By now, you have probably heard plenty about the Spectre and Meltdown exploits that affect many modern processors. The Meltdown exploit (CVE-2017-5754) in particular only affects Intel processors.
Microsoft has already patched most of their client and server operating systems to mitigate against Meltdown. Depending on the exact model of Intel processor you are using, the Microsoft operating system patch will take advantage of processor support for two specific features and instructions which help minimize the performance impact of the operating system patch for Meltdown by using kernel page-table isolation.
These two instructions are process-context identifiers (PCID) and invalidate process-context identifiers (INVPCID). If your Intel processor supports both of these instructions, then the patched version of Windows will take advantage of that to give you better performance than you would otherwise get without those two instructions.
I have previously written about how to use PowerShell to check your Meltdown and Spectre mitigation status in Windows. Using that PowerShell module will give you a complete view of your Meltdown and Spectre mitigation status.
If your Intel processor supports both PCID and INVPCID, then you will see this message at the bottom of the PowerShell results:
Windows OS support for PCID performance optimization is enabled: True [not required for security]
Another way to check what features that your processor supports (whether it is AMD or Intel) is the Coreinfo v3.31 tool from Microsoft. You need to download the zip file, and then unzip it and copy the coreinfo.exe file to where you want it.
You can then simply use a command prompt to run Coreinfo –f > CoreInfoResults.txt to dump the core feature information for the processor to a text file in the same directory as the coreinfo.exe file as you see in Figure 1.
Figure 1: Running Coreinfo with the –f flag and saving the results to a text file
If your Intel processor supports the PCID feature and the INVPCID instruction, you will see an asterisk in the result (which is towards the bottom of the file), as you see below:
PCID * Supports PCIDs and settable CR4.PCIDE
INVPCID * Supports INVPCID instruction
If your Intel processor does not support either or both of the PCID feature and the INVPCID instruction, you will see a dash in the result, as you see below:
PCID – Supports PCIDs and settable CR4.PCIDE
INVPCID – Supports INVPCID instruction
It is possible to for a processor to support PCID and not support INVPCID. My understanding from the Microsoft Powershell code is that you need both to get Windows OS support for the PCID performance optimization.
From what information that I have been able to dig up (and from also asking a source at Intel), PCID is supported in some Westmere family and most Sandy Bridge family processors, with server processors getting support before client processors. According to Intel documentation, INVPCID support was introduced in the Haswell family processors.
This means you will get Windows OS support for the PCID performance optimization in Intel Xeon E5-2600 v3 product family (Haswell-EP) and later processors, along with the Intel Xeon E7 v3 product family (Haswell-EX) and later processors.
In my mind, this is even more justification for a new server or hopefully a complete data platform upgrade, where you get a brand new server running Windows Server 2016, along with SQL Server 2017. If you are thinking along the same lines, SQLskills can help you plan and implement an upgrade and migration.
I ran CoreInfo on every Intel client machine that I own (a total of 16 machines, which is way too many)! The oldest is a 2008-vintage Intel Core2 Quad Q9550 (Yorkfield), which as expected, has neither PCID or INVPCID support. The next oldest is a 2009-vintage Intel Core i7-720QM (Clarksfield) which also has neither PCID or INVPCID support. I don’t have any Nehalem or Westmere machines.
After that, my oldest machine is a Q1 2011-vintage Intel Core i7-2600K (Sandy Bridge), which has PCID support, but does not have INVPCID support. The situation is the same for a Q1 2012-vintage Intel Core i7-3770K (Ivy Bridge) which has PCID support, but does not have INVPCID support.
With a Q2 2013-vintage Intel Core i5-4670K (Haswell), we finally get both PCID and INVPCID support. My newest Intel machine has a Q4 2017-vintage Intel Core i7-8700K (Coffee Lake) which also has both PCID and INVPCID support.
4 thoughts on “Checking Your Intel Processor Features Regarding the Meltdown Exploit”
An important issue that seems to have gone unreported, including by Microsoft, is there are a whole host of low-end, low power Intel processors that are still being sold and have no PCID support, let alone INVPCID.
Airmont Atom, Celeron and Pentium SKUs, for example, have been deployed in huge numbers by businesses, schools, etc, and face significant slowdowns on top of already miserable performance. Even Goldmont models don’t support INVPCID – they may also not even support PCID, but I don’t have hardware available to test at the moment.
You are right. Goldmount doesn’t have support for PCID so also not INVPCID. I’ve just checked my J3455 Celeron (inside Apollo Lake Intel NUC).
actually microsoft has NOT patched Meltdown CVE 2017-5754 on x86 systems (32bit) yet.
only x64 bit systems to be protected…. for Meltdown (as long as your antivirus is compatible too)
What I would like to know is which OS’s actually support PCID / INVPCID if you have it… as it seems windows 7 might not support it anyway.
I have a i7-3770s (the low power version) and it also has PCID = yes, but INVPCID = no
It is a nice CPU and machine for running some (Hyper-V) VMs, but obviously now getting too old…. 🙁