CPUID

X86 instruction

Este artículo debe actualizarse . Actualice este artículo para reflejar los eventos recientes o la información disponible recientemente. ( Julio de 2014 )

En la arquitectura x86 , la instrucción CPUID (identificada por un CPUID código de operación ) es una instrucción suplementaria del procesador (su nombre se deriva de CPU IDentification) que permite al software descubrir detalles del procesador. Fue introducido por Intel en 1993 con el lanzamiento de los procesadores Pentium y 486 mejorados con SL . ^[1]

Un programa puede utilizar CPUIDpara determinar el tipo de procesador y si se implementan funciones como MMX / SSE .

Historia

Antes de la disponibilidad general de la CPUIDinstrucción, los programadores escribirían código de máquina esotérico que explotaba diferencias menores en el comportamiento de la CPU para determinar la marca y el modelo del procesador. ^{[2] [3]} Con la introducción del procesador 80386, EDX en el reinicio indicaba la revisión, pero esto solo se podía leer después del reinicio y no había una forma estándar para que las aplicaciones leyeran el valor.

Fuera de la familia x86, los desarrolladores todavía deben usar procesos esotéricos (que involucran tiempos de instrucción o desencadenantes de fallas de la CPU) para determinar las variaciones en el diseño de la CPU que están presentes.

En la familia Motorola 680x0, que nunca tuvo una instrucción CPUID de ningún tipo, ciertas instrucciones específicas requerían privilegios elevados. Estos podrían usarse para diferenciar a varios miembros de la familia de CPU. En el Motorola 68010 se privilegió la instrucción MOVE de SR . Este notable cambio de instrucción (y máquina de estado) permitió que el 68010 cumpliera con los requisitos de virtualización de Popek y Goldberg . Debido a que el 68000 ofrecía un MOVE sin privilegios de SR, las 2 CPU diferentes podían distinguirse mediante la activación de una condición de error de la CPU.

Si bien la CPUIDinstrucción es específica de la arquitectura x86, otras arquitecturas (como ARM) a menudo proporcionan registros en el chip que se pueden leer de formas prescritas para obtener el mismo tipo de información proporcionada por la instrucción CPUID x86.

Llamando CPUID

El CPUIDcódigo de operación es 0Fh, A2h (como dos bytes o A20Fh como una sola palabra ).

En lenguaje ensamblador , la CPUIDinstrucción no toma parámetros ya que CPUIDimplícitamente usa el registro EAX para determinar la categoría principal de información devuelta. En la terminología más reciente de Intel, esto se denomina hoja CPUID. CPUIDdebe llamarse con EAX = 0primero, ya que esto almacenará en el registro EAX el parámetro de llamada EAX más alto (hoja) que implemente la CPU.

Para obtener información de función extendida, se CPUIDdebe llamar con el bit más significativo del conjunto EAX. Para determinar el parámetro de llamada de función extendida más alto, llame CPUIDcon EAX = 80000000h.

Las hojas de CPUID mayores que 3 pero menos de 80000000 son accesibles solo cuando los registros específicos del modelo tienen IA32_MISC_ENABLE.BOOT_NT4 [bit 22] = 0 (que es así por defecto). Como sugiere el nombre, Windows NT 4.0 hasta SP6 no arrancaba correctamente a menos que se estableciera este bit, ^{[4] [ enlace muerto ]} pero las versiones posteriores de Windows no lo necesitan, por lo que las hojas básicas superiores a 4 se pueden asumir visibles en Windows actual sistemas. A julio de 2014 ^[update], las licencias básicas válidas van hasta las 14h, pero la información devuelta por algunas licencias no se divulga en la documentación disponible públicamente, es decir, están "reservadas".

Algunas de las hojas agregadas más recientemente también tienen subhojas, que se seleccionan a través del registro ECX antes de llamar a CPUID.

EAX = 0: Parámetro de función más alto e ID de fabricante

Esto devuelve la cadena de identificación del fabricante de la CPU, una cadena ASCII de doce caracteres almacenada en EBX, EDX, ECX (en ese orden). El parámetro de llamada básico más alto (el valor más alto al que se puede establecer EAX antes de llamar CPUID) se devuelve en EAX.

Aquí hay una lista de procesadores y la función más alta implementada.

Parámetro de función más alto

Procesadores	Básico	Extendido
A principios de Intel 486	CPUID no implementado
Posteriormente Intel 486 y Pentium	0x01	No se ha implementado
Pentium Pro , Pentium II y Celeron	0x02	No se ha implementado
Pentium III	0x03	No se ha implementado
Pentium 4	0x02	0x8000 0004
Xeon	0x02	0x8000 0004
Pentium M	0x02	0x8000 0004
Pentium 4 con Hyper-Threading	0x05	0x8000 0008
Pentium D (8xx)	0x05	0x8000 0008
Pentium D (9xx)	0x06	0x8000 0008
Core Duo	0x0A	0x8000 0008
2 núcleos, duales	0x0A	0x8000 0008
Xeon 3000 , 5100, 5200, 5300, 5400 ( serie 5000 )	0x0A	0x8000 0008
Serie Core 2 Duo 8000	0x0D	0x8000 0008
Serie Xeon 5200, 5400	0x0A	0x8000 0008
Átomo	0x0A	0x8000 0008
Procesadores basados ​​en Nehalem	0x0B	0x8000 0008
Procesadores basados ​​en Ivy Bridge	0x0D	0x8000 0008
Procesadores basados ​​en Skylake (proc base y max freq; bus ref. Freq)	0x16	0x8000 0008
Hoja principal de enumeración de atributos de proveedor de System-on-Chip	0x17	0x8000 0008

Las siguientes son cadenas de ID de fabricante de procesador conocidas:

• "¡AMDisbetter!"  - muestras de ingeniería temprana de AMD K5 procesador
• "AuthenticAMD"  : AMD
• "CentaurHauls" – IDT WinChip/Centaur (Including some VIA CPU)
• "CyrixInstead" – Cyrix/early STMicroelectronics and IBM
• "GenuineIntel" – Intel
• "TransmetaCPU" – Transmeta
• "GenuineTMx86" – Transmeta
• "Geode by NSC" – National Semiconductor
• "NexGenDriven" – NexGen
• "RiseRiseRise" – Rise
• "SiS SiS SiS " – SiS
• "UMC UMC UMC " – UMC
• "VIA VIA VIA " – VIA
• "Vortex86 SoC" – DM&P Vortex
• "  Shanghai  " – Zhaoxin
• "HygonGenuine" – Hygon
• "E2K MACHINE" – MCST Elbrus

The following are ID strings used by open source soft CPU cores:

• "GenuineAO486" – ao486 CPU^[5]
• "GenuineIntel" – v586 core^[6] (this is identical to the Intel ID string)

The following are known ID strings from virtual machines:

• "bhyve bhyve " – bhyve
• " KVMKVMKVM " – KVM
• "TCGTCGTCGTCG" – QEMU
• "Microsoft Hv" – Microsoft Hyper-V or Windows Virtual PC
• " lrpepyh vr" – Parallels (it possibly should be "prl hyperv ", but it is encoded as " lrpepyh vr" due to an endianness mismatch)
• "VMwareVMware" – VMware
• "XenVMMXenVMM" – Xen HVM
• "ACRNACRNACRN" – Project ACRN
• " QNXQVMBSQG " – QNX Hypervisor
• "VirtualApple" – Apple Rosetta
• "GenuineIntel" – Apple Rosetta 2 ^[7]

For instance, on a GenuineIntel processor values returned in EBX is 0x756e6547, EDX is 0x49656e69 and ECX is 0x6c65746e. The following code is written in GNU Assembler for the x86-64 architecture and displays the vendor ID string as well as the highest calling parameter that the CPU implements.

.datas0:.asciz"CPUID: %x\n"s1:.asciz"Largest basic function number implemented: %i\n"s2:.asciz"Vendor ID: %.12s\n".text.align32.globlmainmain:pushq%rbpmovq%rsp,%rbpsubq$16,%rspmovl$1,%eaxcpuidmovq$s0,%rdimovl%eax,%esixorl%eax,%eaxcallprintfpushq%rbx // -fPICxorl%eax,%eaxcpuidmovl%ebx,0(%rsp)movl%edx,4(%rsp)movl%ecx,8(%rsp)popq%rbx // -fPICmovq$s1,%rdimovl%eax,%esixorl%eax,%eaxcallprintfmovq$s2,%rdimovq%rsp,%rsixorl%eax,%eaxcallprintfmovq%rbp,%rsppopq%rbp//	retmovl$1,%eaxint$0x80

EAX=1: Processor Info and Feature Bits

This returns the CPU's stepping, model, and family information in register EAX (also called the signature of a CPU), feature flags in registers EDX and ECX, and additional feature info in register EBX.^[8]

Processor Version Information

EAX
31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Reserved				Extended Family ID								Extended Model ID				Reserved		Processor Type		Family ID				Model				Stepping ID

• Stepping ID is a product revision number assigned due to fixed errata or other changes.

• The actual processor model is derived from the Model, Extended Model ID and Family ID fields. If the Family ID field is either 6 or 15, the model is equal to the sum of the Extended Model ID field shifted left by 4 bits and the Model field. Otherwise, the model is equal to the value of the Model field.

• The actual processor family is derived from the Family ID and Extended Family ID fields. If the Family ID field is equal to 15, the family is equal to the sum of the Extended Family ID and the Family ID fields. Otherwise, the family is equal to value of the Family ID field.

• The meaning of the Processor Type field is given by the table below.

Processor Type

Type	Encoding in Binary
Original equipment manufacturer (OEM) Processor	00
Intel Overdrive Processor	01
Dual processor (not applicable to Intel486 processors)	10
Reserved value	11

Additional Information

Bits	EBX	Valid
7:0	Brand Index
15:8	CLFLUSH line size (Value . 8 = cache line size in bytes)	if CLFLUSH feature flag is set. CPUID.01.EDX.CLFSH [bit 19]= 1
23:16	Maximum number of addressable IDs for logical processors in this physical package; The nearest power-of-2 integer that is not smaller than this value is the number of unique initial APIC IDs reserved for addressing different logical processors in a physical package. Former use: Number of logical processors per physical processor; two for the Pentium 4 processor with Hyper-Threading Technology.[9]	if Hyper-threading feature flag is set. CPUID.01.EDX.HTT [bit 28]= 1
31:24	Local APIC ID: The initial APIC-ID is used to identify the executing logical processor. It can also be identified via the cpuid 0BH leaf ( CPUID.0Bh.EDX[x2APIC-ID] ).	Pentium 4 and subsequent processors.

The processor info and feature flags are manufacturer specific but usually the Intel values are used by other manufacturers for the sake of compatibility.

Feature Information

Bit	EDX		ECX
	Short	Feature	Short	Feature
0	fpu	Onboard x87 FPU	sse3	Prescott New Instructions-SSE3 (PNI)
1	vme	Virtual 8086 mode extensions (such as VIF, VIP, PIV)	pclmulqdq	PCLMULQDQ
2	de	Debugging extensions (CR4 bit 3)	dtes64	64-bit debug store (edx bit 21)
3	pse	Page Size Extension	monitor	MONITOR and MWAIT instructions (SSE3)
4	tsc	Time Stamp Counter	ds-cpl	CPL qualified debug store
5	msr	Model-specific registers	vmx	Virtual Machine eXtensions
6	pae	Physical Address Extension	smx	Safer Mode Extensions (LaGrande)
7	mce	Machine Check Exception	est	Enhanced SpeedStep
8	cx8	CMPXCHG8 (compare-and-swap) instruction	tm2	Thermal Monitor 2
9	apic	Onboard Advanced Programmable Interrupt Controller	ssse3	Supplemental SSE3 instructions
10	(reserved)		cnxt-id	L1 Context ID
11	sep	SYSENTER and SYSEXIT instructions	sdbg	Silicon Debug interface
12	mtrr	Memory Type Range Registers	fma	Fused multiply-add (FMA3)
13	pge	Page Global Enable bit in CR4	cx16	CMPXCHG16B instruction
14	mca	Machine check architecture	xtpr	Can disable sending task priority messages
15	cmov	Conditional move and FCMOV instructions	pdcm	Perfmon & debug capability
16	pat	Page Attribute Table	(reserved)
17	pse-36	36-bit page size extension	pcid	Process context identifiers (CR4 bit 17)
18	psn	Processor Serial Number	dca	Direct cache access for DMA writes[10][11]
19	clfsh	CLFLUSH instruction (SSE2)	sse4.1	SSE4.1 instructions
20	(reserved)		sse4.2	SSE4.2 instructions
21	ds	Debug store: save trace of executed jumps	x2apic	x2APIC
22	acpi	Onboard thermal control MSRs for ACPI	movbe	MOVBE instruction (big-endian)
23	mmx	MMX instructions	popcnt	POPCNT instruction
24	fxsr	FXSAVE, FXRESTOR instructions, CR4 bit 9	tsc-deadline	APIC implements one-shot operation using a TSC deadline value
25	sse	SSE instructions (a.k.a. Katmai New Instructions)	aes	AES instruction set
26	sse2	SSE2 instructions	xsave	XSAVE, XRESTOR, XSETBV, XGETBV
27	ss	CPU cache implements self-snoop	osxsave	XSAVE enabled by OS
28	htt	Hyper-threading	avx	Advanced Vector Extensions
29	tm	Thermal monitor automatically limits temperature	f16c	F16C (half-precision) FP feature
30	ia64	IA64 processor emulating x86	rdrnd	RDRAND (on-chip random number generator) feature
31	pbe	Pending Break Enable (PBE# pin) wakeup capability	hypervisor	Hypervisor present (always zero on physical CPUs)[12][13]

Reserved fields should be masked before using them for processor identification purposes.

EAX=2: Cache and TLB Descriptor information

This returns a list of descriptors indicating cache and TLB capabilities in EAX, EBX, ECX and EDX registers.

EAX=3: Processor Serial Number

See also: Pentium III § Controversy about privacy issues

This returns the processor's serial number. The processor serial number was introduced on Intel Pentium III, but due to privacy concerns, this feature is no longer implemented on later models (the PSN feature bit is always cleared). Transmeta's Efficeon and Crusoe processors also provide this feature. AMD CPUs however, do not implement this feature in any CPU models.

For Intel Pentium III CPUs, the serial number is returned in the EDX:ECX registers. For Transmeta Efficeon CPUs, it is returned in the EBX:EAX registers. And for Transmeta Crusoe CPUs, it is returned in the EBX register only.

Note that the processor serial number feature must be enabled in the BIOS setting in order to function.

EAX=4 and EAX=Bh: Intel thread/core and cache topology

These two leaves are used for processor topology (thread, core, package) and cache hierarchy enumeration in Intel multi-core (and hyperthreaded) processors.^[14] As of 2013^[update] AMD does not use these leaves but has alternate ways of doing the core enumeration.^[15]

Unlike most other CPUID leaves, leaf Bh will return different values in EDX depending on which logical processor the CPUID instruction runs; the value returned in EDX is actually the x2APIC id of the logical processor. The x2APIC id space is not continuously mapped to logical processors, however; there can be gaps in the mapping, meaning that some intermediate x2APIC ids don't necessarily correspond to any logical processor. Additional information for mapping the x2APIC ids to cores is provided in the other registers. Although the leaf Bh has sub-leaves (selected by ECX as described further below), the value returned in EDX is only affected by the logical processor on which the instruction is running but not by the subleaf.

The processor(s) topology exposed by leaf Bh is a hierarchical one, but with the strange caveat that the order of (logical) levels in this hierarchy doesn't necessarily correspond the order in the physical hierarchy (SMT/core/package). However, every logical level can be queried as an ECX subleaf (of the Bh leaf) for its correspondence to a "level type", which can be either SMT, core, or "invalid". The level id space starts at 0 and is continuous, meaning that if a level id is invalid, all higher level ids will also be invalid. The level type is returned in bits 15:08 of ECX, while the number of logical processors at the level queried is returned in EBX. Finally, the connection between these levels and x2APIC ids is returned in EAX[4:0] as the number of bits that the x2APIC id must be shifted in order to obtain a unique id at the next level.

As an example, a dual-core Westmere processor capable of hyperthreading (thus having two cores and four threads in total) could have x2APIC ids 0, 1, 4 and 5 for its four logical processors. Leaf Bh (=EAX), subleaf 0 (=ECX) of CPUID could for instance return 100h in ECX, meaning that level 0 describes the SMT (hyperthreading) layer, and return 2 in EBX because there are two logical processors (SMT units) per physical core. The value returned in EAX for this 0-subleaf should be 1 in this case, because shifting the aforementioned x2APIC ids to the right by one bit gives a unique core number (at the next level of the level id hierarchy) and erases the SMT id bit inside each core. A simpler way to interpret this information is that the last bit (bit number 0) of the x2APIC id identifies the SMT/hyperthreading unit inside each core in our example. Advancing to subleaf 1 (by making another call to CPUID with EAX=Bh and ECX=1) could for instance return 201h in ECX, meaning that this is a core-type level, and 4 in EBX because there are 4 logical processors in the package; EAX returned could be any value greater than 3, because it so happens that bit number 2 is used to identify the core in the x2APIC id. Note that bit number 1 of the x2APIC id is not used in this example. However EAX returned at this level could well be 4 (and it happens to be so on a Clarkdale Core i3 5x0) because that also gives a unique id at the package level (=0 obviously) when shifting the x2APIC id by 4 bits. Finally, you may wonder what the EAX=4 leaf can tell us that we didn't find out already. In EAX[31:26] it returns the APIC mask bits reserved for a package; that would be 111b in our example because bits 0 to 2 are used for identifying logical processors inside this package, but bit 1 is also reserved although not used as part of the logical processor identification scheme. In other words, APIC ids 0 to 7 are reserved for the package, even though half of these values don't map to a logical processor.

The cache hierarchy of the processor is explored by looking at the sub-leaves of leaf 4. The APIC ids are also used in this hierarchy to convey information about how the different levels of cache are shared by the SMT units and cores. To continue our example, the L2 cache, which is shared by SMT units of the same core but not between physical cores on the Westmere is indicated by EAX[26:14] being set to 1, while the information that the L3 cache is shared by the whole package is indicated by setting those bits to (at least) 111b. The cache details, including cache type, size, and associativity are communicated via the other registers on leaf 4.

Beware that older versions of the Intel app note 485 contain some misleading information, particularly with respect to identifying and counting cores in a multi-core processor;^[16] errors from misinterpreting this information have even been incorporated in the Microsoft sample code for using cpuid, even for the 2013 edition of Visual Studio,^[17] and also in the sandpile.org page for CPUID,^[18] but the Intel code sample for identifying processor topology^[14] has the correct interpretation, and the current Intel Software Developer’s Manual has more clear language. The (open source) cross-platform production code^[19] from Wildfire Games also implements the correct interpretation of the Intel documentation.

Topology detection examples involving older (pre-2010) Intel processors that lack x2APIC (thus don't implement the EAX=Bh leaf) are given in a 2010 Intel presentation.^[20] Beware that using that older detection method on 2010 and newer Intel processors may overestimate the number of cores and logical processors because the old detection method assumes there are no gaps in the APIC id space, and this assumption is violated by some newer processors (starting with the Core i3 5x0 series), but these newer processors also come with an x2APIC, so their topology can be correctly determined using the EAX=Bh leaf method.

EAX=6: Thermal and power management

This section needs expansion. You can help by adding to it. (April 2020)

EAX=7, ECX=0: Extended Features

This returns extended feature flags in EBX, ECX, and EDX. Returns the maximum ECX value for EAX=7 in EAX.

EAX=7 CPUID feature bits

Bit	EBX		ECX		EDX
	Short	Feature	Short	Feature	Short	Feature
0	fsgsbase	Access to base of %fs and %gs	prefetchwt1	PREFETCHWT1 instruction	(reserved)
1		IA32_TSC_ADJUST	avx512_vbmi	AVX-512 Vector Bit Manipulation Instructions	(reserved)
2	sgx	Software Guard Extensions	umip	User-mode Instruction Prevention	avx512_4vnniw	AVX-512 4-register Neural Network Instructions
3	bmi1	Bit Manipulation Instruction Set 1	pku	Memory Protection Keys for User-mode pages	avx512_4fmaps	AVX-512 4-register Multiply Accumulation Single precision
4	hle	TSX Hardware Lock Elision	ospke	PKU enabled by OS	fsrm	Fast Short REP MOVSB
5	avx2	Advanced Vector Extensions 2	waitpkg	Timed pause and user-level monitor/wait	(reserved)
6		FDP_EXCPTN_ONLY	avx512_vbmi2	AVX-512 Vector Bit Manipulation Instructions 2
7	smep	Supervisor Mode Execution Prevention	cet_ss	Control flow enforcement (CET) shadow stack
8	bmi2	Bit Manipulation Instruction Set 2	gfni	Galois Field instructions	avx512_vp2intersect	AVX-512 VP2INTERSECT Doubleword and Quadword Instructions
9	erms	Enhanced REP MOVSB/STOSB	vaes	Vector AES instruction set (VEX-256/EVEX)	SRBDS_CTRL	Special Register Buffer Data Sampling Mitigations
10	invpcid	INVPCID instruction	vpclmulqdq	CLMUL instruction set (VEX-256/EVEX)	md_clear	VERW instruction clears CPU buffers
11	rtm	TSX Restricted Transactional Memory	avx512_vnni	AVX-512 Vector Neural Network Instructions	(reserved)
12	pqm	Platform Quality of Service Monitoring	avx512_bitalg	AVX-512 BITALG instructions
13		FPU CS and FPU DS deprecated	(reserved)		tsx_force_abort
14	mpx	Intel MPX (Memory Protection Extensions)	avx512_vpopcntdq	AVX-512 Vector Population Count Double and Quad-word	SERIALIZE	Serialize instruction execution
15	pqe	Platform Quality of Service Enforcement	(reserved)		Hybrid
16	avx512_f	AVX-512 Foundation		5-level paging	TSXLDTRK	TSX suspend load address tracking
17	avx512_dq	AVX-512 Doubleword and Quadword Instructions	mawau	The value of userspace MPX Address-Width Adjust used by the BNDLDX and BNDSTX Intel MPX instructions in 64-bit mode	(reserved)
18	rdseed	RDSEED instruction			pconfig	Platform configuration (Memory Encryption Technologies Instructions)
19	adx	Intel ADX (Multi-Precision Add-Carry Instruction Extensions)			lbr	Architectural Last Branch Records
20	smap	Supervisor Mode Access Prevention			cet_ibt	Control flow enforcement (CET) indirect branch tracking
21	avx512_ifma	AVX-512 Integer Fused Multiply-Add Instructions			(reserved)
22	pcommit	PCOMMIT instruction	rdpid	Read Processor ID and IA32_TSC_AUX	amx-bf16	Tile computation on bfloat16 numbers
23	clflushopt	CLFLUSHOPT instruction	(reserved)		(reserved)
24	clwb	CLWB instruction	(reserved)		amx-tile	Tile architecture
25	intel_pt	Intel Processor Trace	cldemote	Cache line demote	amx-int8	Tile computation on 8-bit integers
26	avx512_pf	AVX-512 Prefetch Instructions	(reserved)		IBRS_IBPB / spec_ctrl	Speculation Control, part of Indirect Branch Control (IBC): Indirect Branch Restricted Speculation (IBRS) and Indirect Branch Prediction Barrier (IBPB)[21][22]
27	avx512_er	AVX-512 Exponential and Reciprocal Instructions	MOVDIRI		stibp	Single Thread Indirect Branch Predictor, part of IBC[21]
28	avx512_cd	AVX-512 Conflict Detection Instructions	MOVDIR64B		L1D_FLUSH	IA32_FLUSH_CMD MSR
29	sha	Intel SHA extensions	ENQCMD	Enqueue Stores	IA32_ARCH_CAPABILITIES	Speculative Side Channel Mitigations[21]
30	avx512_bw	AVX-512 Byte and Word Instructions	sgx_lc	SGX Launch Configuration	IA32_CORE_CAPABILITIES	Support for a MSR listing model-specific core capabilities
31	avx512_vl	AVX-512 Vector Length Extensions	pks	Protection keys for supervisor-mode pages	ssbd	Speculative Store Bypass Disable,[21] as mitigation for Speculative Store Bypass (IA32_SPEC_CTRL)

EAX=7, ECX=1: Extended Features

This returns extended feature flags in EAX.

EAX=7 CPUID feature bits

Bit	EAX
	Short	Feature
0	(reserved)
1	(reserved)
2	(reserved)
3	(reserved)
4	(reserved)
5	avx512_bf16	AVX-512 BFLOAT16 instructions
6	(reserved)
7	(reserved)
8	(reserved)
9	(reserved)
10	(reserved)
11	(reserved)
12	(reserved)
13	(reserved)
14	(reserved)
15	(reserved)
16	(reserved)
17	(reserved)
18	(reserved)
19	(reserved)
20	(reserved)
21	(reserved)
22	(reserved)
23	(reserved)
24	(reserved)
25	(reserved)
26	(reserved)
27	(reserved)
28	(reserved)
29	(reserved)
30	(reserved)
31	(reserved)

EAX=80000000h: Get Highest Extended Function Implemented

The highest calling parameter is returned in EAX.

EAX=80000001h: Extended Processor Info and Feature Bits

This returns extended feature flags in EDX and ECX.

AMD feature flags are as follows:^[23][24]

EAX=80000001h CPUID feature bits

Bit	EDX		ECX
	Short	Feature	Short	Feature
0	fpu	Onboard x87 FPU	lahf_lm	LAHF/SAHF in long mode
1	vme	Virtual mode extensions (VIF)	cmp_legacy	Hyperthreading not valid
2	de	Debugging extensions (CR4 bit 3)	svm	Secure Virtual Machine
3	pse	Page Size Extension	extapic	Extended APIC space
4	tsc	Time Stamp Counter	cr8_legacy	CR8 in 32-bit mode
5	msr	Model-specific registers	abm	Advanced bit manipulation (lzcnt and popcnt)
6	pae	Physical Address Extension	sse4a	SSE4a
7	mce	Machine Check Exception	misalignsse	Misaligned SSE mode
8	cx8	CMPXCHG8 (compare-and-swap) instruction	3dnowprefetch	PREFETCH and PREFETCHW instructions
9	apic	Onboard Advanced Programmable Interrupt Controller	osvw	OS Visible Workaround
10	(reserved)		ibs	Instruction Based Sampling
11	syscall	SYSCALL and SYSRET instructions	xop	XOP instruction set
12	mtrr	Memory Type Range Registers	skinit	SKINIT/STGI instructions
13	pge	Page Global Enable bit in CR4	wdt	Watchdog timer
14	mca	Machine check architecture	(reserved)
15	cmov	Conditional move and FCMOV instructions	lwp	Light Weight Profiling[25]
16	pat	Page Attribute Table	fma4	4 operands fused multiply-add
17	pse36	36-bit page size extension	tce	Translation Cache Extension
18	(reserved)
19	mp	Multiprocessor Capable	nodeid_msr	NodeID MSR
20	nx	NX bit	(reserved)
21	(reserved)		tbm	Trailing Bit Manipulation
22	mmxext	Extended MMX	topoext	Topology Extensions
23	mmx	MMX instructions	perfctr_core	Core performance counter extensions
24	fxsr	FXSAVE, FXRSTOR instructions, CR4 bit 9	perfctr_nb	NB performance counter extensions
25	fxsr_opt	FXSAVE/FXRSTOR optimizations	(reserved)
26	pdpe1gb	Gigabyte pages	dbx	Data breakpoint extensions
27	rdtscp	RDTSCP instruction	perftsc	Performance TSC
28	(reserved)		pcx_l2i	L2I perf counter extensions
29	lm	Long mode	(reserved)
30	3dnowext	Extended 3DNow!	(reserved)
31	3dnow	3DNow!	(reserved)

EAX=80000002h,80000003h,80000004h: Processor Brand String

These return the processor brand string in EAX, EBX, ECX and EDX. CPUID must be issued with each parameter in sequence to get the entire 48-byte null-terminated ASCII processor brand string.^[26] It is necessary to check whether the feature is present in the CPU by issuing CPUID with EAX = 80000000h first and checking if the returned value is greater or equal to 80000004h.

#include <cpuid.h> // GCC-provided#include <stdio.h>#include <stdint.h>int main(void) {   uint32_t brand[12];   if (!__get_cpuid_max(0x80000004, NULL)) { fprintf(stderr, "Feature not implemented."); return 2; }   __get_cpuid(0x80000002, brand+0x0, brand+0x1, brand+0x2, brand+0x3); __get_cpuid(0x80000003, brand+0x4, brand+0x5, brand+0x6, brand+0x7); __get_cpuid(0x80000004, brand+0x8, brand+0x9, brand+0xa, brand+0xb);   printf("Brand: %s\n", brand);}

EAX=80000005h: L1 Cache and TLB Identifiers

This function contains the processor’s L1 cache and TLB characteristics.

EAX=80000006h: Extended L2 Cache Features

Returns details of the L2 cache in ECX, including the line size in bytes (Bits 07 - 00), type of associativity (encoded by a 4 bits field; Bits 15 - 12) and the cache size in KB (Bits 31 - 16).

#include <cpuid.h> // GCC-provided#include <stdio.h>#include <stdint.h>int main(void) { uint32_t eax, ebx, ecx, edx;   if (__get_cpuid(0x80000006, &eax, &ebx, &ecx, &edx)) {       printf("Line size: %d B, Assoc. Type: %d; Cache Size: %d KB.\n", ecx & 0xff, (ecx >> 12) & 0x07, (ecx >> 16) & 0xffff); return 0; } else { fputs(stderr, "CPU does not support 0x80000006"); return 2; }}

EAX=80000007h: Advanced Power Management Information

This function provides advanced power management feature identifiers. EDX bit 8 indicates support for invariant TSC.

EAX=80000008h: Virtual and Physical address Sizes

Returns largest virtual and physical address sizes in EAX.

• Bits 07-00: #Physical Address Bits.
• Bits 15-8: #Linear Address Bits.
• Bits 31-16: Reserved = 0.

It could be used by the hypervisor in a virtual machine system to report physical/virtual address sizes possible with the virtual CPU.

EBX is used for features：

• Bit 0: CLZERO, Clear cache line with address in RAX.
• Bit 4: RDPRU, Read MPERF or APERF from ring 3.
• Bit 8: MCOMMIT, commit stores to memory. For memory fencing and retrieving ECC errors.
• Bit 9: WBNOINVD, Write Back and Do Not Invalidate Cache.

ECX provides core count.

• Bits 07-00: #Physical Cores minus one.
• Bits 11-8: Reserved = 0.
• Bits 15-12: #APIC ID Bits. 2 raised to this power would be the physical core count, as long as it's non-zero.
• Bits 17-16: Performance time-stamp counter size.
• Bits 31-18: Reserved = 0.

EDX provides information specific to RDPRU (the maximum register identifier allowed) in 31-16. The current number as of Zen 2 is 1 for MPERF and APERF.

EAX=8FFFFFFFh: AMD Easter Egg

Specific to AMD K7 and K8 CPUs, this returns the string "IT'S HAMMER TIME" in EAX, EBX, ECX and EDX,^[27] a reference to the MC Hammer song U Can't Touch This.

CPUID usage from high-level languages

Inline assembly

This information is easy to access from other languages as well. For instance, the C code for gcc below prints the first five values, returned by the cpuid:

#include <stdio.h>/* This works on 32 and 64-bit systems. See [[Inline assembler#In actual compilers]] for hints on reading this code. */int main(){ /* The four registers do not need to be initialized as the processor will write over it. */ int infotype, a, b, c, d; for (infotype = 0; infotype < 5; infotype ++) { __asm__("cpuid"           : "=a" (a), "=b" (b), "=c" (c), "=d" (d) // The output variables. EAX -> a and vice versa. : "0" (infotype)); // Put the infotype into EAX. printf ("InfoType %x\nEAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n", infotype, a, b, c, d); } return 0;}

In MSVC and Borland/Embarcadero C compilers (bcc32) flavored inline assembly, the clobbering information is implicit in the instructions:

#include <stdio.h>int main(){ unsigned int InfoType = 0; unsigned int a, b, c, d; __asm { /* Do the call. */ mov EAX, InfoType; cpuid; /* Save results. */ mov a, EAX; mov b, EBX; mov c, ECX; mov d, EDX; } printf ("InfoType %x\nEAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n", InfoType, a, b, c, d); return 0;}

If either version was written in plain assembly language, the programmer must manually save the results of EAX, EBX, ECX, and EDX elsewhere if they want to keep using the values.

Wrapper functions

GCC also provides a header called <cpuid.h> on systems that have CPUID. The __cpuid is a macro expanding to inline assembly. Typical usage would be:

#include <cpuid.h>#include <stdio.h>intmain (void){ int a, b, c, d; __cpuid (0 /* vendor string */, a, b, c, d); printf ("EAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n", a, b, c, d); return 0;}

But if one requested an extended feature not present on this CPU, they would not notice and might get random, unexpected results. Safer version is also provided in <cpuid.h>. It checks for extended features and does some more safety checks. The output values are not passed using reference-like macro parameters, but more conventional pointers.

#include <cpuid.h>#include <stdio.h>intmain (void){ int a, b, c, d; if (!__get_cpuid (0x81234567 /* nonexistent, but assume it exists */, &a, &b, &c, &d)) { fprintf (stderr, "Warning: CPUID request 0x81234567 not valid!\n"); } printf("EAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n", a, b, c, d); return 0;}

Notice the ampersands in &a, &b, &c, &d and the conditional statement. If the __get_cpuid call receives a correct request, it will return a non-zero value, if it fails, zero.^[28]

Microsoft Visual C compiler has builtin function __cpuid() so the cpuid instruction may be embedded without using inline assembly, which is handy since the x86-64 version of MSVC does not allow inline assembly at all. The same program for MSVC would be:

#include <iostream>#include <intrin.h>int main(){ int cpuInfo[4]; for (int a = 0; a < 5; a++) { __cpuid(cpuInfo, a); std::cout << "The code " << a << " gives " << cpuInfo[0] << ", " << cpuInfo[1] << ", " << cpuInfo[2] << ", " << cpuInfo[3] << '\n'; } return 0;}

Many interpreted or compiled scripting languages are capable of using CPUID via an FFI library. One such implementation shows usage of the Ruby FFI module to execute assembly language that includes the CPUID opcode.

CPU-specific information outside x86

Some of the non-x86 CPU architectures also provide certain forms of structured information about the processor's abilities, commonly as a set of special registers:

• ARM architectures have a CPUID coprocessor register which requires EL1 or above to access.^[29]
• The IBM System z mainframe processors have a Store CPU ID (STIDP) instruction since the 1983 IBM 4381^[30] for querying the processor ID.^[31]
• The IBM System z mainframe processors also have a Store Facilities List Extended (STFLE) instruction which lists the installed hardware features.^[31]
• The MIPS32/64 architecture defines a mandatory Processor Identification (PrId) and a series of daisy-chained Configuration Registers.^[32]
• The PowerPC processor has the 32-bit read-only Processor Version Register (PVR) identifying the processor model in use. The instruction requires supervisor access level.^[33]

DSP and transputer-like chip families have not taken up the instruction in any noticeable way, in spite of having (in relative terms) as many variations in design. Alternate ways of silicon identification might be present; for example, DSPs from Texas Instruments contain a memory-based register set for each functional unit that starts with identifiers determining the unit type and model, its ASIC design revision and features selected at the design phase, and continues with unit-specific control and data registers. Access to these areas is performed by simply using the existing load and store instructions; thus, for such devices there is no need for extending the register set for the device identification purposes.^{[citation needed]}

See also

• CPU-Z, a Windows utility that uses CPUID to identify various system settings
• Spectre (security vulnerability)
• Speculative Store Bypass (SSB)
• /proc/cpuinfo, a text file generated by certain systems containing some of the CPUID information

References

1. "Intel 64 and IA-32 Architectures Software Developer's Manual" (PDF). Intel.com. Retrieved 2013-04-11.
2. "Detecting Intel Processors - Knowing the generation of a system CPU". Rcollins.org. Retrieved 2013-04-11.
3. "LXR linux-old/arch/i386/kernel/head.S". Lxr.linux.no. Archived from the original on 2012-07-13. Retrieved 2013-04-11.
4. "CPUID, EAX=4 - Strange results (Solved)". Software.intel.com. Retrieved 2014-07-10.
5. "ao486 CPUID instruction".
6. "v586: 586 compatible soft core for FPGA".
7. https://cpufun.substack.com/p/fun-with-timers-and-cpuid
8. "Chapter 3 Instruction Set Reference, A-L" (PDF). Intel® 64 and IA-32 Architectures Software Developer's Manual. Intel Corporation. 2018-12-20. Retrieved 2018-12-20.
9. http://bochs.sourceforge.net/techspec/24161821.pdf
10. Huggahalli, Ram; Iyer, Ravi; Tetrick, Scott (2005). "Direct Cache Access for High Bandwidth Network I/O". ACM SIGARCH Computer Architecture News. 33 (2): 50–59. doi:10.1145/1080695.1069976. CiteSeerX:10.1.1.91.957.
11. Drepper, Ulrich (2007), What Every Programmer Should Know About Memory, CiteSeerX:10.1.1.91.957
12. "Mechanisms to determine if software is running in a VMware virtual machine". VMware Knowledge Base. VMWare. 2015-05-01. Intel and AMD CPUs have reserved bit 31 of ECX of CPUID leaf 0x1 as the hypervisor present bit. This bit allows hypervisors to indicate their presence to the guest operating system. Hypervisors set this bit and physical CPUs (all existing and future CPUs) set this bit to zero. Guest operating systems can test bit 31 to detect if they are running inside a virtual machine.
13. Kataria, Alok; Hecht, Dan (2008-10-01). "Hypervisor CPUID Interface Proposal". LKML Archive on lore.kernel.org. Archived from the original on 2019-03-15. Bit 31 of ECX of CPUID leaf 0x1. This bit has been reserved by Intel & AMD for use by hypervisors, and indicates the presence of a hypervisor. Virtual CPU's (hypervisors) set this bit to 1 and physical CPU's (all existing and future cpu's) set this bit to zero. This bit can be probed by the guest software to detect whether they are running inside a virtual machine.
14. Shih Kuo (Jan 27, 2012). "Intel® 64 Architecture Processor Topology Enumeration".
15. "Processor and Core Enumeration Using CPUID | AMD". Developer.amd.com. Archived from the original on 2014-07-14. Retrieved 2014-07-10.
16. "Sandybridge processors report incorrect core number?". Software.intel.com. 2012-12-29. Retrieved 2014-07-10.
17. "cpuid, __cpuidex". Msdn.microsoft.com. 2014-06-20. Retrieved 2014-07-10.
18. "x86 architecture - CPUID". sandpile.org. Retrieved 2014-07-10.
19. "topology.cpp in ps/trunk/source/lib/sysdep/arch/x86_x64 – Wildfire Games". Trac.wildfiregames.com. 2011-12-27. Retrieved 2014-07-10.
20. Hyper-Threading Technology and Multi-Core Processor Detection
21. "Speculative Execution Side Channel Mitigations" (PDF). Revision 2.0. Intel. May 2018 [January 2018]. Document Number: 336996-002. Retrieved 2018-05-26.
22. "IBRS patch series [LWN.net]".
23. CPUID Specification (PDF), AMD, September 2010, retrieved 2013-04-02
24. Linux kernel source code
25. Lightweight Profiling Specification (PDF), AMD, August 2010, retrieved 2013-04-03
26. "Intel® Processor Identification and the CPUID Instruction" (PDF). Download.intel.com. 2012-03-06. Retrieved 2013-04-11.
27. Ferrie, Peter. "Attacks on Virtual Machine Emulators" (PDF). symantec.com. Symantec Advanced Threat Research. Archived from the original (PDF) on 2007-02-07. Retrieved 15 March 2017.
28. https://github.com/gcc-mirror/gcc/blob/master/gcc/config/i386/cpuid.h
29. "ARM Information Center". Infocenter.arm.com. Retrieved 2013-04-11.
30. "Processor version codes and SRM constants". Archived from the original on 2014-09-08. Retrieved 2014-09-08.
31. "IBM System z10 Enterprise Class Technical Guide" (PDF).
32. "MIPS32 Architecture For Programmers, Volume III: The MIPS32 Privileged Resource Architecture" (PDF). MIPS Technologies, Inc. 2001-03-12.
33. "PowerPC Operating Environment Architecture, book III" (PDF).

Further reading

• "AMD64 Technology Indirect Branch Control Extension" (PDF) (White paper). Revision 4.10.18. Advanced Micro Devices, Inc. (AMD). 2018. Archived (PDF) from the original on 2018-05-09. Retrieved 2018-05-09.

External links

• Intel Processor Identification and the CPUID Instruction (Application Note 485), last published version. Said to be incorporated into the Intel® 64 and IA-32 Architectures Software Developer’s Manual in 2013, but as of July 2014^[update] the manual still directs the reader to note 485.
  • Contains some information that can be and was easily misinterpreted though, particularly with respect to processor topology identification.
  • The big Intel manuals tend to lag behind the Intel ISA document, available at the top of this page, which is updated even for processors not yet publicly available, and thus usually contains more CPUID bits. For example, as of this writing the ISA book (at revision 19, dated May 2014) documents the CLFLUSHOPT bit in leaf 7, but the big manuals although apparently more up-to-date (at revision 51, dated June 2014) don't mention it.
• AMD64 Architecture Programmer’s Manual Volume 3: General-Purpose and System Instructions
• cpuid.exe, an open source command-line tool for Windows, available in SysTools.zip. Ex: cpuid -v displays the value of every CPUID feature flag.
• instlatx64 - collection of x86/x64 Instruction Latency, Memory Latency and CPUID dumps