570,RW 260 | 571,RW 261 | 572,RW 262 | 580,RW 263 | 581,RW 264 | 582,RW 265 | 583,RW 266 | 600,RW 267 | 601,RW 268 | 603,RW 269 | 606,R 270 | 607,RW 271 | 608,RW 272 | 609,RW 273 | 60a,RW 274 | 60b,RW 275 | 60c,RW 276 | 60d,R 277 | 610,RW 278 | 611,R 279 | 613,R 280 | 614,R 281 | 615,RW 282 | 618,RW 283 | 619,R 284 | 61b,R 285 | 61d,R 286 | 620,RW 287 | 621,R 288 | 622,RW 289 | 623,R 290 | 630,R 291 | 631,R 292 | 632,R 293 | 633,RW 294 | 634,RW 295 | 635,RW 296 | 636,RW 297 | 637,R 298 | 638,RW 299 | 639,R 300 | 63a,RW 301 | 640,RW 302 | 641,R 303 | 642,RW 304 | 648,R 305 | 649,R 306 | 64a,R 307 | 64b,R 308 | 64c,RW 309 | 64d,R 310 | 64e,R 311 | 64f,RW 312 | 652,RW 313 | 653,R 314 | 655,R 315 | 656,R 316 | 658,R 317 | 659,R 318 | 65a,R 319 | 65b,R 320 | 65c,RW 321 | 680,RW 322 | 681,RW 323 | 682,RW 324 | 683,RW 325 | 684,RW 326 | 685,RW 327 | 686,RW 328 | 687,RW 329 | 688,RW 330 | 689,RW 331 | 68a,RW 332 | 68b,RW 333 | 68c,RW 334 | 68d,RW 335 | 68e,RW 336 | 68f,RW 337 | 690,RW 338 | 691,RW 339 | 692,RW 340 | 693,RW 341 | 694,RW 342 | 695,RW 343 | 696,RW 344 | 697,RW 345 | 698,RW 346 | 699,RW 347 | 69a,RW 348 | 69b,RW 349 | 69c,RW 350 | 69d,RW 351 | 69e,RW 352 | 69f,RW 353 | 6b0,RW 354 | 6b1,RW 355 | 6c0,RW 356 | 6c1,RW 357 | 6c2,RW 358 | 6c3,RW 359 | 6c4,RW 360 | 6c5,RW 361 | 6c6,RW 362 | 6c7,RW 363 | 6c8,RW 364 | 6c9,RW 365 | 6ca,RW 366 | 6cb,RW 367 | 6cc,RW 368 | 6cd,RW 369 | 6ce,RW 370 | 6cf,RW 371 | 6d0,RW 372 | 6d1,RW 373 | 6d2,RW 374 | 6d3,RW 375 | 6d4,RW 376 | 6d5,RW 377 | 6d6,RW 378 | 6d7,RW 379 | 6d8,RW 380 | 6d9,RW 381 | 6da,RW 382 | 6db,RW 383 | 6dc,RW 384 | 6dd,RW 385 | 6de,RW 386 | 6df,RW 387 | 6e0,RW 388 | 700,RW 389 | 701,RW 390 | 702,RW 391 | 703,RW 392 | 704,RW 393 | 705,RW 394 | 706,RW 395 | 707,RW 396 | 708,RW 397 | 709,RW 398 | 710,RW 399 | 711,RW 400 | 712,RW 401 | 713,RW 402 | 714,RW 403 | 715,RW 404 | 716,RW 405 | 717,RW 406 | 718,RW 407 | 719,RW 408 | 720,RW 409 | 721,RW 410 | 722,RW 411 | 723,RW 412 | 724,RW 413 | 725,RW 414 | 726,RW 415 | 727,RW 416 | 728,RW 417 | 729,RW 418 | 730,RW 419 | 731,RW 420 | 732,RW 421 | 733,RW 422 | 734,RW 423 | 735,RW 424 | 736,RW 425 | 737,RW 426 | 738,RW 427 | 739,RW 428 | 740,RW 429 | 741,RW 430 | 742,RW 431 | 743,RW 432 | 744,RW 433 | 745,RW 434 | 746,RW 435 | 747,RW 436 | 748,RW 437 | 749,RW 438 | 750,RW 439 | 751,RW 440 | 752,RW 441 | 753,RW 442 | 754,RW 443 | 755,RW 444 | 756,RW 445 | 757,RW 446 | 758,RW 447 | 759,RW 448 | 760,RW 449 | 761,RW 450 | 762,RW 451 | 763,RW 452 | 764,RW 453 | 765,RW 454 | 766,RW 455 | 767,RW 456 | 768,RW 457 | 769,RW 458 | 770,RW 459 | 771,R 460 | 773,RW 461 | 774,RW 462 | 777,RW 463 | 83f,W 464 | c80,R 465 | c8f,RW 466 | c90,RW 467 | c91,RW 468 | c92,RW 469 | c93,RW 470 | d90,RW 471 | da0,RW 472 | db0,RW 473 | db1,RW 474 | db2,R 475 | dc0,RW 476 | dc1,RW 477 | dc2,RW 478 | dc3,RW 479 | dc4,RW 480 | dc5,RW 481 | dc6,RW 482 | dc7,RW 483 | dc8,RW 484 | dc9,RW 485 | dca,RW 486 | dcb,RW 487 | dcc,RW 488 | dcd,RW 489 | dce,RW 490 | dcf,RW 491 | dd0,RW 492 | dd1,RW 493 | dd2,RW 494 | dd3,RW 495 | dd4,RW 496 | dd5,RW 497 | dd6,RW 498 | dd7,RW 499 | dd8,RW 500 | dd9,RW 501 | dda,RW 502 | ddb,RW 503 | ddc,RW 504 | ddd,RW 505 | dde,RW 506 | ddf,RW 507 | e01,RW 508 | e02,RW 509 | c0000080,RW 510 | c0000081,RW 511 | c0000082,RW 512 | c0000083,RW 513 | c0000084,RW 514 | c0000100,RW 515 | c0000101,RW 516 | c0000102,RW 517 | c0000103,RW 518 | -------------------------------------------------------------------------------- /msr_scans/intel-core-i9-9900k.csv: -------------------------------------------------------------------------------- 1 | 0,RW 2 | 1,RW 3 | 6,RW 4 | 10,RW 5 | 17,R 6 | 1b,RW 7 | 20,R 8 | 21,R 9 | 22,R 10 | 23,R 11 | 2a,R 12 | 2e,RW 13 | 33,RW 14 | 34,R 15 | 35,R 16 | 3a,R 17 | 3b,RW 18 | 3e,RW 19 | 48,RW 20 | 49,W 21 | 59,R 22 | 7a,RW 23 | 80,RW 24 | 8b,RW 25 | 8c,RW 26 | 8d,RW 27 | 8e,RW 28 | 8f,RW 29 | 95,RW 30 | 9b,R 31 | c1,RW 32 | c2,RW 33 | c3,RW 34 | c4,RW 35 | ce,R 36 | e2,RW 37 | e4,RW 38 | e7,RW 39 | e8,RW 40 | fe,R 41 | 102,RW 42 | 103,RW 43 | 104,RW 44 | 10a,R 45 | 10b,W 46 | 10f,RW 47 | 110,R 48 | 118,R 49 | 11f,RW 50 | 121,R 51 | 123,RW 52 | 139,W 53 | 13a,R 54 | 13c,R 55 | 13d,RW 56 | 140,RW 57 | 150,RW 58 | 174,RW 59 | 175,RW 60 | 176,RW 61 | 179,R 62 | 17a,RW 63 | 186,RW 64 | 187,RW 65 | 188,RW 66 | 189,RW 67 | 194,RW 68 | 198,R 69 | 199,RW 70 | 19a,RW 71 | 19b,RW 72 | 19c,RW 73 | 19d,R 74 | 1a0,RW 75 | 1a1,R 76 | 1a2,RW 77 | 1a4,RW 78 | 1a6,RW 79 | 1a7,RW 80 | 1a8,RW 81 | 1aa,RW 82 | 1ad,RW 83 | 1b0,RW 84 | 1b1,RW 85 | 1b2,RW 86 | 1c6,R 87 | 1c8,RW 88 | 1c9,RW 89 | 1d9,RW 90 | 1da,R 91 | 1db,R 92 | 1dc,R 93 | 1dd,RW 94 | 1de,RW 95 | 1e0,RW 96 | 1f0,R 97 | 1f2,R 98 | 1f3,R 99 | 1f4,R 100 | 1f5,R 101 | 1fb,R 102 | 1fc,RW 103 | 200,RW 104 | 201,RW 105 | 202,RW 106 | 203,RW 107 | 204,RW 108 | 205,RW 109 | 206,RW 110 | 207,RW 111 | 208,RW 112 | 209,RW 113 | 20a,RW 114 | 20b,RW 115 | 20c,RW 116 | 20d,RW 117 | 20e,RW 118 | 20f,RW 119 | 210,RW 120 | 211,RW 121 | 212,RW 122 | 213,RW 123 | 250,RW 124 | 258,RW 125 | 259,RW 126 | 268,RW 127 | 269,RW 128 | 26a,RW 129 | 26b,RW 130 | 26c,RW 131 | 26d,RW 132 | 26e,RW 133 | 26f,RW 134 | 277,RW 135 | 280,RW 136 | 281,RW 137 | 282,RW 138 | 283,RW 139 | 284,RW 140 | 285,RW 141 | 286,RW 142 | 287,RW 143 | 288,RW 144 | 289,RW 145 | 28a,RW 146 | 28b,RW 147 | 28c,RW 148 | 28d,RW 149 | 2e0,R 150 | 2e6,W 151 | 2e7,RW 152 | 2f4,R 153 | 2f5,R 154 | 2ff,RW 155 | 300,W 156 | 301,W 157 | 302,RW 158 | 305,R 159 | 309,RW 160 | 30a,RW 161 | 30b,RW 162 | 345,R 163 | 38d,RW 164 | 38e,R 165 | 38f,RW 166 | 390,RW 167 | 391,RW 168 | 392,R 169 | 393,RW 170 | 394,RW 171 | 395,RW 172 | 396,R 173 | 397,RW 174 | 3b0,RW 175 | 3b1,RW 176 | 3b2,RW 177 | 3b3,RW 178 | 3f1,RW 179 | 3f6,RW 180 | 3f7,RW 181 | 3f8,R 182 | 3f9,R 183 | 3fa,R 184 | 3fc,R 185 | 3fd,R 186 | 3fe,R 187 | 400,RW 188 | 401,RW 189 | 402,RW 190 | 403,RW 191 | 404,RW 192 | 405,RW 193 | 406,RW 194 | 407,RW 195 | 408,RW 196 | 409,RW 197 | 40a,RW 198 | 40b,RW 199 | 40c,RW 200 | 40d,RW 201 | 40e,RW 202 | 40f,RW 203 | 410,RW 204 | 411,RW 205 | 412,RW 206 | 413,RW 207 | 414,RW 208 | 415,R 209 | 416,RW 210 | 417,RW 211 | 418,RW 212 | 419,RW 213 | 41a,R 214 | 41b,R 215 | 41c,RW 216 | 41d,RW 217 | 41e,R 218 | 41f,R 219 | 420,RW 220 | 421,RW 221 | 422,R 222 | 423,R 223 | 424,RW 224 | 425,RW 225 | 426,R 226 | 427,R 227 | 428,RW 228 | 429,RW 229 | 42a,R 230 | 42b,R 231 | 42c,RW 232 | 42d,RW 233 | 42e,R 234 | 42f,R 235 | 430,RW 236 | 431,RW 237 | 432,R 238 | 433,R 239 | 434,RW 240 | 435,RW 241 | 436,R 242 | 437,R 243 | 480,R 244 | 481,R 245 | 482,R 246 | 483,R 247 | 484,R 248 | 485,R 249 | 486,R 250 | 487,R 251 | 488,R 252 | 489,R 253 | 48a,R 254 | 48b,R 255 | 48c,R 256 | 48d,R 257 | 48e,R 258 | 48f,R 259 | 490,R 260 | 491,R 261 | 4c1,RW 262 | 4c2,RW 263 | 4c3,RW 264 | 4c4,RW 265 | 4e0,R 266 | 4e2,R 267 | 4e3,R 268 | 500,R 269 | 503,RW 270 | 560,RW 271 | 561,RW 272 | 570,RW 273 | 571,RW 274 | 572,RW 275 | 580,RW 276 | 581,RW 277 | 582,RW 278 | 583,RW 279 | 600,RW 280 | 601,RW 281 | 603,RW 282 | 606,R 283 | 607,RW 284 | 608,RW 285 | 609,RW 286 | 60a,RW 287 | 60b,RW 288 | 60c,RW 289 | 60d,R 290 | 610,RW 291 | 611,R 292 | 613,R 293 | 614,R 294 | 615,RW 295 | 618,RW 296 | 619,R 297 | 61b,R 298 | 61d,R 299 | 620,RW 300 | 621,R 301 | 622,RW 302 | 623,R 303 | 630,R 304 | 631,R 305 | 632,R 306 | 633,RW 307 | 634,RW 308 | 635,RW 309 | 636,RW 310 | 637,R 311 | 638,RW 312 | 639,R 313 | 63a,RW 314 | 640,RW 315 | 641,R 316 | 642,RW 317 | 648,R 318 | 649,R 319 | 64a,R 320 | 64b,R 321 | 64c,RW 322 | 64d,R 323 | 64e,R 324 | 64f,RW 325 | 652,RW 326 | 653,R 327 | 655,R 328 | 656,R 329 | 658,R 330 | 659,R 331 | 65a,R 332 | 65b,R 333 | 65c,RW 334 | 680,RW 335 | 681,RW 336 | 682,RW 337 | 683,RW 338 | 684,RW 339 | 685,RW 340 | 686,RW 341 | 687,RW 342 | 688,RW 343 | 689,RW 344 | 68a,RW 345 | 68b,RW 346 | 68c,RW 347 | 68d,RW 348 | 68e,RW 349 | 68f,RW 350 | 690,RW 351 | 691,RW 352 | 692,RW 353 | 693,RW 354 | 694,RW 355 | 695,RW 356 | 696,RW 357 | 697,RW 358 | 698,RW 359 | 699,RW 360 | 69a,RW 361 | 69b,RW 362 | 69c,RW 363 | 69d,RW 364 | 69e,RW 365 | 69f,RW 366 | 6b0,RW 367 | 6b1,RW 368 | 6c0,RW 369 | 6c1,RW 370 | 6c2,RW 371 | 6c3,RW 372 | 6c4,RW 373 | 6c5,RW 374 | 6c6,RW 375 | 6c7,RW 376 | 6c8,RW 377 | 6c9,RW 378 | 6ca,RW 379 | 6cb,RW 380 | 6cc,RW 381 | 6cd,RW 382 | 6ce,RW 383 | 6cf,RW 384 | 6d0,RW 385 | 6d1,RW 386 | 6d2,RW 387 | 6d3,RW 388 | 6d4,RW 389 | 6d5,RW 390 | 6d6,RW 391 | 6d7,RW 392 | 6d8,RW 393 | 6d9,RW 394 | 6da,RW 395 | 6db,RW 396 | 6dc,RW 397 | 6dd,RW 398 | 6de,RW 399 | 6df,RW 400 | 6e0,RW 401 | 700,RW 402 | 701,RW 403 | 702,RW 404 | 703,RW 405 | 704,RW 406 | 705,RW 407 | 706,RW 408 | 707,RW 409 | 708,RW 410 | 709,RW 411 | 710,RW 412 | 711,RW 413 | 712,RW 414 | 713,RW 415 | 714,RW 416 | 715,RW 417 | 716,RW 418 | 717,RW 419 | 718,RW 420 | 719,RW 421 | 720,RW 422 | 721,RW 423 | 722,RW 424 | 723,RW 425 | 724,RW 426 | 725,RW 427 | 726,RW 428 | 727,RW 429 | 728,RW 430 | 729,RW 431 | 730,RW 432 | 731,RW 433 | 732,RW 434 | 733,RW 435 | 734,RW 436 | 735,RW 437 | 736,RW 438 | 737,RW 439 | 738,RW 440 | 739,RW 441 | 740,RW 442 | 741,RW 443 | 742,RW 444 | 743,RW 445 | 744,RW 446 | 745,RW 447 | 746,RW 448 | 747,RW 449 | 748,RW 450 | 749,RW 451 | 750,RW 452 | 751,RW 453 | 752,RW 454 | 753,RW 455 | 754,RW 456 | 755,RW 457 | 756,RW 458 | 757,RW 459 | 758,RW 460 | 759,RW 461 | 760,RW 462 | 761,RW 463 | 762,RW 464 | 763,RW 465 | 764,RW 466 | 765,RW 467 | 766,RW 468 | 767,RW 469 | 768,RW 470 | 769,RW 471 | 770,RW 472 | 773,RW 473 | 83f,W 474 | c80,R 475 | c8f,RW 476 | c90,RW 477 | c91,RW 478 | c92,RW 479 | c93,RW 480 | d90,RW 481 | da0,RW 482 | db0,RW 483 | db1,RW 484 | db2,R 485 | dc0,RW 486 | dc1,RW 487 | dc2,RW 488 | dc3,RW 489 | dc4,RW 490 | dc5,RW 491 | dc6,RW 492 | dc7,RW 493 | dc8,RW 494 | dc9,RW 495 | dca,RW 496 | dcb,RW 497 | dcc,RW 498 | dcd,RW 499 | dce,RW 500 | dcf,RW 501 | dd0,RW 502 | dd1,RW 503 | dd2,RW 504 | dd3,RW 505 | dd4,RW 506 | dd5,RW 507 | dd6,RW 508 | dd7,RW 509 | dd8,RW 510 | dd9,RW 511 | dda,RW 512 | ddb,RW 513 | ddc,RW 514 | ddd,RW 515 | dde,RW 516 | ddf,RW 517 | e01,RW 518 | e02,RW 519 | f70,RW 520 | f71,RW 521 | f72,RW 522 | f73,RW 523 | f74,RW 524 | f75,RW 525 | f76,RW 526 | f77,RW 527 | f78,RW 528 | f79,RW 529 | c0000080,RW 530 | c0000081,RW 531 | c0000082,RW 532 | c0000083,RW 533 | c0000084,RW 534 | c0000100,RW 535 | c0000101,RW 536 | c0000102,RW 537 | c0000103,RW 538 | -------------------------------------------------------------------------------- /msr_scans/intel-xeon-silver-4208.csv: -------------------------------------------------------------------------------- 1 | 0,RW 2 | 1,RW 3 | 6,RW 4 | 10,RW 5 | 17,R 6 | 1b,RW 7 | 20,R 8 | 21,R 9 | 22,R 10 | 23,R 11 | 2a,R 12 | 2e,RW 13 | 31,RW 14 | 33,RW 15 | 34,R 16 | 35,R 17 | 3a,R 18 | 3b,RW 19 | 3e,RW 20 | 48,RW 21 | 49,W 22 | 4e,RW 23 | 4f,R 24 | 53,R 25 | 54,R 26 | 55,R 27 | 56,R 28 | 59,R 29 | 5e,RW 30 | 5f,RW 31 | 61,W 32 | 62,W 33 | 63,RW 34 | 64,RW 35 | 67,R 36 | 69,W 37 | 6b,R 38 | 6d,W 39 | 80,RW 40 | 8b,RW 41 | 9b,R 42 | af,RW 43 | c1,RW 44 | c2,RW 45 | c3,RW 46 | c4,RW 47 | ce,R 48 | e2,RW 49 | e3,RW 50 | e4,RW 51 | e7,RW 52 | e8,RW 53 | fe,R 54 | 102,RW 55 | 108,RW 56 | 10a,R 57 | 10b,W 58 | 110,R 59 | 118,R 60 | 11f,RW 61 | 122,RW 62 | 128,R 63 | 129,R 64 | 12a,R 65 | 13a,R 66 | 13c,R 67 | 13d,RW 68 | 140,RW 69 | 150,RW 70 | 152,R 71 | 153,R 72 | 154,R 73 | 155,R 74 | 156,R 75 | 157,R 76 | 174,RW 77 | 175,RW 78 | 176,RW 79 | 178,RW 80 | 179,R 81 | 17a,RW 82 | 17f,RW 83 | 186,RW 84 | 187,RW 85 | 188,RW 86 | 189,RW 87 | 194,RW 88 | 198,R 89 | 199,RW 90 | 19a,RW 91 | 19b,RW 92 | 19c,RW 93 | 19d,R 94 | 1a0,RW 95 | 1a1,R 96 | 1a2,RW 97 | 1a3,R 98 | 1a4,RW 99 | 1a5,R 100 | 1a6,RW 101 | 1a7,RW 102 | 1a8,RW 103 | 1aa,R 104 | 1ad,RW 105 | 1ae,RW 106 | 1b0,RW 107 | 1b1,RW 108 | 1b2,RW 109 | 1c6,R 110 | 1c8,RW 111 | 1c9,RW 112 | 1d9,RW 113 | 1da,R 114 | 1db,R 115 | 1dc,R 116 | 1dd,RW 117 | 1de,RW 118 | 1e0,RW 119 | 1e1,R 120 | 1e2,RW 121 | 1f0,R 122 | 1f2,R 123 | 1f3,R 124 | 1f6,R 125 | 1f7,R 126 | 1f9,R 127 | 1fb,R 128 | 1fc,RW 129 | 200,RW 130 | 201,RW 131 | 202,RW 132 | 203,RW 133 | 204,RW 134 | 205,RW 135 | 206,RW 136 | 207,RW 137 | 208,RW 138 | 209,RW 139 | 20a,RW 140 | 20b,RW 141 | 20c,RW 142 | 20d,RW 143 | 20e,RW 144 | 20f,RW 145 | 210,RW 146 | 211,RW 147 | 212,RW 148 | 213,RW 149 | 250,RW 150 | 258,RW 151 | 259,RW 152 | 268,RW 153 | 269,RW 154 | 26a,RW 155 | 26b,RW 156 | 26c,RW 157 | 26d,RW 158 | 26e,RW 159 | 26f,RW 160 | 277,RW 161 | 280,RW 162 | 281,RW 163 | 282,RW 164 | 283,RW 165 | 284,RW 166 | 285,RW 167 | 286,RW 168 | 287,RW 169 | 288,RW 170 | 289,RW 171 | 28a,RW 172 | 28b,RW 173 | 28c,RW 174 | 28d,RW 175 | 28e,RW 176 | 28f,RW 177 | 290,RW 178 | 291,RW 179 | 292,RW 180 | 293,RW 181 | 2e0,RW 182 | 2e6,W 183 | 2e7,R 184 | 2ff,RW 185 | 300,R 186 | 302,RW 187 | 305,R 188 | 309,RW 189 | 30a,RW 190 | 30b,RW 191 | 345,R 192 | 38d,RW 193 | 38e,R 194 | 38f,RW 195 | 390,RW 196 | 391,RW 197 | 392,R 198 | 3f1,RW 199 | 3f6,RW 200 | 3f7,RW 201 | 3f8,R 202 | 3f9,R 203 | 3fa,R 204 | 3fc,R 205 | 3fd,R 206 | 3fe,R 207 | 400,RW 208 | 401,RW 209 | 402,RW 210 | 403,RW 211 | 404,RW 212 | 405,RW 213 | 406,RW 214 | 407,RW 215 | 408,RW 216 | 409,RW 217 | 40a,RW 218 | 40b,RW 219 | 40c,RW 220 | 40d,RW 221 | 40e,RW 222 | 40f,RW 223 | 410,RW 224 | 411,RW 225 | 412,RW 226 | 413,RW 227 | 414,RW 228 | 415,RW 229 | 416,RW 230 | 417,RW 231 | 418,RW 232 | 419,RW 233 | 41a,RW 234 | 41b,RW 235 | 41c,RW 236 | 41d,RW 237 | 41e,RW 238 | 41f,R 239 | 420,RW 240 | 421,RW 241 | 422,RW 242 | 423,R 243 | 424,RW 244 | 425,RW 245 | 426,RW 246 | 427,R 247 | 428,RW 248 | 429,RW 249 | 42a,RW 250 | 42b,R 251 | 42c,RW 252 | 42d,RW 253 | 42e,RW 254 | 42f,R 255 | 430,RW 256 | 431,RW 257 | 432,RW 258 | 433,RW 259 | 434,RW 260 | 435,RW 261 | 436,RW 262 | 437,RW 263 | 438,RW 264 | 439,RW 265 | 43a,RW 266 | 43b,RW 267 | 43c,RW 268 | 43d,RW 269 | 43e,RW 270 | 43f,RW 271 | 440,RW 272 | 441,RW 273 | 442,RW 274 | 443,RW 275 | 444,RW 276 | 445,RW 277 | 446,RW 278 | 447,RW 279 | 448,RW 280 | 449,RW 281 | 44a,RW 282 | 44b,RW 283 | 44c,RW 284 | 44d,RW 285 | 44e,RW 286 | 44f,RW 287 | 480,R 288 | 481,R 289 | 482,R 290 | 483,R 291 | 484,R 292 | 485,R 293 | 486,R 294 | 487,R 295 | 488,R 296 | 489,R 297 | 48a,R 298 | 48b,R 299 | 48c,R 300 | 48d,R 301 | 48e,R 302 | 48f,R 303 | 490,R 304 | 491,R 305 | 4c1,RW 306 | 4c2,RW 307 | 4c3,RW 308 | 4c4,RW 309 | 4d0,R 310 | 503,RW 311 | 560,RW 312 | 561,RW 313 | 570,RW 314 | 571,RW 315 | 572,RW 316 | 580,RW 317 | 581,RW 318 | 582,RW 319 | 583,RW 320 | 600,RW 321 | 601,RW 322 | 603,RW 323 | 606,R 324 | 607,RW 325 | 608,RW 326 | 609,RW 327 | 60a,RW 328 | 60b,RW 329 | 60c,RW 330 | 60d,R 331 | 610,RW 332 | 611,R 333 | 613,R 334 | 614,R 335 | 615,R 336 | 618,RW 337 | 619,R 338 | 61b,R 339 | 61c,R 340 | 61d,R 341 | 620,RW 342 | 621,R 343 | 622,RW 344 | 623,R 345 | 637,R 346 | 638,RW 347 | 639,R 348 | 648,R 349 | 649,R 350 | 64a,R 351 | 64b,RW 352 | 64c,RW 353 | 64d,RW 354 | 64e,R 355 | 64f,RW 356 | 680,RW 357 | 681,RW 358 | 682,RW 359 | 683,RW 360 | 684,RW 361 | 685,RW 362 | 686,RW 363 | 687,RW 364 | 688,RW 365 | 689,RW 366 | 68a,RW 367 | 68b,RW 368 | 68c,RW 369 | 68d,RW 370 | 68e,RW 371 | 68f,RW 372 | 690,RW 373 | 691,RW 374 | 692,RW 375 | 693,RW 376 | 694,RW 377 | 695,RW 378 | 696,RW 379 | 697,RW 380 | 698,RW 381 | 699,RW 382 | 69a,RW 383 | 69b,RW 384 | 69c,RW 385 | 69d,RW 386 | 69e,RW 387 | 69f,RW 388 | 6b1,RW 389 | 6c0,RW 390 | 6c1,RW 391 | 6c2,RW 392 | 6c3,RW 393 | 6c4,RW 394 | 6c5,RW 395 | 6c6,RW 396 | 6c7,RW 397 | 6c8,RW 398 | 6c9,RW 399 | 6ca,RW 400 | 6cb,RW 401 | 6cc,RW 402 | 6cd,RW 403 | 6ce,RW 404 | 6cf,RW 405 | 6d0,RW 406 | 6d1,RW 407 | 6d2,RW 408 | 6d3,RW 409 | 6d4,RW 410 | 6d5,RW 411 | 6d6,RW 412 | 6d7,RW 413 | 6d8,RW 414 | 6d9,RW 415 | 6da,RW 416 | 6db,RW 417 | 6dc,RW 418 | 6dd,RW 419 | 6de,RW 420 | 6df,RW 421 | 6e0,RW 422 | 700,RW 423 | 701,RW 424 | 702,R 425 | 703,RW 426 | 704,RW 427 | 705,RW 428 | 706,RW 429 | 707,RW 430 | 708,RW 431 | 709,RW 432 | 70a,RW 433 | 70b,RW 434 | 70c,RW 435 | 70d,RW 436 | 710,RW 437 | 711,RW 438 | 712,RW 439 | 713,RW 440 | 714,RW 441 | 715,RW 442 | 716,RW 443 | 717,RW 444 | 718,RW 445 | 719,RW 446 | 71a,RW 447 | 71b,RW 448 | 71c,RW 449 | 71d,R 450 | 770,RW 451 | 773,RW 452 | 790,R 453 | 793,RW 454 | 802,R 455 | 803,R 456 | 808,RW 457 | 80a,R 458 | 80b,W 459 | 80d,R 460 | 80f,RW 461 | 810,R 462 | 811,R 463 | 812,R 464 | 813,R 465 | 814,R 466 | 815,R 467 | 816,R 468 | 817,R 469 | 818,R 470 | 819,R 471 | 81a,R 472 | 81b,R 473 | 81c,R 474 | 81d,R 475 | 81e,R 476 | 81f,R 477 | 820,R 478 | 821,R 479 | 822,R 480 | 823,R 481 | 824,R 482 | 825,R 483 | 826,R 484 | 827,R 485 | 828,RW 486 | 82f,RW 487 | 830,RW 488 | 832,RW 489 | 833,RW 490 | 834,RW 491 | 835,RW 492 | 836,RW 493 | 837,RW 494 | 838,RW 495 | 839,R 496 | 83e,RW 497 | 83f,W 498 | 972,W 499 | a00,RW 500 | a01,RW 501 | a02,RW 502 | a40,RW 503 | a41,RW 504 | a42,RW 505 | a43,RW 506 | a44,RW 507 | a45,RW 508 | a47,RW 509 | a48,RW 510 | a49,RW 511 | a4a,RW 512 | a4b,RW 513 | a4c,RW 514 | a4d,RW 515 | a4e,RW 516 | a4f,RW 517 | a50,RW 518 | a51,RW 519 | a52,RW 520 | a53,RW 521 | a58,RW 522 | a59,RW 523 | a5a,RW 524 | a5b,RW 525 | a5c,RW 526 | a5f,RW 527 | a60,RW 528 | a61,RW 529 | a62,RW 530 | a63,RW 531 | a64,RW 532 | a65,RW 533 | a67,RW 534 | a68,RW 535 | a69,RW 536 | a6a,RW 537 | a6b,RW 538 | a6c,RW 539 | a6d,RW 540 | a6e,RW 541 | a6f,RW 542 | a70,RW 543 | a71,RW 544 | a72,RW 545 | a73,RW 546 | a78,RW 547 | a79,RW 548 | a7a,RW 549 | a7b,RW 550 | a7c,RW 551 | a7f,RW 552 | a80,RW 553 | a81,RW 554 | a82,RW 555 | a83,RW 556 | a84,RW 557 | a85,RW 558 | a87,RW 559 | a88,RW 560 | a89,RW 561 | a8a,RW 562 | a8b,RW 563 | a8c,RW 564 | a8d,RW 565 | a8e,RW 566 | a8f,RW 567 | a90,RW 568 | a91,RW 569 | a92,RW 570 | a93,RW 571 | a98,RW 572 | a99,RW 573 | a9a,RW 574 | a9b,RW 575 | a9c,RW 576 | a9f,RW 577 | aa0,RW 578 | aa1,RW 579 | aa2,RW 580 | aa3,RW 581 | aa4,RW 582 | aa5,RW 583 | aa7,RW 584 | aa8,RW 585 | aa9,RW 586 | aaa,RW 587 | aab,RW 588 | aac,RW 589 | aad,RW 590 | aae,RW 591 | aaf,RW 592 | ab0,RW 593 | ab1,RW 594 | ab2,RW 595 | ab3,RW 596 | ab8,RW 597 | ab9,RW 598 | aba,RW 599 | abb,RW 600 | abc,RW 601 | abf,RW 602 | ac0,RW 603 | ac1,RW 604 | ac2,RW 605 | ac3,RW 606 | ac4,RW 607 | ac5,RW 608 | ac7,RW 609 | ac8,RW 610 | ac9,RW 611 | aca,RW 612 | acb,RW 613 | acc,RW 614 | acd,RW 615 | ace,RW 616 | acf,RW 617 | ad0,RW 618 | ad1,RW 619 | ad2,RW 620 | ad3,RW 621 | ad8,RW 622 | ad9,RW 623 | ada,RW 624 | adb,RW 625 | adc,RW 626 | adf,RW 627 | ae0,RW 628 | ae1,RW 629 | ae2,RW 630 | ae3,RW 631 | ae4,RW 632 | ae5,RW 633 | ae7,RW 634 | ae8,RW 635 | ae9,RW 636 | aea,RW 637 | aeb,RW 638 | aec,RW 639 | aed,RW 640 | aee,RW 641 | aef,RW 642 | af0,RW 643 | af1,RW 644 | af2,RW 645 | af3,RW 646 | af8,RW 647 | af9,RW 648 | afa,RW 649 | afb,RW 650 | afc,RW 651 | aff,RW 652 | b00,RW 653 | b01,RW 654 | b02,RW 655 | b03,RW 656 | b04,RW 657 | b05,RW 658 | b06,RW 659 | b07,RW 660 | b08,RW 661 | b09,RW 662 | b0a,RW 663 | b0b,RW 664 | b0c,RW 665 | b0d,RW 666 | b0e,RW 667 | b0f,RW 668 | b10,RW 669 | b11,RW 670 | b12,RW 671 | b13,RW 672 | b14,RW 673 | b15,RW 674 | b16,RW 675 | b17,RW 676 | b18,RW 677 | b19,RW 678 | b1a,RW 679 | b1b,RW 680 | b1c,RW 681 | b1d,RW 682 | b1e,RW 683 | b1f,RW 684 | b20,RW 685 | b21,RW 686 | b22,RW 687 | b23,RW 688 | b24,RW 689 | b25,RW 690 | b26,RW 691 | b27,RW 692 | b28,RW 693 | b29,RW 694 | b2a,RW 695 | b2b,RW 696 | b2c,RW 697 | b2d,RW 698 | b2e,RW 699 | b2f,RW 700 | b30,RW 701 | b31,RW 702 | b32,RW 703 | b33,RW 704 | b34,RW 705 | b35,RW 706 | b36,RW 707 | b37,RW 708 | b38,RW 709 | b39,RW 710 | b3a,RW 711 | b3b,RW 712 | b3c,RW 713 | b3d,RW 714 | b3e,RW 715 | b3f,RW 716 | b40,RW 717 | b41,RW 718 | b42,RW 719 | b43,RW 720 | b44,RW 721 | b45,RW 722 | b46,RW 723 | b47,RW 724 | b48,RW 725 | b49,RW 726 | b4a,RW 727 | b4b,RW 728 | b4c,RW 729 | b4d,RW 730 | b4e,RW 731 | b4f,RW 732 | b50,RW 733 | b51,RW 734 | b52,RW 735 | b53,RW 736 | b54,RW 737 | b55,RW 738 | b56,RW 739 | b57,RW 740 | b58,RW 741 | b59,RW 742 | b5a,RW 743 | b5b,RW 744 | b5c,RW 745 | b5d,RW 746 | b5e,RW 747 | b5f,RW 748 | c80,R 749 | c81,RW 750 | c8b,RW 751 | c8c,R 752 | c8d,RW 753 | c8e,R 754 | c8f,RW 755 | c90,RW 756 | c91,RW 757 | c92,RW 758 | c93,RW 759 | c94,RW 760 | c95,RW 761 | c96,RW 762 | c97,RW 763 | c98,RW 764 | c99,RW 765 | c9a,RW 766 | c9b,RW 767 | c9c,RW 768 | c9d,RW 769 | c9e,RW 770 | c9f,RW 771 | d50,RW 772 | d51,RW 773 | d52,RW 774 | d53,RW 775 | d54,RW 776 | d55,RW 777 | d56,RW 778 | d57,RW 779 | d90,RW 780 | da0,RW 781 | dc0,RW 782 | dc1,RW 783 | dc2,RW 784 | dc3,RW 785 | dc4,RW 786 | dc5,RW 787 | dc6,RW 788 | dc7,RW 789 | dc8,RW 790 | dc9,RW 791 | dca,RW 792 | dcb,RW 793 | dcc,RW 794 | dcd,RW 795 | dce,RW 796 | dcf,RW 797 | dd0,RW 798 | dd1,RW 799 | dd2,RW 800 | dd3,RW 801 | dd4,RW 802 | dd5,RW 803 | dd6,RW 804 | dd7,RW 805 | dd8,RW 806 | dd9,RW 807 | dda,RW 808 | ddb,RW 809 | ddc,RW 810 | ddd,RW 811 | dde,RW 812 | ddf,RW 813 | e00,RW 814 | e01,RW 815 | e02,RW 816 | e03,RW 817 | e04,RW 818 | e05,RW 819 | e06,RW 820 | e07,RW 821 | e08,RW 822 | e09,RW 823 | e0a,RW 824 | e0b,RW 825 | e10,RW 826 | e11,RW 827 | e12,RW 828 | e13,RW 829 | e14,RW 830 | e15,RW 831 | e16,RW 832 | e17,RW 833 | e18,RW 834 | e19,RW 835 | e1a,RW 836 | e1b,RW 837 | e20,RW 838 | e21,RW 839 | e22,RW 840 | e23,RW 841 | e24,RW 842 | e25,RW 843 | e26,RW 844 | e27,RW 845 | e28,RW 846 | e29,RW 847 | e2a,RW 848 | e2b,RW 849 | e30,RW 850 | e31,RW 851 | e32,RW 852 | e33,RW 853 | e34,RW 854 | e35,RW 855 | e36,RW 856 | e37,RW 857 | e38,RW 858 | e39,RW 859 | e3a,RW 860 | e3b,RW 861 | e40,RW 862 | e41,RW 863 | e42,RW 864 | e43,RW 865 | e44,RW 866 | e45,RW 867 | e46,RW 868 | e47,RW 869 | e48,RW 870 | e49,RW 871 | e4a,RW 872 | e4b,RW 873 | e50,RW 874 | e51,RW 875 | e52,RW 876 | e53,RW 877 | e54,RW 878 | e55,RW 879 | e56,RW 880 | e57,RW 881 | e58,RW 882 | e59,RW 883 | e5a,RW 884 | e5b,RW 885 | e60,RW 886 | e61,RW 887 | e62,RW 888 | e63,RW 889 | e64,RW 890 | e65,RW 891 | e66,RW 892 | e67,RW 893 | e68,RW 894 | e69,RW 895 | e6a,RW 896 | e6b,RW 897 | e70,RW 898 | e71,RW 899 | e72,RW 900 | e73,RW 901 | e74,RW 902 | e75,RW 903 | e76,RW 904 | e77,RW 905 | e78,RW 906 | e79,RW 907 | e7a,RW 908 | e7b,RW 909 | e80,RW 910 | e81,RW 911 | e82,RW 912 | e83,RW 913 | e84,RW 914 | e85,RW 915 | e86,RW 916 | e87,RW 917 | e88,RW 918 | e89,RW 919 | e8a,RW 920 | e8b,RW 921 | e90,RW 922 | e91,RW 923 | e92,RW 924 | e93,RW 925 | e94,RW 926 | e95,RW 927 | e96,RW 928 | e97,RW 929 | e98,RW 930 | e99,RW 931 | e9a,RW 932 | e9b,RW 933 | ea0,RW 934 | ea1,RW 935 | ea2,RW 936 | ea3,RW 937 | ea4,RW 938 | ea5,RW 939 | ea6,RW 940 | ea7,RW 941 | ea8,RW 942 | ea9,RW 943 | eaa,RW 944 | eab,RW 945 | eb0,RW 946 | eb1,RW 947 | eb2,RW 948 | eb3,RW 949 | eb4,RW 950 | eb5,RW 951 | eb6,RW 952 | eb7,RW 953 | eb8,RW 954 | eb9,RW 955 | eba,RW 956 | ebb,RW 957 | ec0,RW 958 | ec1,RW 959 | ec2,RW 960 | ec3,RW 961 | ec4,RW 962 | ec5,RW 963 | ec6,RW 964 | ec7,RW 965 | ec8,RW 966 | ec9,RW 967 | eca,RW 968 | ecb,RW 969 | ed0,RW 970 | ed1,RW 971 | ed2,RW 972 | ed3,RW 973 | ed4,RW 974 | ed5,RW 975 | ed6,RW 976 | ed7,RW 977 | ed8,RW 978 | ed9,RW 979 | eda,RW 980 | edb,RW 981 | ee0,RW 982 | ee1,RW 983 | ee2,RW 984 | ee3,RW 985 | ee4,RW 986 | ee5,RW 987 | ee6,RW 988 | ee7,RW 989 | ee8,RW 990 | ee9,RW 991 | eea,RW 992 | eeb,RW 993 | ef0,RW 994 | ef1,RW 995 | ef2,RW 996 | ef3,RW 997 | ef4,RW 998 | ef5,RW 999 | ef6,RW 1000 | ef7,RW 1001 | ef8,RW 1002 | ef9,RW 1003 | efa,RW 1004 | efb,RW 1005 | f00,RW 1006 | f01,RW 1007 | f02,RW 1008 | f03,RW 1009 | f04,RW 1010 | f05,RW 1011 | f06,RW 1012 | f07,RW 1013 | f08,RW 1014 | f09,RW 1015 | f0a,RW 1016 | f0b,RW 1017 | f10,RW 1018 | f11,RW 1019 | f12,RW 1020 | f13,RW 1021 | f14,RW 1022 | f15,RW 1023 | f16,RW 1024 | f17,RW 1025 | f18,RW 1026 | f19,RW 1027 | f1a,RW 1028 | f1b,RW 1029 | f20,RW 1030 | f21,RW 1031 | f22,RW 1032 | f23,RW 1033 | f24,RW 1034 | f25,RW 1035 | f26,RW 1036 | f27,RW 1037 | f28,RW 1038 | f29,RW 1039 | f2a,RW 1040 | f2b,RW 1041 | f30,RW 1042 | f31,RW 1043 | f32,RW 1044 | f33,RW 1045 | f34,RW 1046 | f35,RW 1047 | f36,RW 1048 | f37,RW 1049 | f38,RW 1050 | f39,RW 1051 | f3a,RW 1052 | f3b,RW 1053 | f40,RW 1054 | f41,RW 1055 | f42,RW 1056 | f43,RW 1057 | f44,RW 1058 | f45,RW 1059 | f46,RW 1060 | f47,RW 1061 | f48,RW 1062 | f49,RW 1063 | f4a,RW 1064 | f4b,RW 1065 | f50,RW 1066 | f51,RW 1067 | f52,RW 1068 | f53,RW 1069 | f54,RW 1070 | f55,RW 1071 | f56,RW 1072 | f57,RW 1073 | f58,RW 1074 | f59,RW 1075 | f5a,RW 1076 | f5b,RW 1077 | f60,RW 1078 | f61,RW 1079 | f62,RW 1080 | f63,RW 1081 | f64,RW 1082 | f65,RW 1083 | f66,RW 1084 | f67,RW 1085 | f68,RW 1086 | f69,RW 1087 | f6a,RW 1088 | f6b,RW 1089 | f70,RW 1090 | f71,RW 1091 | f72,RW 1092 | f73,RW 1093 | f74,RW 1094 | f75,RW 1095 | f76,RW 1096 | f77,RW 1097 | f78,RW 1098 | f79,RW 1099 | f7a,RW 1100 | f7b,RW 1101 | c0000080,RW 1102 | c0000081,RW 1103 | c0000082,RW 1104 | c0000083,RW 1105 | c0000084,RW 1106 | c0000100,RW 1107 | c0000101,RW 1108 | c0000102,RW 1109 | c0000103,RW 1110 | -------------------------------------------------------------------------------- /scripts/sampling/README.md: -------------------------------------------------------------------------------- 1 | # Create msr list from here 2 | 3 | ``` 4 | ../../toolset/build/bin/msrs_ls > msr_list 5 | ``` 6 | 7 | ``` 8 | ./sample_all.sh ../../toolset/build/bin/msrs_sample 5 msr_list 9 | ``` 10 | -------------------------------------------------------------------------------- /scripts/sampling/msrs_analyze.py: -------------------------------------------------------------------------------- 1 | import argparse 2 | import matplotlib as mpl 3 | import numpy as np 4 | import scipy.stats 5 | import multiprocessing as mp 6 | 7 | mpl.use("Agg") 8 | import matplotlib.pyplot as plt 9 | 10 | 11 | def setup_arg_parse(): 12 | parser = argparse.ArgumentParser() 13 | parser.add_argument("sample_file", type=str, 14 | help='The path to an MSR sample_file') 15 | parser.add_argument("-a", "--action", type=str, default="plot", help="one of: plot, corr, changes, first") 16 | parser.add_argument("-m", "--msr", type=str, 17 | help="Specifies the hex address of the MSR for corr. E.g.: --msr=1a2b3c") 18 | parser.add_argument("--msrs", type=str, default="all", 19 | help="Specifies the hex address of the MSRs to use the data from. Specify all for, well, all " 20 | "MSRs. Examples: '--msrs=1a2b3c' '--msrs=1a2b3c,1a2b3d' '--msrs=all'") 21 | parser.add_argument("-s", "--similarity-threshold", type=float, default=0.75, 22 | help="Specifies the minimal similarity needed to generate a plot") 23 | parser.add_argument("-c", "--cpus", type=str, default="all", 24 | help="Specifies the CPU(s) to use the data from. CPU ids or \"all\" for, well, all CPUs. " 25 | "Examples: '-c 1' '-c all' -c '5,7,9'") 26 | parser.add_argument("--cpu-name", type=str, default="N/A", help="Specifies the name of the CPU.") 27 | return parser 28 | 29 | 30 | def parse_data_line(line): 31 | res = [] 32 | msr_parts = line.split(";") 33 | for msr_part in msr_parts: 34 | res.append([int(v, 16) for v in msr_part.split(",")]) 35 | return res 36 | 37 | 38 | def load_msr_sample_file(path): 39 | # returns: a dict msrs containing a dict cpu -> list of values 40 | with open(path, "r") as f: 41 | lines = f.readlines() 42 | lines = list(filter(lambda l: len(l) > 0 and l[0] != '#', [l.strip() for l in lines])) 43 | 44 | cpus = [int(l.strip(), 16) for l in lines[0].split(",")] 45 | msrs = [int(l.strip(), 16) for l in lines[1].split(",")] 46 | time = int(lines[2], 16) 47 | 48 | res = {} 49 | for msr in msrs: 50 | res[msr] = {} 51 | for cpu in cpus: 52 | res[msr][cpu] = [] 53 | 54 | for line in lines[3:]: 55 | parsed_line = parse_data_line(line) 56 | for msr_idx, msr in enumerate(msrs): 57 | for cpu_idx, cpu in enumerate(cpus): 58 | res[msr][cpu].append(parsed_line[msr_idx][cpu_idx]) 59 | 60 | return time, res 61 | 62 | 63 | def format_msr(msr): 64 | return hex(msr)[2:].rjust(8, '0') 65 | 66 | 67 | def format_value(val): 68 | val = hex(val)[2:].rjust(16, '0') 69 | return "{}{}{}{}".format(val[:4], val[4:8], val[8:12], val[12:]) 70 | 71 | 72 | def print_values(values): 73 | for k, v in values.items(): 74 | print("{} : {}".format(format_msr(k), format_value(v))) 75 | 76 | 77 | def plot_heatmap(cpu, msr, values): 78 | # Heatmap of changed bits 79 | bits = [0] * 64 80 | old = bin(values[0])[2:].rjust(64, "0")[::-1] 81 | # for value in [bin(x)[2:].rjust(64, "0")[::-1] for x in values[1:]]: 82 | for value in [bin(x)[2:].rjust(64, "0")[::-1] for x in values]: 83 | for i, b in enumerate(value): 84 | if b != old[i]: 85 | bits[i] = bits[i] + 1 86 | 87 | t = [i for i in range(7, -1, -1)] 88 | 89 | fig, ax = plt.subplots() 90 | fig.set_size_inches(8.5, 8.5, forward=True) 91 | 92 | bit_mat = np.reshape(bits, (8, 8)) 93 | 94 | im = ax.imshow(bit_mat, cmap="Greens") 95 | ax.set_yticks([]) 96 | ax.set_xlim(-.5, 7.5) 97 | ax.set_ylim(-.5, 7.5) 98 | ax.set_xticks(t) 99 | ax.set_yticks(t) 100 | 101 | plt.title("Bitflips of the MSR {} on CPU {}".format(format_msr(msr), cpu)) 102 | ax.set_ylabel("Byte") 103 | ax.set_xlabel("Bit") 104 | 105 | for x in range(8): 106 | for y in range(8): 107 | ax.text(x, y, bit_mat[y][x], ha="center", va="center", color="black") 108 | 109 | fig.tight_layout() 110 | plt.gca().invert_xaxis() 111 | # plt.gca().invert_yaxis() 112 | 113 | cbar = ax.figure.colorbar(im, ax=ax) 114 | cbar.ax.set_ylabel("Flips", rotation=-90, va="bottom") 115 | 116 | plt.savefig("{}_{}_hotbits.png".format(format_msr(msr), cpu)) 117 | plt.close() 118 | 119 | 120 | def plot_values(cpu, msr, values, scan_time): 121 | plt.title("MSR {} Values on CPU {}".format(format_msr(msr), cpu)) 122 | plt.ylabel("Value") 123 | plt.xlabel("Second") 124 | 125 | plt.plot(np.linspace(0, scan_time, len(values)), values) 126 | 127 | plt.savefig("{}_{}_values.png".format(format_msr(msr), cpu)) 128 | plt.close() 129 | 130 | 131 | def calc_changes(values): 132 | changes = [] 133 | old = values[0] 134 | for v in values[1:]: 135 | changes.append(v - old) 136 | old = v 137 | return changes 138 | 139 | 140 | def calc_msr_changes(msr, values_per_cpu): 141 | for cpu, values in values_per_cpu.items(): 142 | first_value = values[0] 143 | for value in values[1:]: 144 | if value != first_value: 145 | print("{:x}".format(msr)) 146 | return 147 | 148 | 149 | def plot_changes(cpu, msr, values, scan_time): 150 | plt.title("MSR {} Value Changes on CPU {}".format(format_msr(msr), cpu)) 151 | plt.ylabel("Value Change") 152 | plt.xlabel("Second") 153 | 154 | changes = calc_changes(values) 155 | 156 | plt.plot(np.linspace(0, scan_time, len(changes)), changes) 157 | 158 | plt.savefig("{}_{}_changes.png".format(format_msr(msr), cpu)) 159 | plt.close() 160 | 161 | 162 | def plot_rchanges(cpu, msr, values, scan_time): 163 | plt.title("MSR {} Reverse Value Changes on CPU {}".format(format_msr(msr), cpu)) 164 | plt.ylabel("Value Change") 165 | plt.xlabel("Second") 166 | 167 | changes = np.array(calc_changes(values)) * -1 168 | 169 | plt.plot(np.linspace(0, scan_time, len(changes)), changes) 170 | 171 | plt.savefig("{}_{}_rchanges.png".format(format_msr(msr), cpu)) 172 | plt.close() 173 | 174 | 175 | def plot_all_cpus(msr, cpu_values, scan_time): 176 | plt.title("MSR {} on all available CPUs".format(format_msr(msr))) 177 | plt.ylabel("Value") 178 | plt.xlabel("Second") 179 | for cpu, values in cpu_values.items(): 180 | plt.plot(np.linspace(0, scan_time, len(values), values), values) 181 | plt.savefig("combined_plot_{}.png".format(format_msr(msr))) 182 | plt.close() 183 | 184 | 185 | def do_plt(scan_time, cpu_values_per_msr, _): 186 | msr_addrs = set() 187 | plot_args = [] 188 | 189 | for msr, values in cpu_values_per_msr.items(): 190 | for cpu, vs in values.items(): 191 | if np.sum(vs) == 0: 192 | continue 193 | msr_addrs.add(msr) 194 | changed = False 195 | old = vs[0] 196 | for v in vs[1:]: 197 | if v != old: 198 | changed = True 199 | break 200 | old = v 201 | 202 | if changed: 203 | print("MSR {} has changes on CPU {}!".format(format_msr(msr), cpu)) 204 | plot_args.append((cpu, msr, vs, scan_time)) 205 | 206 | with mp.Pool(mp.cpu_count()) as p: 207 | p.starmap(plot_values, plot_args) 208 | p.starmap(plot_changes, plot_args) 209 | p.starmap(plot_rchanges, plot_args) 210 | p.starmap(plot_heatmap, [(cpu, msr, vs) for cpu, msr, vs, scan_time in plot_args]) 211 | p.starmap(plot_all_cpus, [(msr, cpu_values, scan_time) for msr, cpu_values in cpu_values_per_msr.items()]) 212 | 213 | 214 | def plot_correlation(values_a, values_b, cpu_a, cpu_b, msr_a, msr_b, scan_time, similarity_threshold, mode="unchanged"): 215 | x = np.linspace(0, scan_time, len(values_a)) 216 | 217 | psim = np.nan 218 | ssim = np.nan 219 | 220 | v_a = np.asarray(values_a) 221 | v_b = np.asarray(values_b) 222 | 223 | # see https://github.com/scipy/scipy/blob/master/scipy/stats/stats.py for more information 224 | if np.linalg.norm(values_a - np.mean(values_a)) >= 1e-13 * np.abs(np.mean(values_a)) and np.linalg.norm( 225 | values_b - np.mean(values_b)) >= 1e-13 * np.abs(np.mean(values_b)) and \ 226 | np.any(v_a != v_a[0]) and \ 227 | np.any(v_b != v_b[0]): 228 | psim = scipy.stats.pearsonr(values_a, values_b)[0] 229 | ssim = scipy.stats.spearmanr(values_a, values_b)[0] 230 | 231 | res = (psim, ssim, msr_a, cpu_a, msr_b, cpu_b, mode) 232 | if (np.abs(psim) < similarity_threshold and np.abs(ssim) < similarity_threshold) or ( 233 | np.isnan(psim) and np.isnan(ssim)): 234 | return res 235 | 236 | fig = plt.figure() 237 | fig.set_size_inches(12, 8, forward=True) 238 | fig.suptitle( 239 | "Comparison of {} on CPU {} and {} on CPU {}\n Mode: {}".format(format_msr(msr_a), cpu_a, format_msr(msr_b), 240 | cpu_b, mode), fontsize=15) 241 | 242 | grid = plt.GridSpec(3, 2, height_ratios=[3, 1, 1], figure=fig) 243 | ax11 = plt.subplot(grid[0, 0]) 244 | ax12 = plt.subplot(grid[0, 1]) 245 | ax2 = plt.subplot(grid[1, 0:]) 246 | ax3 = plt.subplot(grid[2, 0:]) 247 | 248 | ax11.plot(x, values_a) 249 | ax12.plot(x, values_b) 250 | 251 | ax11.set_title("{}".format(format_msr(msr_a))) 252 | ax12.set_title("{}".format(format_msr(msr_b))) 253 | 254 | ax2.set_title("Pearson Correlation Coefficient") 255 | ax2.barh(0, psim) 256 | if psim < 0: 257 | ax2.set_xlim(0, -1) 258 | else: 259 | ax2.set_xlim(0, 1) 260 | ax2.set_ylim(-.5, .5) 261 | ax2.set_yticks([]) 262 | ax2.text(.5, .5, "{}".format(psim), horizontalalignment="center", verticalalignment="center", 263 | transform=ax2.transAxes) 264 | 265 | ax3.set_title("Spearman Correlation Coefficient") 266 | ax3.barh(0, ssim) 267 | if ssim < 0: 268 | ax3.set_xlim(0, -1) 269 | else: 270 | ax3.set_xlim(0, 1) 271 | ax3.set_ylim(-.5, .5) 272 | ax3.set_yticks([]) 273 | ax3.text(.5, .5, "{}".format(ssim), horizontalalignment="center", verticalalignment="center", 274 | transform=ax3.transAxes) 275 | 276 | grid.tight_layout(fig, rect=[0, 0.03, 1, .95]) 277 | fig.savefig("corr_{}_{}_{}_{}_{}.png".format(format_msr(msr_a), cpu_a, format_msr(msr_b), cpu_b, mode)) 278 | # plt.show() 279 | plt.close() 280 | return res 281 | 282 | 283 | def do_corr(scan_time, cpu_values_per_msr, args): 284 | if "msr" not in args: 285 | print("You need to specify an MSR with -m when performing corr!") 286 | exit(1) 287 | 288 | ref_msr = int(args["msr"], 16) 289 | 290 | if ref_msr not in list(cpu_values_per_msr.keys()): 291 | print("The MSR specified with -m is not in the dataset!") 292 | exit(1) 293 | 294 | similarity_threshold = args["similarity_threshold"] 295 | 296 | cpu = list(cpu_values_per_msr[list(cpu_values_per_msr.keys())[0]].keys())[0] 297 | 298 | calc_args = [] 299 | for msr, values_per_cpu in cpu_values_per_msr.items(): 300 | if msr == ref_msr: 301 | continue 302 | calc_args.append((cpu_values_per_msr[ref_msr][cpu], values_per_cpu[cpu], cpu, cpu, ref_msr, msr, scan_time, 303 | similarity_threshold)) 304 | changes = calc_changes(values_per_cpu[cpu]) 305 | calc_args.append((cpu_values_per_msr[ref_msr][cpu][:-1], changes, cpu, cpu, ref_msr, msr, scan_time, 306 | similarity_threshold, "changes")) 307 | 308 | with mp.Pool(mp.cpu_count()) as p: 309 | results = p.starmap(plot_correlation, calc_args) 310 | 311 | for psim, ssim, msr_a, cpu_a, msr_b, cpu_b, mode in sorted(results, key=lambda vals: np.abs(vals[0]))[::-1]: 312 | if not np.isnan(psim) or not np.isnan(ssim): 313 | print("Similarity of {} on {} and {} on {} is {} (pearson), {} (spearman) with mode {}".format(hex(msr_a), 314 | cpu_a, 315 | hex(msr_b), 316 | cpu_b, 317 | psim, ssim, 318 | mode)) 319 | 320 | 321 | def plot_non_zero_histogram(cpu, values): 322 | plt.title("Histogram of Static Non-Zero MSR Values on CPU {}".format(cpu)) 323 | plt.hist([x for x in values if x != 0], bins=128) 324 | plt.savefig("static_nz_hist_cpu_{}.jpg".format(cpu)) 325 | plt.close() 326 | 327 | 328 | def print_separation(): 329 | # print("--------------------------------------------------") 330 | print() 331 | 332 | 333 | def print_zero_to_non_zero_latex_tabular(zero_non_zero_per_cpu, cpu_name): 334 | cpus = list(zero_non_zero_per_cpu.keys()) 335 | cpus.sort() 336 | 337 | print_separation() 338 | print(R"""\begin{table}[H] 339 | \caption{Static MSRs with Value Zero Compared to Static MSRs with a Non-Zero Value on the """ + "{}".format( 340 | cpu_name) + R""".} 341 | \centering 342 | \label{tb:znz_""" + "{}".format(cpu_name.replace(" ", "_")) + R"""} 343 | \begin{tabular}{| l | c | c |} 344 | \hline 345 | \multicolumn{1}{|c|}{\textbf{CPU}} & \multicolumn{1}{p{3cm}|}{\centering \textbf{Number of} \\ \textbf{Zero MSRs}} & \multicolumn{1}{p{3cm}|}{\centering \textbf{Number of} \\ \textbf{Non-Zero MSRs}}\\ 346 | \hline 347 | """) 348 | 349 | for cpu in cpus: 350 | znz = zero_non_zero_per_cpu[cpu] 351 | print(R"{} & {} & {} (${:0.3f}\%$)\\\hline".format(cpu, znz["zero"], znz["non_zero"], znz["non_zero_pct"])) 352 | 353 | print(R"""\end{tabular}\end{table}""") 354 | print_separation() 355 | 356 | 357 | def print_statistical_markers_non_zero_latex_tabular(msr_values_per_cpu, cpu_name): 358 | cpus = list(msr_values_per_cpu.keys()) 359 | cpus.sort() 360 | 361 | print_separation() 362 | print(R"""\begin{table}[H] 363 | \caption{Statistical Parameters of Static Non-Zero MSRs on the """ + "{}".format(cpu_name) + R""".} 364 | \centering 365 | \label{tb:sp_""" + "{}".format(cpu_name.replace(" ", "_")) + R"""} 366 | \begin{tabular}{| l | c | c | c | c |} 367 | \hline 368 | \textbf{CPU} & \textbf{Minimum} & \textbf{Maximum} & \textbf{Median} & \textbf{Modus}\\ 369 | \hline 370 | """) 371 | 372 | for cpu in cpus: 373 | msr_values = msr_values_per_cpu[cpu] 374 | print(generate_marker_line(cpu, [x for x in msr_values.values() if x != 0])) 375 | 376 | print(R"\end{tabular}\end{table}") 377 | print_separation() 378 | 379 | 380 | def generate_marker_line(cpu, values): 381 | min_str = format_value(int(np.min(values))) 382 | max_str = format_value(int(np.max(values))) 383 | median_str = format_value(int(np.median(values))) 384 | mode = scipy.stats.mode(values, 0) 385 | mode_str = format_value(int(mode.mode[0])) 386 | return R"{} & {} & {} & {} & {} (x{}) \\\hline".format(cpu, min_str, max_str, median_str, mode_str, mode.count[0]) 387 | 388 | 389 | def calc_zero_to_non_zero(msr_values_per_cpu): 390 | zero_non_zero_per_cpu = {} 391 | zero = "zero" 392 | non_zero = "non_zero" 393 | non_zero_pct = "non_zero_pct" 394 | for cpu, msr_values in msr_values_per_cpu.items(): 395 | zero_non_zero_per_cpu[cpu] = {zero: 0, non_zero: 0, non_zero_pct: 0.0} 396 | for value in msr_values.values(): 397 | if value == 0: 398 | zero_non_zero_per_cpu[cpu][zero] += 1 399 | else: 400 | zero_non_zero_per_cpu[cpu][non_zero] += 1 401 | zero_non_zero_per_cpu[cpu][non_zero_pct] = zero_non_zero_per_cpu[cpu][non_zero] / zero_non_zero_per_cpu[cpu][ 402 | zero] 403 | 404 | return zero_non_zero_per_cpu 405 | 406 | 407 | def calc_static_statistics_per_cpu(cpu, msr_values): 408 | values = list(msr_values.values()) 409 | plot_non_zero_histogram(cpu, values) 410 | 411 | 412 | def do_first(scan_time, cpu_values_per_msr, args): 413 | cpu_name = args["cpu_name"] 414 | msr_values_per_cpu = {} 415 | for cpu in list(cpu_values_per_msr.values())[0].keys(): 416 | msr_values_per_cpu[cpu] = {} 417 | for msr, values_per_cpu in cpu_values_per_msr.items(): 418 | for cpu, values in values_per_cpu.items(): 419 | msr_values_per_cpu[cpu][msr] = values[0] 420 | 421 | for cpu, msr_values in msr_values_per_cpu.items(): 422 | calc_static_statistics_per_cpu(cpu, msr_values) 423 | 424 | zero_non_zero_per_cpu = calc_zero_to_non_zero(msr_values_per_cpu) 425 | print_zero_to_non_zero_latex_tabular(zero_non_zero_per_cpu, cpu_name) 426 | print_statistical_markers_non_zero_latex_tabular(msr_values_per_cpu, cpu_name) 427 | 428 | 429 | def do_changes(scan_time, cpu_values_per_msr, args): 430 | calc_args = list(cpu_values_per_msr.items()) 431 | 432 | with mp.Pool(mp.cpu_count()) as p: 433 | p.starmap(calc_msr_changes, calc_args) 434 | 435 | 436 | def main(): 437 | # TODO (maybe) 438 | # Consider action "plot_all" that generates a plot for each cpu per msr regardless of present changes during the 439 | # scan period 440 | actions = { 441 | "plot": do_plt, 442 | "corr": do_corr, 443 | "changes": do_changes, 444 | "first": do_first 445 | } 446 | parser = setup_arg_parse() 447 | args = vars(parser.parse_args()) 448 | if args["action"] not in actions: 449 | print("ERROR! This action does not exist!") 450 | exit(-1) 451 | 452 | scan_time, data = load_msr_sample_file(args["sample_file"]) 453 | 454 | msrs_arg = args["msrs"] 455 | if msrs_arg != "all": 456 | wanted_msrs = [int(msr, 16) for msr in msrs_arg.split(",")] 457 | if "msr" in args and args["msr"]: 458 | wanted_msrs.append(int(args["msr"], 16)) 459 | msrs = list(data.keys()) 460 | for msr in msrs: 461 | if msr not in wanted_msrs: 462 | del data[msr] 463 | 464 | cpus_arg = args["cpus"] 465 | if cpus_arg != "all": 466 | to_remove = [] 467 | wanted_cpus = [int(cpu) for cpu in cpus_arg.split(",")] 468 | for msr, cpu_values in data.items(): 469 | for cpu in cpu_values.keys(): 470 | if cpu not in wanted_cpus: 471 | to_remove.append((msr, cpu)) 472 | for msr, cpu in to_remove: 473 | del data[msr][cpu] 474 | 475 | actions[args["action"]](scan_time, data, args) 476 | 477 | 478 | if __name__ == "__main__": 479 | main() 480 | -------------------------------------------------------------------------------- /scripts/sampling/sample_all.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | USAGE="Usage: ${0} sample_time msr_file" 4 | 5 | timestamp=$(date +"%Y%m%d-%H%M%S") 6 | 7 | sampler_path=./msr_scanner/tools/build/bin/msrs_sample 8 | 9 | set -e 10 | 11 | [[ -z "${1}" ]] && { echo "Missing argument: sample time!" ; echo $USAGE ; exit 1 ; } 12 | [[ -z "${2}" ]] && { echo "Missing argument: path to msr file!" ; echo $USAGE ; exit 1 ; } 13 | 14 | sed "/^#/d" ${2} | sed "s/^/0x/" | sudo xargs ${sampler_path} ${1} > sample_all_${1}_${timestamp} 15 | -------------------------------------------------------------------------------- /use_cases/aesni_solver/Readme.md: -------------------------------------------------------------------------------- 1 | ## Z3 Solver for AESNI perfect Prime & Probe traces 2 | 3 | To solve for the key of the provided trace file use: 4 | ``` 5 | python3 solve.py pt_0b65ba59651ff159c67f2185ef34c139.data 0b65ba59651ff159c67f2185ef34c139 6 | ``` 7 | 8 | To solve with only fewer known plaintext bytes: 9 | 10 | ``` 11 | python3 solve.py pt_0b65ba59651ff159c67f2185ef34c139.data 0b65ba59651ff159c67f2185 12 | ``` -------------------------------------------------------------------------------- /use_cases/aesni_solver/cache_lookup.py: -------------------------------------------------------------------------------- 1 | lookup_ft0 = { 2 | 0x36 : (0x00, 0x07), 3 | 0x37 : (0x08, 0x17), 4 | 0x38 : (0x18, 0x27), 5 | 0x39 : (0x28, 0x37), 6 | 0x3a : (0x38, 0x47), 7 | 0x3b : (0x48, 0x57), 8 | 0x3c : (0x58, 0x67), 9 | 0x3d : (0x68, 0x77), 10 | 0x3e : (0x78, 0x87), 11 | 0x3f : (0x88, 0x97), 12 | 0x0 : (0x98, 0xa7), 13 | 0x1 : (0xa8, 0xb7), 14 | 0x2 : (0xb8, 0xc7), 15 | 0x3 : (0xc8, 0xd7), 16 | 0x4 : (0xd8, 0xe7), 17 | 0x5 : (0xe8, 0xf7), 18 | 0x6 : (0xf8, 0xff), 19 | } 20 | 21 | lookup_ft1 = { 22 | 0x26 : (0x00, 0x07), 23 | 0x27 : (0x08, 0x17), 24 | 0x28 : (0x18, 0x27), 25 | 0x29 : (0x28, 0x37), 26 | 0x2a : (0x38, 0x47), 27 | 0x2b : (0x48, 0x57), 28 | 0x2c : (0x58, 0x67), 29 | 0x2d : (0x68, 0x77), 30 | 0x2e : (0x78, 0x87), 31 | 0x2f : (0x88, 0x97), 32 | 0x30 : (0x98, 0xa7), 33 | 0x31 : (0xa8, 0xb7), 34 | 0x32 : (0xb8, 0xc7), 35 | 0x33 : (0xc8, 0xd7), 36 | 0x34 : (0xd8, 0xe7), 37 | 0x35 : (0xe8, 0xf7), 38 | 0x36 : (0xf8, 0xff), 39 | } 40 | 41 | lookup_ft2 = { 42 | 0x16 : (0x00, 0x07), 43 | 0x17 : (0x08, 0x17), 44 | 0x18 : (0x18, 0x27), 45 | 0x19 : (0x28, 0x37), 46 | 0x1a : (0x38, 0x47), 47 | 0x1b : (0x48, 0x57), 48 | 0x1c : (0x58, 0x67), 49 | 0x1d : (0x68, 0x77), 50 | 0x1e : (0x78, 0x87), 51 | 0x1f : (0x88, 0x97), 52 | 0x20 : (0x98, 0xa7), 53 | 0x21 : (0xa8, 0xb7), 54 | 0x22 : (0xb8, 0xc7), 55 | 0x23 : (0xc8, 0xd7), 56 | 0x24 : (0xd8, 0xe7), 57 | 0x25 : (0xe8, 0xf7), 58 | 0x26 : (0xf8, 0xff), 59 | } 60 | 61 | lookup_ft3 = { 62 | 0x6 : (0x00, 0x07), 63 | 0x7 : (0x08, 0x17), 64 | 0x8 : (0x18, 0x27), 65 | 0x9 : (0x28, 0x37), 66 | 0xa : (0x38, 0x47), 67 | 0xb : (0x48, 0x57), 68 | 0xc : (0x58, 0x67), 69 | 0xd : (0x68, 0x77), 70 | 0xe : (0x78, 0x87), 71 | 0xf : (0x88, 0x97), 72 | 0x10 : (0x98, 0xa7), 73 | 0x11 : (0xa8, 0xb7), 74 | 0x12 : (0xb8, 0xc7), 75 | 0x13 : (0xc8, 0xd7), 76 | 0x14 : (0xd8, 0xe7), 77 | 0x15 : (0xe8, 0xf7), 78 | 0x16 : (0xf8, 0xff), 79 | } 80 | 81 | lookup_rk = { 82 | 0x6 : (0x00, 0x1f), 83 | 0x7 : (0x20, 0x5f), 84 | 0x8 : (0x60, 0x9f), 85 | 0x9 : (0xa0, 0xdf), 86 | 0xa : (0xe0, 0xff), 87 | } 88 | 89 | 90 | def in_range(range, x): 91 | return (range[0] <= x) and (x <= range[1]) -------------------------------------------------------------------------------- /use_cases/aesni_solver/solve.py: -------------------------------------------------------------------------------- 1 | from z3 import * 2 | import sys 3 | import numpy as np 4 | import time 5 | 6 | from cache_lookup import * 7 | from tables import * 8 | 9 | trace_file = sys.argv[1] 10 | 11 | def grep(x, select=0): 12 | found = [] 13 | with open(trace_file) as f: 14 | for line in f: 15 | parts = line.split(" ") 16 | if (parts[0] == x): 17 | found.append(int(parts[1], 16)) 18 | return found[select] & ((1 << 6) - 1) 19 | 20 | 21 | #define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \ 22 | # do \ 23 | # { \ 24 | # (X0) = *RK++ ^ AES_FT0( ( (Y0) ) & 0xFF ) ^ \ 25 | # AES_FT1( ( (Y1) >> 8 ) & 0xFF ) ^ \ 26 | # AES_FT2( ( (Y2) >> 16 ) & 0xFF ) ^ \ 27 | # AES_FT3( ( (Y3) >> 24 ) & 0xFF ); \ 28 | # \ 29 | # (X1) = *RK++ ^ AES_FT0( ( (Y1) ) & 0xFF ) ^ \ 30 | # AES_FT1( ( (Y2) >> 8 ) & 0xFF ) ^ \ 31 | # AES_FT2( ( (Y3) >> 16 ) & 0xFF ) ^ \ 32 | # AES_FT3( ( (Y0) >> 24 ) & 0xFF ); \ 33 | # \ 34 | # (X2) = *RK++ ^ AES_FT0( ( (Y2) ) & 0xFF ) ^ \ 35 | # AES_FT1( ( (Y3) >> 8 ) & 0xFF ) ^ \ 36 | # AES_FT2( ( (Y0) >> 16 ) & 0xFF ) ^ \ 37 | # AES_FT3( ( (Y1) >> 24 ) & 0xFF ); \ 38 | # \ 39 | # (X3) = *RK++ ^ AES_FT0( ( (Y3) ) & 0xFF ) ^ \ 40 | # AES_FT1( ( (Y0) >> 8 ) & 0xFF ) ^ \ 41 | # AES_FT2( ( (Y1) >> 16 ) & 0xFF ) ^ \ 42 | # AES_FT3( ( (Y2) >> 24 ) & 0xFF ); \ 43 | # } while( 0 ) 44 | 45 | ft0s = [ 46 | "R555555556256", 47 | "R555555556282", 48 | "R5555555562af", 49 | "R5555555562cd", 50 | "R555555556307", 51 | "R55555555633a", 52 | "R555555556368", 53 | "R555555556376", 54 | "R5555555563f8", 55 | "R555555556429", 56 | "R555555556460", 57 | "R555555556480", 58 | ] 59 | ft1s = [ 60 | "R55555555626c", 61 | "R555555556296", 62 | "R5555555562e2", 63 | "R5555555562f9", 64 | "R555555556320", 65 | "R55555555634c", 66 | "R55555555638a", 67 | "R5555555563b6", 68 | "R55555555640f", 69 | "R55555555643d", 70 | "R55555555647a", 71 | "R5555555564a2", 72 | ] 73 | ft2s = [ 74 | "R555555556278", 75 | "R5555555562a5", 76 | "R5555555562e9", 77 | "R5555555562fd", 78 | "R55555555632c", 79 | "R55555555636c", 80 | "R5555555563a1", 81 | "R5555555563ba", 82 | "R55555555641b", 83 | "R55555555644a", 84 | "R555555556493", 85 | "R5555555564a9", 86 | ] 87 | ft3s = [ 88 | "R55555555625d", 89 | "R555555556286", 90 | "R5555555562b3", 91 | "R5555555562d4", 92 | "R555555556315", 93 | "R55555555633e", 94 | "R55555555637a", 95 | "R555555556396", 96 | "R555555556404", 97 | "R55555555642d", 98 | "R555555556467", 99 | "R555555556488", 100 | ] 101 | ## 102 | guess_Y = [[[ 103 | lookup_ft0[grep(ft0s[0], i)], 104 | lookup_ft1[grep(ft1s[3], i)], 105 | lookup_ft2[grep(ft2s[2], i)], 106 | lookup_ft3[grep(ft3s[1], i)], 107 | ], 108 | [ 109 | lookup_ft0[grep(ft0s[1], i)], 110 | lookup_ft1[grep(ft1s[0], i)], 111 | lookup_ft2[grep(ft2s[3], i)], 112 | lookup_ft3[grep(ft3s[2], i)], 113 | ], 114 | [ 115 | lookup_ft0[grep(ft0s[2], i)], 116 | lookup_ft1[grep(ft1s[1], i)], 117 | lookup_ft2[grep(ft2s[0], i)], 118 | lookup_ft3[grep(ft3s[3], i)], 119 | ], 120 | [ 121 | lookup_ft0[grep(ft0s[3], i)], 122 | lookup_ft1[grep(ft1s[2], i)], 123 | lookup_ft2[grep(ft2s[1], i)], 124 | lookup_ft3[grep(ft3s[0], i)], 125 | ]] for i in range(4) ] 126 | 127 | ## 128 | guess_X = [[[ 129 | lookup_ft0[grep(ft0s[4], i)], 130 | lookup_ft1[grep(ft1s[7], i)], 131 | lookup_ft2[grep(ft2s[6], i)], 132 | lookup_ft3[grep(ft3s[5], i)], 133 | ], 134 | [ 135 | lookup_ft0[grep(ft0s[5], i)], 136 | lookup_ft1[grep(ft1s[4], i)], 137 | lookup_ft2[grep(ft2s[7], i)], 138 | lookup_ft3[grep(ft3s[6], i)], 139 | ], 140 | [ 141 | lookup_ft0[grep(ft0s[7], i)], 142 | lookup_ft1[grep(ft1s[5], i)], 143 | lookup_ft2[grep(ft2s[4], i)], 144 | lookup_ft3[grep(ft3s[7], i)], 145 | ], 146 | [ 147 | lookup_ft0[grep(ft0s[6], i)], 148 | lookup_ft1[grep(ft1s[6], i)], 149 | lookup_ft2[grep(ft2s[5], i)], 150 | lookup_ft3[grep(ft3s[4], i)], 151 | ]] for i in range(4)] 152 | 153 | # add last y 154 | guess_Y.append([[ 155 | lookup_ft0[grep(ft0s[ 8], 0)], 156 | lookup_ft1[grep(ft1s[11], 0)], 157 | lookup_ft2[grep(ft2s[10], 0)], 158 | lookup_ft3[grep(ft3s[ 9], 0)], 159 | ], 160 | [ 161 | lookup_ft0[grep(ft0s[ 9], 0)], 162 | lookup_ft1[grep(ft1s[ 8], 0)], 163 | lookup_ft2[grep(ft2s[11], 0)], 164 | lookup_ft3[grep(ft3s[10], 0)], 165 | ], 166 | [ 167 | lookup_ft0[grep(ft0s[10], 0)], 168 | lookup_ft1[grep(ft1s[ 9], 0)], 169 | lookup_ft2[grep(ft2s[ 8], 0)], 170 | lookup_ft3[grep(ft3s[11], 0)], 171 | ], 172 | [ 173 | lookup_ft0[grep(ft0s[11], 0)], 174 | lookup_ft1[grep(ft1s[10], 0)], 175 | lookup_ft2[grep(ft2s[ 9], 0)], 176 | lookup_ft3[grep(ft3s[ 8], 0)], 177 | ]]) 178 | 179 | guess_rks = {} 180 | 181 | 182 | number_rk_rounds = 10 183 | 184 | for i in range(number_rk_rounds): 185 | guess_rks[3+4*i] = [ 186 | lookup_rk[grep("R555555555cfd", i)], 187 | lookup_rk[grep("R555555555cdf", i)], 188 | lookup_rk[grep("R555555555d14", i)], 189 | lookup_rk[grep("R555555555ced", i)], 190 | ] 191 | 192 | #key = [BitVec(f"key_{i}", 8) for i in range(16)] 193 | pt = [BitVec(f"pt_{i}", 8) for i in range(16)] 194 | 195 | known_pt = [] 196 | if len(sys.argv) == 3: 197 | for i in range(0, len(sys.argv[2]), 2): 198 | known_pt.append( int(sys.argv[2][i:i+2], 16) ) 199 | 200 | #print(f"using known pt: {[hex(x) for x in known_pt]}") 201 | 202 | for i, kpt in enumerate(known_pt[::-1]): 203 | s.add( pt[15-i] == kpt ) 204 | 205 | n_Y = 2 206 | n_X = 1 207 | 208 | Y = [[[BitVec(f"Y{j}_{x}_{i}", 8) for i in range(4)] for x in range(4)] for j in range(n_Y)] 209 | X = [[[BitVec(f"X{j}_{x}_{i}", 8) for i in range(4)] for x in range(4)] for j in range(n_X)] 210 | 211 | ### this is the data from the key derivation 212 | 213 | # we know that the first round keys are the key bytes 214 | rks = [] 215 | rks.append( [ Y[0][0][b] ^ pt[ 0+b] for b in range(4) ] ) 216 | rks.append( [ Y[0][1][b] ^ pt[ 4+b] for b in range(4) ] ) 217 | rks.append( [ Y[0][2][b] ^ pt[ 8+b] for b in range(4) ] ) 218 | rks.append( [ Y[0][3][b] ^ pt[12+b] for b in range(4) ] ) 219 | 220 | # add the key derivation 221 | for r in range(number_rk_rounds): 222 | rk0 = rks[r*4+0] 223 | rk1 = rks[r*4+1] 224 | rk2 = rks[r*4+2] 225 | rk3 = rks[r*4+3] 226 | 227 | rk4 = [ rk0[b] ^ get_rcon_byte(r, b) ^ FSb[rk3[shift_index[b]]] for b in range(4) ] 228 | rk5 = [ rk4[b] ^ rk1[b] for b in range(4) ] 229 | rk6 = [ rk5[b] ^ rk2[b] for b in range(4) ] 230 | rk7 = [ rk6[b] ^ rk3[b] for b in range(4) ] 231 | 232 | rks.append(rk4) 233 | rks.append(rk5) 234 | rks.append(rk6) 235 | rks.append(rk7) 236 | 237 | # add the bounds for the rks 238 | for rk in range(number_rk_rounds): 239 | for i in range(4): 240 | s.add( And( ULE( guess_rks[3+rk*4][i][0], rks[3+rk*4][i] ), ULE( rks[3+rk*4][i], guess_rks[3+rk*4][i][1] ) ) ) 241 | 242 | ### this is the data from the encryption 243 | 244 | # we also know that y0{0-3} are guesses for the key bytes 245 | #for i in range(4): # variable index 246 | # for b in range(4): # byte index 247 | # s.add( Y[0][i][b] == key[i*4+b] ^ pt[i*4+b]) 248 | 249 | # add the leaked bounds 250 | 251 | for j in range(n_Y): # iteration index 252 | for i in range(4): # variable index 253 | for b in range(4): # byte index 254 | s.add( And( ULE( guess_Y[j][i][b][0], Y[j][i][b] ), ULE( Y[j][i][b], guess_Y[j][i][b][1] ) ) ) 255 | 256 | for j in range(n_X): # iteration index 257 | for i in range(4): # variable index 258 | for b in range(4): # byte index 259 | s.add( And( ULE( guess_X[j][i][b][0], X[j][i][b] ), ULE( X[j][i][b], guess_X[j][i][b][1] ) ) ) 260 | 261 | # the aes fround 262 | def aes_fround(s, YY, XX, ki): 263 | for i in range(4): # variable index 264 | for b in range(4): # byte index 265 | i0 = (i+0) % 4 266 | i1 = (i+1) % 4 267 | i2 = (i+2) % 4 268 | i3 = (i+3) % 4 269 | s.add( YY[i][b] == rks[i+ki][b] ^ FT0x[b][XX[i0][0]] ^ FT1x[b][XX[i1][1]] ^ FT2x[b][XX[i2][2]] ^ FT3x[b][XX[i3][3]] ) 270 | 271 | aes_fround(s, X[0], Y[0], 4) 272 | 273 | # the more rounds added the fewer candidates but the longer it takes to solve 274 | 275 | #aes_fround(s, Y[1], X[0], 8) 276 | #aes_fround(s, X[1], Y[1], 12) 277 | 278 | #aes_fround(s, Y[2], X[1], 16) 279 | #aes_fround(s, X[2], Y[2], 20) 280 | 281 | #aes_fround(s, Y[3], X[2], 24) 282 | #aes_fround(s, X[3], Y[3], 28) 283 | 284 | #aes_fround(s, Y[4], X[3], 32) 285 | 286 | 287 | 288 | ## solve! 289 | 290 | counter = 0 291 | #set_option(max_args=10000000, max_lines=1000000, max_depth=10000000, max_visited=1000000) 292 | #print(s.assertions()) 293 | 294 | 295 | with open("out.smt", "w") as f: 296 | f.write("(set-logic QF_BV)\n") 297 | f.write(s.sexpr()) 298 | f.write("(check-sat)") 299 | 300 | start = time.time() 301 | 302 | while s.check() != unsat: 303 | m = s.model() 304 | sys.stdout.flush() 305 | 306 | block = [] 307 | 308 | print(f"candidate {counter:3d}: ", end='') 309 | 310 | s.push() 311 | 312 | aes_fround(s, Y[1], X[0], 8) 313 | 314 | for i in range(4): 315 | for b in range(4): 316 | y = m[Y[0][i][b]].as_long() 317 | p = m[pt[i*4+b]].as_long() 318 | v = y ^ p 319 | 320 | print(f"{v:02x}", end='') 321 | block.append( v != Y[0][i][b] ^ pt[i*4+b]) 322 | #block.append( y != Y[0][i][b]) 323 | block.append( p != pt[i*4+b] ) 324 | 325 | s.add( y == Y[0][i][b]) 326 | s.add( p == pt[i*4+b]) 327 | 328 | correct = s.check() != unsat 329 | 330 | s.pop() 331 | 332 | print(" pt: ", end='') 333 | for i in range(16): 334 | v = m[pt[i]].as_long() 335 | print(f"{v:02x}", end='') 336 | 337 | if correct: 338 | print(" <- correct") 339 | break 340 | else: 341 | print("\r", end='') 342 | 343 | counter += 1 344 | s.add(Or(block)) 345 | 346 | end = time.time() 347 | 348 | print("") 349 | print(f"took {int((end - start)//60):4d}:{int((end - start)%60):02d} m:s") -------------------------------------------------------------------------------- /use_cases/aesni_solver/tables.py: -------------------------------------------------------------------------------- 1 | FT0 = [ 0xA56363C6, 0x847C7CF8, 0x997777EE, 0x8D7B7BF6, 0x0DF2F2FF, 0xBD6B6BD6, 0xB16F6FDE, 0x54C5C591, 0x50303060, 0x03010102, 0xA96767CE, 0x7D2B2B56, 0x19FEFEE7, 0x62D7D7B5, 0xE6ABAB4D, 0x9A7676EC, 0x45CACA8F, 0x9D82821F, 0x40C9C989, 0x877D7DFA, 0x15FAFAEF, 0xEB5959B2, 0xC947478E, 0x0BF0F0FB, 0xECADAD41, 0x67D4D4B3, 0xFDA2A25F, 0xEAAFAF45, 0xBF9C9C23, 0xF7A4A453, 0x967272E4, 0x5BC0C09B, 0xC2B7B775, 0x1CFDFDE1, 0xAE93933D, 0x6A26264C, 0x5A36366C, 0x413F3F7E, 0x02F7F7F5, 0x4FCCCC83, 0x5C343468, 0xF4A5A551, 0x34E5E5D1, 0x08F1F1F9, 0x937171E2, 0x73D8D8AB, 0x53313162, 0x3F15152A, 0x0C040408, 0x52C7C795, 0x65232346, 0x5EC3C39D, 0x28181830, 0xA1969637, 0x0F05050A, 0xB59A9A2F, 0x0907070E, 0x36121224, 0x9B80801B, 0x3DE2E2DF, 0x26EBEBCD, 0x6927274E, 0xCDB2B27F, 0x9F7575EA, 0x1B090912, 0x9E83831D, 0x742C2C58, 0x2E1A1A34, 0x2D1B1B36, 0xB26E6EDC, 0xEE5A5AB4, 0xFBA0A05B, 0xF65252A4, 0x4D3B3B76, 0x61D6D6B7, 0xCEB3B37D, 0x7B292952, 0x3EE3E3DD, 0x712F2F5E, 0x97848413, 0xF55353A6, 0x68D1D1B9, 0x00000000, 0x2CEDEDC1, 0x60202040, 0x1FFCFCE3, 0xC8B1B179, 0xED5B5BB6, 0xBE6A6AD4, 0x46CBCB8D, 0xD9BEBE67, 0x4B393972, 0xDE4A4A94, 0xD44C4C98, 0xE85858B0, 0x4ACFCF85, 0x6BD0D0BB, 0x2AEFEFC5, 0xE5AAAA4F, 0x16FBFBED, 0xC5434386, 0xD74D4D9A, 0x55333366, 0x94858511, 0xCF45458A, 0x10F9F9E9, 0x06020204, 0x817F7FFE, 0xF05050A0, 0x443C3C78, 0xBA9F9F25, 0xE3A8A84B, 0xF35151A2, 0xFEA3A35D, 0xC0404080, 0x8A8F8F05, 0xAD92923F, 0xBC9D9D21, 0x48383870, 0x04F5F5F1, 0xDFBCBC63, 0xC1B6B677, 0x75DADAAF, 0x63212142, 0x30101020, 0x1AFFFFE5, 0x0EF3F3FD, 0x6DD2D2BF, 0x4CCDCD81, 0x140C0C18, 0x35131326, 0x2FECECC3, 0xE15F5FBE, 0xA2979735, 0xCC444488, 0x3917172E, 0x57C4C493, 0xF2A7A755, 0x827E7EFC, 0x473D3D7A, 0xAC6464C8, 0xE75D5DBA, 0x2B191932, 0x957373E6, 0xA06060C0, 0x98818119, 0xD14F4F9E, 0x7FDCDCA3, 0x66222244, 0x7E2A2A54, 0xAB90903B, 0x8388880B, 0xCA46468C, 0x29EEEEC7, 0xD3B8B86B, 0x3C141428, 0x79DEDEA7, 0xE25E5EBC, 0x1D0B0B16, 0x76DBDBAD, 0x3BE0E0DB, 0x56323264, 0x4E3A3A74, 0x1E0A0A14, 0xDB494992, 0x0A06060C, 0x6C242448, 0xE45C5CB8, 0x5DC2C29F, 0x6ED3D3BD, 0xEFACAC43, 0xA66262C4, 0xA8919139, 0xA4959531, 0x37E4E4D3, 0x8B7979F2, 0x32E7E7D5, 0x43C8C88B, 0x5937376E, 0xB76D6DDA, 0x8C8D8D01, 0x64D5D5B1, 0xD24E4E9C, 0xE0A9A949, 0xB46C6CD8, 0xFA5656AC, 0x07F4F4F3, 0x25EAEACF, 0xAF6565CA, 0x8E7A7AF4, 0xE9AEAE47, 0x18080810, 0xD5BABA6F, 0x887878F0, 0x6F25254A, 0x722E2E5C, 0x241C1C38, 0xF1A6A657, 0xC7B4B473, 0x51C6C697, 0x23E8E8CB, 0x7CDDDDA1, 0x9C7474E8, 0x211F1F3E, 0xDD4B4B96, 0xDCBDBD61, 0x868B8B0D, 0x858A8A0F, 0x907070E0, 0x423E3E7C, 0xC4B5B571, 0xAA6666CC, 0xD8484890, 0x05030306, 0x01F6F6F7, 0x120E0E1C, 0xA36161C2, 0x5F35356A, 0xF95757AE, 0xD0B9B969, 0x91868617, 0x58C1C199, 0x271D1D3A, 0xB99E9E27, 0x38E1E1D9, 0x13F8F8EB, 0xB398982B, 0x33111122, 0xBB6969D2, 0x70D9D9A9, 0x898E8E07, 0xA7949433, 0xB69B9B2D, 0x221E1E3C, 0x92878715, 0x20E9E9C9, 0x49CECE87, 0xFF5555AA, 0x78282850, 0x7ADFDFA5, 0x8F8C8C03, 0xF8A1A159, 0x80898909, 0x170D0D1A, 0xDABFBF65, 0x31E6E6D7, 0xC6424284, 0xB86868D0, 0xC3414182, 0xB0999929, 0x772D2D5A, 0x110F0F1E, 0xCBB0B07B, 0xFC5454A8, 0xD6BBBB6D, 0x3A16162C ] 2 | 3 | 4 | FT1 = [0x6363C6A5, 0x7C7CF884, 0x7777EE99, 0x7B7BF68D, 0xF2F2FF0D, 0x6B6BD6BD, 0x6F6FDEB1, 0xC5C59154, 0x30306050, 0x01010203, 0x6767CEA9, 0x2B2B567D, 0xFEFEE719, 0xD7D7B562, 0xABAB4DE6, 0x7676EC9A, 0xCACA8F45, 0x82821F9D, 0xC9C98940, 0x7D7DFA87, 0xFAFAEF15, 0x5959B2EB, 0x47478EC9, 0xF0F0FB0B, 0xADAD41EC, 0xD4D4B367, 0xA2A25FFD, 0xAFAF45EA, 0x9C9C23BF, 0xA4A453F7, 0x7272E496, 0xC0C09B5B, 0xB7B775C2, 0xFDFDE11C, 0x93933DAE, 0x26264C6A, 0x36366C5A, 0x3F3F7E41, 0xF7F7F502, 0xCCCC834F, 0x3434685C, 0xA5A551F4, 0xE5E5D134, 0xF1F1F908, 0x7171E293, 0xD8D8AB73, 0x31316253, 0x15152A3F, 0x0404080C, 0xC7C79552, 0x23234665, 0xC3C39D5E, 0x18183028, 0x969637A1, 0x05050A0F, 0x9A9A2FB5, 0x07070E09, 0x12122436, 0x80801B9B, 0xE2E2DF3D, 0xEBEBCD26, 0x27274E69, 0xB2B27FCD, 0x7575EA9F, 0x0909121B, 0x83831D9E, 0x2C2C5874, 0x1A1A342E, 0x1B1B362D, 0x6E6EDCB2, 0x5A5AB4EE, 0xA0A05BFB, 0x5252A4F6, 0x3B3B764D, 0xD6D6B761, 0xB3B37DCE, 0x2929527B, 0xE3E3DD3E, 0x2F2F5E71, 0x84841397, 0x5353A6F5, 0xD1D1B968, 0x00000000, 0xEDEDC12C, 0x20204060, 0xFCFCE31F, 0xB1B179C8, 0x5B5BB6ED, 0x6A6AD4BE, 0xCBCB8D46, 0xBEBE67D9, 0x3939724B, 0x4A4A94DE, 0x4C4C98D4, 0x5858B0E8, 0xCFCF854A, 0xD0D0BB6B, 0xEFEFC52A, 0xAAAA4FE5, 0xFBFBED16, 0x434386C5, 0x4D4D9AD7, 0x33336655, 0x85851194, 0x45458ACF, 0xF9F9E910, 0x02020406, 0x7F7FFE81, 0x5050A0F0, 0x3C3C7844, 0x9F9F25BA, 0xA8A84BE3, 0x5151A2F3, 0xA3A35DFE, 0x404080C0, 0x8F8F058A, 0x92923FAD, 0x9D9D21BC, 0x38387048, 0xF5F5F104, 0xBCBC63DF, 0xB6B677C1, 0xDADAAF75, 0x21214263, 0x10102030, 0xFFFFE51A, 0xF3F3FD0E, 0xD2D2BF6D, 0xCDCD814C, 0x0C0C1814, 0x13132635, 0xECECC32F, 0x5F5FBEE1, 0x979735A2, 0x444488CC, 0x17172E39, 0xC4C49357, 0xA7A755F2, 0x7E7EFC82, 0x3D3D7A47, 0x6464C8AC, 0x5D5DBAE7, 0x1919322B, 0x7373E695, 0x6060C0A0, 0x81811998, 0x4F4F9ED1, 0xDCDCA37F, 0x22224466, 0x2A2A547E, 0x90903BAB, 0x88880B83, 0x46468CCA, 0xEEEEC729, 0xB8B86BD3, 0x1414283C, 0xDEDEA779, 0x5E5EBCE2, 0x0B0B161D, 0xDBDBAD76, 0xE0E0DB3B, 0x32326456, 0x3A3A744E, 0x0A0A141E, 0x494992DB, 0x06060C0A, 0x2424486C, 0x5C5CB8E4, 0xC2C29F5D, 0xD3D3BD6E, 0xACAC43EF, 0x6262C4A6, 0x919139A8, 0x959531A4, 0xE4E4D337, 0x7979F28B, 0xE7E7D532, 0xC8C88B43, 0x37376E59, 0x6D6DDAB7, 0x8D8D018C, 0xD5D5B164, 0x4E4E9CD2, 0xA9A949E0, 0x6C6CD8B4, 0x5656ACFA, 0xF4F4F307, 0xEAEACF25, 0x6565CAAF, 0x7A7AF48E, 0xAEAE47E9, 0x08081018, 0xBABA6FD5, 0x7878F088, 0x25254A6F, 0x2E2E5C72, 0x1C1C3824, 0xA6A657F1, 0xB4B473C7, 0xC6C69751, 0xE8E8CB23, 0xDDDDA17C, 0x7474E89C, 0x1F1F3E21, 0x4B4B96DD, 0xBDBD61DC, 0x8B8B0D86, 0x8A8A0F85, 0x7070E090, 0x3E3E7C42, 0xB5B571C4, 0x6666CCAA, 0x484890D8, 0x03030605, 0xF6F6F701, 0x0E0E1C12, 0x6161C2A3, 0x35356A5F, 0x5757AEF9, 0xB9B969D0, 0x86861791, 0xC1C19958, 0x1D1D3A27, 0x9E9E27B9, 0xE1E1D938, 0xF8F8EB13, 0x98982BB3, 0x11112233, 0x6969D2BB, 0xD9D9A970, 0x8E8E0789, 0x949433A7, 0x9B9B2DB6, 0x1E1E3C22, 0x87871592, 0xE9E9C920, 0xCECE8749, 0x5555AAFF, 0x28285078, 0xDFDFA57A, 0x8C8C038F, 0xA1A159F8, 0x89890980, 0x0D0D1A17, 0xBFBF65DA, 0xE6E6D731, 0x424284C6, 0x6868D0B8, 0x414182C3, 0x999929B0, 0x2D2D5A77, 0x0F0F1E11, 0xB0B07BCB, 0x5454A8FC, 0xBBBB6DD6, 0x16162C3A ] 5 | 6 | 7 | 8 | FT2 = [0x63C6A563, 0x7CF8847C, 0x77EE9977, 0x7BF68D7B, 0xF2FF0DF2, 0x6BD6BD6B, 0x6FDEB16F, 0xC59154C5, 0x30605030, 0x01020301, 0x67CEA967, 0x2B567D2B, 0xFEE719FE, 0xD7B562D7, 0xAB4DE6AB, 0x76EC9A76, 0xCA8F45CA, 0x821F9D82, 0xC98940C9, 0x7DFA877D, 0xFAEF15FA, 0x59B2EB59, 0x478EC947, 0xF0FB0BF0, 0xAD41ECAD, 0xD4B367D4, 0xA25FFDA2, 0xAF45EAAF, 0x9C23BF9C, 0xA453F7A4, 0x72E49672, 0xC09B5BC0, 0xB775C2B7, 0xFDE11CFD, 0x933DAE93, 0x264C6A26, 0x366C5A36, 0x3F7E413F, 0xF7F502F7, 0xCC834FCC, 0x34685C34, 0xA551F4A5, 0xE5D134E5, 0xF1F908F1, 0x71E29371, 0xD8AB73D8, 0x31625331, 0x152A3F15, 0x04080C04, 0xC79552C7, 0x23466523, 0xC39D5EC3, 0x18302818, 0x9637A196, 0x050A0F05, 0x9A2FB59A, 0x070E0907, 0x12243612, 0x801B9B80, 0xE2DF3DE2, 0xEBCD26EB, 0x274E6927, 0xB27FCDB2, 0x75EA9F75, 0x09121B09, 0x831D9E83, 0x2C58742C, 0x1A342E1A, 0x1B362D1B, 0x6EDCB26E, 0x5AB4EE5A, 0xA05BFBA0, 0x52A4F652, 0x3B764D3B, 0xD6B761D6, 0xB37DCEB3, 0x29527B29, 0xE3DD3EE3, 0x2F5E712F, 0x84139784, 0x53A6F553, 0xD1B968D1, 0x00000000, 0xEDC12CED, 0x20406020, 0xFCE31FFC, 0xB179C8B1, 0x5BB6ED5B, 0x6AD4BE6A, 0xCB8D46CB, 0xBE67D9BE, 0x39724B39, 0x4A94DE4A, 0x4C98D44C, 0x58B0E858, 0xCF854ACF, 0xD0BB6BD0, 0xEFC52AEF, 0xAA4FE5AA, 0xFBED16FB, 0x4386C543, 0x4D9AD74D, 0x33665533, 0x85119485, 0x458ACF45, 0xF9E910F9, 0x02040602, 0x7FFE817F, 0x50A0F050, 0x3C78443C, 0x9F25BA9F, 0xA84BE3A8, 0x51A2F351, 0xA35DFEA3, 0x4080C040, 0x8F058A8F, 0x923FAD92, 0x9D21BC9D, 0x38704838, 0xF5F104F5, 0xBC63DFBC, 0xB677C1B6, 0xDAAF75DA, 0x21426321, 0x10203010, 0xFFE51AFF, 0xF3FD0EF3, 0xD2BF6DD2, 0xCD814CCD, 0x0C18140C, 0x13263513, 0xECC32FEC, 0x5FBEE15F, 0x9735A297, 0x4488CC44, 0x172E3917, 0xC49357C4, 0xA755F2A7, 0x7EFC827E, 0x3D7A473D, 0x64C8AC64, 0x5DBAE75D, 0x19322B19, 0x73E69573, 0x60C0A060, 0x81199881, 0x4F9ED14F, 0xDCA37FDC, 0x22446622, 0x2A547E2A, 0x903BAB90, 0x880B8388, 0x468CCA46, 0xEEC729EE, 0xB86BD3B8, 0x14283C14, 0xDEA779DE, 0x5EBCE25E, 0x0B161D0B, 0xDBAD76DB, 0xE0DB3BE0, 0x32645632, 0x3A744E3A, 0x0A141E0A, 0x4992DB49, 0x060C0A06, 0x24486C24, 0x5CB8E45C, 0xC29F5DC2, 0xD3BD6ED3, 0xAC43EFAC, 0x62C4A662, 0x9139A891, 0x9531A495, 0xE4D337E4, 0x79F28B79, 0xE7D532E7, 0xC88B43C8, 0x376E5937, 0x6DDAB76D, 0x8D018C8D, 0xD5B164D5, 0x4E9CD24E, 0xA949E0A9, 0x6CD8B46C, 0x56ACFA56, 0xF4F307F4, 0xEACF25EA, 0x65CAAF65, 0x7AF48E7A, 0xAE47E9AE, 0x08101808, 0xBA6FD5BA, 0x78F08878, 0x254A6F25, 0x2E5C722E, 0x1C38241C, 0xA657F1A6, 0xB473C7B4, 0xC69751C6, 0xE8CB23E8, 0xDDA17CDD, 0x74E89C74, 0x1F3E211F, 0x4B96DD4B, 0xBD61DCBD, 0x8B0D868B, 0x8A0F858A, 0x70E09070, 0x3E7C423E, 0xB571C4B5, 0x66CCAA66, 0x4890D848, 0x03060503, 0xF6F701F6, 0x0E1C120E, 0x61C2A361, 0x356A5F35, 0x57AEF957, 0xB969D0B9, 0x86179186, 0xC19958C1, 0x1D3A271D, 0x9E27B99E, 0xE1D938E1, 0xF8EB13F8, 0x982BB398, 0x11223311, 0x69D2BB69, 0xD9A970D9, 0x8E07898E, 0x9433A794, 0x9B2DB69B, 0x1E3C221E, 0x87159287, 0xE9C920E9, 0xCE8749CE, 0x55AAFF55, 0x28507828, 0xDFA57ADF, 0x8C038F8C, 0xA159F8A1, 0x89098089, 0x0D1A170D, 0xBF65DABF, 0xE6D731E6, 0x4284C642, 0x68D0B868, 0x4182C341, 0x9929B099, 0x2D5A772D, 0x0F1E110F, 0xB07BCBB0, 0x54A8FC54, 0xBB6DD6BB, 0x162C3A16 ] 9 | 10 | 11 | 12 | FT3 = [ 0xC6A56363, 0xF8847C7C, 0xEE997777, 0xF68D7B7B, 0xFF0DF2F2, 0xD6BD6B6B, 0xDEB16F6F, 0x9154C5C5, 0x60503030, 0x02030101, 0xCEA96767, 0x567D2B2B, 0xE719FEFE, 0xB562D7D7, 0x4DE6ABAB, 0xEC9A7676, 0x8F45CACA, 0x1F9D8282, 0x8940C9C9, 0xFA877D7D, 0xEF15FAFA, 0xB2EB5959, 0x8EC94747, 0xFB0BF0F0, 0x41ECADAD, 0xB367D4D4, 0x5FFDA2A2, 0x45EAAFAF, 0x23BF9C9C, 0x53F7A4A4, 0xE4967272, 0x9B5BC0C0, 0x75C2B7B7, 0xE11CFDFD, 0x3DAE9393, 0x4C6A2626, 0x6C5A3636, 0x7E413F3F, 0xF502F7F7, 0x834FCCCC, 0x685C3434, 0x51F4A5A5, 0xD134E5E5, 0xF908F1F1, 0xE2937171, 0xAB73D8D8, 0x62533131, 0x2A3F1515, 0x080C0404, 0x9552C7C7, 0x46652323, 0x9D5EC3C3, 0x30281818, 0x37A19696, 0x0A0F0505, 0x2FB59A9A, 0x0E090707, 0x24361212, 0x1B9B8080, 0xDF3DE2E2, 0xCD26EBEB, 0x4E692727, 0x7FCDB2B2, 0xEA9F7575, 0x121B0909, 0x1D9E8383, 0x58742C2C, 0x342E1A1A, 0x362D1B1B, 0xDCB26E6E, 0xB4EE5A5A, 0x5BFBA0A0, 0xA4F65252, 0x764D3B3B, 0xB761D6D6, 0x7DCEB3B3, 0x527B2929, 0xDD3EE3E3, 0x5E712F2F, 0x13978484, 0xA6F55353, 0xB968D1D1, 0x00000000, 0xC12CEDED, 0x40602020, 0xE31FFCFC, 0x79C8B1B1, 0xB6ED5B5B, 0xD4BE6A6A, 0x8D46CBCB, 0x67D9BEBE, 0x724B3939, 0x94DE4A4A, 0x98D44C4C, 0xB0E85858, 0x854ACFCF, 0xBB6BD0D0, 0xC52AEFEF, 0x4FE5AAAA, 0xED16FBFB, 0x86C54343, 0x9AD74D4D, 0x66553333, 0x11948585, 0x8ACF4545, 0xE910F9F9, 0x04060202, 0xFE817F7F, 0xA0F05050, 0x78443C3C, 0x25BA9F9F, 0x4BE3A8A8, 0xA2F35151, 0x5DFEA3A3, 0x80C04040, 0x058A8F8F, 0x3FAD9292, 0x21BC9D9D, 0x70483838, 0xF104F5F5, 0x63DFBCBC, 0x77C1B6B6, 0xAF75DADA, 0x42632121, 0x20301010, 0xE51AFFFF, 0xFD0EF3F3, 0xBF6DD2D2, 0x814CCDCD, 0x18140C0C, 0x26351313, 0xC32FECEC, 0xBEE15F5F, 0x35A29797, 0x88CC4444, 0x2E391717, 0x9357C4C4, 0x55F2A7A7, 0xFC827E7E, 0x7A473D3D, 0xC8AC6464, 0xBAE75D5D, 0x322B1919, 0xE6957373, 0xC0A06060, 0x19988181, 0x9ED14F4F, 0xA37FDCDC, 0x44662222, 0x547E2A2A, 0x3BAB9090, 0x0B838888, 0x8CCA4646, 0xC729EEEE, 0x6BD3B8B8, 0x283C1414, 0xA779DEDE, 0xBCE25E5E, 0x161D0B0B, 0xAD76DBDB, 0xDB3BE0E0, 0x64563232, 0x744E3A3A, 0x141E0A0A, 0x92DB4949, 0x0C0A0606, 0x486C2424, 0xB8E45C5C, 0x9F5DC2C2, 0xBD6ED3D3, 0x43EFACAC, 0xC4A66262, 0x39A89191, 0x31A49595, 0xD337E4E4, 0xF28B7979, 0xD532E7E7, 0x8B43C8C8, 0x6E593737, 0xDAB76D6D, 0x018C8D8D, 0xB164D5D5, 0x9CD24E4E, 0x49E0A9A9, 0xD8B46C6C, 0xACFA5656, 0xF307F4F4, 0xCF25EAEA, 0xCAAF6565, 0xF48E7A7A, 0x47E9AEAE, 0x10180808, 0x6FD5BABA, 0xF0887878, 0x4A6F2525, 0x5C722E2E, 0x38241C1C, 0x57F1A6A6, 0x73C7B4B4, 0x9751C6C6, 0xCB23E8E8, 0xA17CDDDD, 0xE89C7474, 0x3E211F1F, 0x96DD4B4B, 0x61DCBDBD, 0x0D868B8B, 0x0F858A8A, 0xE0907070, 0x7C423E3E, 0x71C4B5B5, 0xCCAA6666, 0x90D84848, 0x06050303, 0xF701F6F6, 0x1C120E0E, 0xC2A36161, 0x6A5F3535, 0xAEF95757, 0x69D0B9B9, 0x17918686, 0x9958C1C1, 0x3A271D1D, 0x27B99E9E, 0xD938E1E1, 0xEB13F8F8, 0x2BB39898, 0x22331111, 0xD2BB6969, 0xA970D9D9, 0x07898E8E, 0x33A79494, 0x2DB69B9B, 0x3C221E1E, 0x15928787, 0xC920E9E9, 0x8749CECE, 0xAAFF5555, 0x50782828, 0xA57ADFDF, 0x038F8C8C, 0x59F8A1A1, 0x09808989, 0x1A170D0D, 0x65DABFBF, 0xD731E6E6, 0x84C64242, 0xD0B86868, 0x82C34141, 0x29B09999, 0x5A772D2D, 0x1E110F0F, 0x7BCBB0B0, 0xA8FC5454, 0x6DD6BBBB, 0x2C3A1616 ] 13 | 14 | 15 | ForwardTable = [ 16 | 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 17 | 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, 18 | 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 19 | 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 20 | 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 21 | 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 22 | 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 23 | 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, 24 | 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 25 | 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 26 | 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 27 | 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, 28 | 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 29 | 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, 30 | 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 31 | 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 32 | 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 33 | 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, 34 | 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 35 | 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, 36 | 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 37 | 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 38 | 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 39 | 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, 40 | 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 41 | 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, 42 | 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 43 | 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 44 | 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 45 | 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 46 | 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 47 | 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16 48 | ] 49 | 50 | RCON = [ 51 | 0x00000001, 0x00000002, 0x00000004, 0x00000008, 52 | 0x00000010, 0x00000020, 0x00000040, 0x00000080, 53 | 0x0000001B, 0x00000036 54 | ] 55 | 56 | shift_index = [1,2,3,0] 57 | 58 | from z3 import * 59 | 60 | #FSb = Array('FSb', BitVecSort(8), BitVecSort(8)) 61 | 62 | FT0x = [Array(f"FT0_{i}", BitVecSort(8), BitVecSort(8)) for i in range(4)] 63 | #FT1x = [Array(f"FT1_{i}", BitVecSort(8), BitVecSort(8)) for i in range(4)] 64 | #FT2x = [Array(f"FT2_{i}", BitVecSort(8), BitVecSort(8)) for i in range(4)] 65 | #FT3x = [Array(f"FT3_{i}", BitVecSort(8), BitVecSort(8)) for i in range(4)] 66 | 67 | ft0x_byte_perm = [0,1,2,3] 68 | ft1x_byte_perm = [3,0,1,2] 69 | ft2x_byte_perm = [2,3,0,1] 70 | ft3x_byte_perm = [1,2,3,0] 71 | 72 | FT1x = [FT0x[ft1x_byte_perm[i]] for i in range(4)] 73 | FT2x = [FT0x[ft2x_byte_perm[i]] for i in range(4)] 74 | FT3x = [FT0x[ft3x_byte_perm[i]] for i in range(4)] 75 | 76 | FSb = FT0x[1] 77 | 78 | if False: 79 | FTh0 = Array(f"FTh0", BitVecSort(8), BitVecSort(32)) 80 | FTh1 = Array(f"FTh1", BitVecSort(8), BitVecSort(32)) 81 | FTh2 = Array(f"FTh2", BitVecSort(8), BitVecSort(32)) 82 | FTh3 = Array(f"FTh3", BitVecSort(8), BitVecSort(32)) 83 | 84 | 85 | s = SolverFor("QF_BV") 86 | #s = Solver() 87 | 88 | set_option(max_args=10000000, max_lines=1000000, max_depth=10000000, max_visited=1000000) 89 | set_param("parallel.enable",True) 90 | set_param("parallel.threads.max", 4) 91 | #set_param("solver.smtlib2_log", "filename.smt2") 92 | 93 | if True: 94 | #for i,e in enumerate(ForwardTable): 95 | # s.add(FSb[i] == BitVecVal(e, 8) ) 96 | 97 | if False: 98 | for i in range(256): 99 | s.add(FTh0[i] == BitVecVal(FT0[i], 32)) 100 | s.add(FTh1[i] == BitVecVal(FT1[i], 32)) 101 | s.add(FTh2[i] == BitVecVal(FT2[i], 32)) 102 | s.add(FTh3[i] == BitVecVal(FT3[i], 32)) 103 | 104 | for i in range(4): 105 | for j,e in enumerate(FT0): 106 | s.add(FT0x[i][j] == BitVecVal((e >> (i*8)) & 0xFF, 8)) 107 | 108 | #for j,e in enumerate(FT1): 109 | # s.add(FT1x[i][j] == BitVecVal((e >> (i*8)) & 0xFF, 8)) 110 | 111 | #for j,e in enumerate(FT2): 112 | # s.add(FT2x[i][j] == BitVecVal((e >> (i*8)) & 0xFF, 8)) 113 | 114 | #for j,e in enumerate(FT3): 115 | # s.add(FT3x[i][j] == BitVecVal((e >> (i*8)) & 0xFF, 8)) 116 | 117 | 118 | def get_rcon_byte(rcon_index, byte_index): 119 | return ((RCON[rcon_index] >> (byte_index*8)) & 0xff) -------------------------------------------------------------------------------- /use_cases/cpuidtrap/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | gcc -shared -fPIC libfixcpuid.c -O3 -o libfixcpuid.so -ldl 3 | gcc test.c -O3 -o test -lm 4 | gcc bench.c -O3 -o bench -lm 5 | 6 | clean: 7 | -rm bench libfixcpuid.so test 8 | -------------------------------------------------------------------------------- /use_cases/cpuidtrap/bench.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | uint64_t rdtscnf() { 7 | uint64_t a, d; 8 | asm volatile("rdtscp" : "=a"(a), "=d"(d) :: "rcx"); 9 | a = (d << 32) | a; 10 | return a; 11 | } 12 | 13 | #define AVERAGE 100000 14 | 15 | size_t measurements[AVERAGE]; 16 | 17 | size_t mean(size_t* val, size_t len) { 18 | size_t sum = 0; 19 | for(size_t i = 0; i < len; i++) { 20 | sum += val[i]; 21 | } 22 | return sum / len; 23 | } 24 | 25 | double standard_error(size_t* val, size_t len) { 26 | size_t m = mean(val, len); 27 | size_t err_sum = 0; 28 | for(size_t i = 0; i < len; i++) { 29 | err_sum += (val[i] - m) * (val[i] - m); 30 | } 31 | double stddev = sqrt((double)err_sum / (double)(len - 1)); 32 | //printf("sqrt(%f) = %f\n", (double)err_sum / (double)(len - 1), stddev); 33 | return stddev / sqrt(len); 34 | } 35 | 36 | void rdrand(){ 37 | for(int i = 0; i < AVERAGE; i++) { 38 | size_t start = rdtscnf(); 39 | uint64_t random_number; 40 | asm volatile("rdrand %0":"=r"(random_number):); 41 | size_t end = rdtscnf(); 42 | measurements[i] = end - start; 43 | } 44 | } 45 | 46 | void cpuid(){ 47 | for(int i = 0; i < AVERAGE; i++) { 48 | size_t start = rdtscnf(); 49 | unsigned int model; 50 | int rax, rbx, rcx, rdx; 51 | asm volatile("cpuid" : "+a"(rax), "+b"(rbx), "+c"(rcx), "+d"(rdx)); 52 | size_t end = rdtscnf(); 53 | measurements[i] = end - start; 54 | } 55 | } 56 | 57 | 58 | int main(int argc, char *argv[]) { 59 | printf("hi!\n"); 60 | 61 | if (argc != 3) { 62 | printf("usage: %s [rdrand=0|cpuid=1] trap\n", argv[0]); 63 | return -1; 64 | } 65 | 66 | int bench = atoi(argv[1]); 67 | int trap = atoi(argv[2]); 68 | 69 | while (1) { 70 | if (bench == 0) { 71 | rdrand(); 72 | printf("RDRAND took %zd cycles (+/- %.1f)\n", mean(measurements, AVERAGE), standard_error(measurements, AVERAGE)); 73 | } else { 74 | cpuid(); 75 | printf("CPUID took %zd cycles (+/- %.1f)\n", mean(measurements, AVERAGE), standard_error(measurements, AVERAGE)); 76 | } 77 | 78 | } 79 | 80 | printf("done\n"); 81 | return 0; 82 | } 83 | -------------------------------------------------------------------------------- /use_cases/cpuidtrap/libfixcpuid.c: -------------------------------------------------------------------------------- 1 | #define _GNU_SOURCE 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include "module/fixcpuid.h" 19 | 20 | 21 | #define MODE_CACHE 22 | 23 | 24 | // #define debug printf 25 | #define debug 26 | 27 | #define TAG "[CPUID Fix] " 28 | 29 | #define GET_REG(ctx, reg) ((ucontext_t*)ctx)->uc_mcontext.gregs[REG_R##reg] 30 | 31 | static int fixcpuid_fd = 0; 32 | 33 | static uint64_t cpuid_cache[64][4]; 34 | static uint64_t cpuid_ecache[64][4]; 35 | 36 | static int cache_all_leaves() { 37 | uint64_t rax, rbx, rcx, rdx; 38 | 39 | rax = 0; 40 | asm volatile("cpuid" : "+a"(rax), "+b"(rbx), "+c"(rcx), "+d"(rdx)); 41 | printf("Highest leaf: 0x%zx\n", rax); 42 | int max = rax; 43 | 44 | rax = 0x80000000; 45 | asm volatile("cpuid" : "+a"(rax), "+b"(rbx), "+c"(rcx), "+d"(rdx)); 46 | printf("Highest extended leaf: 0x%zx\n", rax); 47 | int emax = rax; 48 | 49 | for(int i = 0; i < max; i++) { 50 | rax = i; 51 | asm volatile("cpuid" : "+a"(rax), "+b"(rbx), "+c"(rcx), "+d"(rdx)); 52 | cpuid_cache[i][0] = rax; 53 | cpuid_cache[i][1] = rbx; 54 | cpuid_cache[i][2] = rcx; 55 | cpuid_cache[i][3] = rdx; 56 | } 57 | for(int i = 0x80000000; i < emax; i++) { 58 | rax = i; 59 | asm volatile("cpuid" : "+a"(rax), "+b"(rbx), "+c"(rcx), "+d"(rdx)); 60 | cpuid_ecache[i - 0x80000000][0] = rax; 61 | cpuid_ecache[i - 0x80000000][1] = rbx; 62 | cpuid_ecache[i - 0x80000000][2] = rcx; 63 | cpuid_ecache[i - 0x80000000][3] = rdx; 64 | } 65 | } 66 | 67 | static int fixcpuid_handler(int signal, siginfo_t *info, void *ctx) { 68 | if(info->si_code != SI_KERNEL) return 0; 69 | 70 | if(*(uint16_t*)GET_REG(ctx, IP) != 0xa20f) return 0; // ignore if not cpuid opcode 71 | 72 | uint64_t rax, rbx, rcx, rdx; 73 | rax = GET_REG(ctx, AX); 74 | rcx = GET_REG(ctx, CX); 75 | 76 | debug(TAG "CPUID call: leaf=%zd, subleaf=%zd\n", rax, rcx); 77 | 78 | #if defined(MODE_CACHE) 79 | size_t index = rax; 80 | if(index >= 0x80000000) { 81 | rax = cpuid_ecache[index - 0x80000000][0]; 82 | rbx = cpuid_ecache[index - 0x80000000][1]; 83 | rcx = cpuid_ecache[index - 0x80000000][2]; 84 | rdx = cpuid_ecache[index - 0x80000000][3]; 85 | } else { 86 | rax = cpuid_cache[index][0]; 87 | rbx = cpuid_cache[index][1]; 88 | rcx = cpuid_cache[index][2]; 89 | rdx = cpuid_cache[index][3]; 90 | } 91 | #else 92 | ioctl(fixcpuid_fd, FIXCPUID_IOCTL_CMD_TRAP_CPUID, 0); 93 | asm volatile("rdrand %%rcx" : : : "rcx"); 94 | asm volatile("cpuid" : "+a"(rax), "+b"(rbx), "+c"(rcx), "+d"(rdx)); 95 | ioctl(fixcpuid_fd, FIXCPUID_IOCTL_CMD_TRAP_CPUID, 1); 96 | #endif 97 | 98 | GET_REG(ctx, IP) += 2; // skip cpuid 99 | GET_REG(ctx, AX) = rax; 100 | GET_REG(ctx, BX) = rbx; 101 | GET_REG(ctx, CX) = rcx; 102 | GET_REG(ctx, DX) = rdx; 103 | return 1; 104 | } 105 | 106 | 107 | void __attribute__((constructor)) _cpuidifx() { 108 | if(!fixcpuid_fd) fixcpuid_fd = open(FIXCPUID_DEVICE_PATH, O_RDONLY); 109 | if(fixcpuid_fd == -1) { 110 | debug(TAG "Could not init kernel module, did you load it?\n"); 111 | } 112 | 113 | debug(TAG "Init\n"); 114 | #if defined(MODE_CACHE) 115 | cache_all_leaves(); 116 | #endif 117 | 118 | ioctl(fixcpuid_fd, FIXCPUID_IOCTL_CMD_TRAP_CPUID, 1); 119 | 120 | struct sigaction sa = { 121 | .sa_sigaction = (void*)fixcpuid_handler, 122 | .sa_flags = SA_SIGINFO, 123 | }; 124 | 125 | sigaction(SIGSEGV, &sa, NULL); 126 | 127 | sigset_t sigset; 128 | sigemptyset(&sigset); 129 | sigaddset(&sigset, SIGSEGV); 130 | sigprocmask(SIG_UNBLOCK, &sigset, NULL); 131 | 132 | debug(TAG "Init done\n"); 133 | } 134 | 135 | void __attribute__((destructor)) _cpuidifx_done() { 136 | debug(TAG "Cleanup\n"); 137 | ioctl(fixcpuid_fd, FIXCPUID_IOCTL_CMD_TRAP_CPUID, 0); 138 | debug(TAG "Goodbye!\n"); 139 | } 140 | 141 | -------------------------------------------------------------------------------- /use_cases/cpuidtrap/module/Makefile: -------------------------------------------------------------------------------- 1 | obj-m += fixcpuid.o 2 | ccflags-y += -Wno-unused-result 3 | all: fixcpuid.c 4 | make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules 5 | clean: 6 | make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean 7 | 8 | 9 | -------------------------------------------------------------------------------- /use_cases/cpuidtrap/module/fixcpuid.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include "fixcpuid.h" 10 | 11 | MODULE_AUTHOR(""); 12 | MODULE_DESCRIPTION("Device to trap CPUID"); 13 | MODULE_LICENSE("GPL"); 14 | 15 | #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0) 16 | #define from_user raw_copy_from_user 17 | #define to_user raw_copy_to_user 18 | #else 19 | #define from_user copy_from_user 20 | #define to_user copy_to_user 21 | #endif 22 | 23 | static bool device_busy = false; 24 | 25 | 26 | static int device_open(struct inode *inode, struct file *file) { 27 | int j; 28 | /* Check if device is busy */ 29 | if (device_busy == true) { 30 | return -EBUSY; 31 | } 32 | 33 | /* Lock module */ 34 | try_module_get(THIS_MODULE); 35 | 36 | device_busy = true; 37 | 38 | return 0; 39 | } 40 | 41 | static int device_release(struct inode *inode, struct file *file) { 42 | /* Unlock module */ 43 | device_busy = false; 44 | 45 | module_put(THIS_MODULE); 46 | 47 | return 0; 48 | } 49 | 50 | static long device_ioctl(struct file *file, unsigned int ioctl_num, unsigned long ioctl_param) { 51 | int j; 52 | size_t start, end, sum = 0; 53 | switch (ioctl_num) { 54 | case FIXCPUID_IOCTL_CMD_TRAP_CPUID: 55 | { 56 | size_t val; 57 | rdmsrl(0x140, val); 58 | val = (val & ~(size_t)1) | (ioctl_param & 1); 59 | wrmsrl(0x140, val); 60 | return 0; 61 | } 62 | default: 63 | return -1; 64 | } 65 | 66 | return 0; 67 | } 68 | 69 | static struct file_operations f_ops = {.unlocked_ioctl = device_ioctl, 70 | .open = device_open, 71 | .release = device_release}; 72 | 73 | static struct miscdevice misc_dev = { 74 | .minor = MISC_DYNAMIC_MINOR, 75 | .name = FIXCPUID_DEVICE_NAME, 76 | .fops = &f_ops, 77 | .mode = S_IRWXUGO, 78 | }; 79 | 80 | int init_module(void) { 81 | int r; 82 | 83 | /* Register device */ 84 | r = misc_register(&misc_dev); 85 | if (r != 0) { 86 | printk(KERN_ALERT "[fixcpuid-module] Failed registering device with %d\n", r); 87 | return 1; 88 | } 89 | 90 | printk(KERN_INFO "[fixcpuid-module] Loaded.\n"); 91 | 92 | return 0; 93 | } 94 | 95 | void cleanup_module(void) { 96 | misc_deregister(&misc_dev); 97 | 98 | printk(KERN_INFO "[fixcpuid-module] Removed.\n"); 99 | } 100 | 101 | 102 | -------------------------------------------------------------------------------- /use_cases/cpuidtrap/module/fixcpuid.h: -------------------------------------------------------------------------------- 1 | #ifndef FIXCPUID_MODULE_H 2 | #define FIXCPUID_MODULE_H 3 | 4 | #include 5 | 6 | #define FIXCPUID_DEVICE_NAME "fixcpuid" 7 | #define FIXCPUID_DEVICE_PATH "/dev/" FIXCPUID_DEVICE_NAME 8 | 9 | #define FIXCPUID_IOCTL_MAGIC_NUMBER (long)0xc1d 10 | 11 | #define FIXCPUID_IOCTL_CMD_TRAP_CPUID \ 12 | _IOR(FIXCPUID_IOCTL_MAGIC_NUMBER, 1, size_t) 13 | 14 | 15 | 16 | #endif // FIXCPUID_MODULE_H 17 | -------------------------------------------------------------------------------- /use_cases/cpuidtrap/test.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | uint64_t rdtscnf() { 7 | uint64_t a, d; 8 | asm volatile("rdtscp" : "=a"(a), "=d"(d) :: "rcx"); 9 | a = (d << 32) | a; 10 | return a; 11 | } 12 | 13 | #define AVERAGE 100000 14 | 15 | size_t measurements[AVERAGE]; 16 | 17 | size_t mean(size_t* val, size_t len) { 18 | size_t sum = 0; 19 | for(size_t i = 0; i < len; i++) { 20 | sum += val[i]; 21 | } 22 | return sum / len; 23 | } 24 | 25 | double standard_error(size_t* val, size_t len) { 26 | size_t m = mean(val, len); 27 | size_t err_sum = 0; 28 | for(size_t i = 0; i < len; i++) { 29 | err_sum += (val[i] - m) * (val[i] - m); 30 | } 31 | double stddev = sqrt((double)err_sum / (double)(len - 1)); 32 | printf("sqrt(%f) = %f\n", (double)err_sum / (double)(len - 1), stddev); 33 | return stddev / sqrt(len); 34 | } 35 | 36 | int main() { 37 | printf("hi!\n"); 38 | 39 | printf("Brand string: \n"); 40 | unsigned int model; 41 | int name[4] = {0, 0, 0, 0}; 42 | __cpuid(0, model, name[0], name[2], name[1]); 43 | printf("%s\n", name); 44 | 45 | printf("\nNow benchmarking\n"); 46 | 47 | for(int i = 0; i < AVERAGE; i++) { 48 | size_t start = rdtscnf(); 49 | // asm volatile("cpuid" : : "a"(0), "b"(0), "c"(0), "d"(0)); 50 | __cpuid(0, model, name[0], name[2], name[1]); 51 | size_t end = rdtscnf(); 52 | measurements[i] = end - start; 53 | } 54 | printf("CPUID took %zd cycles (+/- %.1f)\n", mean(measurements, AVERAGE), standard_error(measurements, AVERAGE)); 55 | printf("done\n"); 56 | return 0; 57 | } 58 | --------------------------------------------------------------------------------