Reverse Engineering DVFS Mechanisms

Dynamic Voltage and Frequency Scaling (DVFS) provides superlinear power savings to computer systems by lowering supply voltage and clock frequency when processors wait for other systems components such as memory and I/O, in addition to enforcing thermal chip constraints. More recent DVFS mechanisms are managed fully in hardware to reduce response times, but existing analysis specific to hardware-managed DVFS is lacking. In this study, we aim to reconstruct the DVFS mechanism implemented in modern hardware by constructing a custom high frequency sampling mechanism using a Linux kernel module that enables flexible and low overhead sampling of Model-Specific Registers (MSRs) derived from the power management mechanism. We study an extensive reverse engineering of Intel Core 3100 U's DVFS mechanism. Our study reveals two novel findings: (1) the mapping from abstract firmware standards to an Intel-specific implementation of fixed voltage-frequency states and (2) the function of undocumented bits in an MSR. We then demonstrate that we are able to perform a model stealing attack through a variety of machine-learned proxy models based on access to relevant hardware with <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$99 \% R^{2}$</tex> coefficient for regression models and up to 92 % F1 score for a classifier.