CPUID

In the x86 architecture, the CPUID instruction (identified by a CPUID opcode) is a processor supplementary instruction (its name derived from CPU Identification) allowing software to discover details of the processor. It was introduced by Intel in 1993 with the launch of the Pentium and SL-enhanced 486 processors.[1]

A program can use the CPUID to determine processor type and whether features such as MMX/SSE are implemented.

History

Prior to the general availability of the CPUID instruction, programmers would write esoteric machine code which exploited minor differences in CPU behavior in order to determine the processor make and model.[2][3] With the introduction of the 80386 processor, EDX on reset indicated the revision but this was only readable after reset and there was no standard way for applications to read the value.

Outside the x86 family, developers are mostly still required to use esoteric processes (involving instruction timing or CPU fault triggers) to determine the variations in CPU design that are present.

In the Motorola 680x0 family — that never had a CPUID instruction of any kind — certain specific instructions required elevated privileges. These could be used to tell various CPU family members apart. In the Motorola 68010 the instruction MOVE from SR became privileged. This notable instruction (and state machine) change allowed the 68010 to meet the Popek and Goldberg virtualization requirements. Because the 68000 offered an unprivileged MOVE from SR the 2 different CPUs could be told apart by a CPU error condition being triggered.

While the CPUID instruction is specific to the x86 architecture, other architectures (like ARM) often provide on-chip registers which can be read in prescribed ways to obtain the same sorts of information provided by the x86 CPUID instruction.

Calling CPUID

The CPUID opcode is 0F A2.

In assembly language, the CPUID instruction takes no parameters as CPUID implicitly uses the EAX register to determine the main category of information returned. In Intel's more recent terminology, this is called the CPUID leaf. CPUID should be called with EAX = 0 first, as this will store in the EAX register the highest EAX calling parameter (leaf) that the CPU implements.

To obtain extended function information CPUID should be called with the most significant bit of EAX set. To determine the highest extended function calling parameter, call CPUID with EAX = 80000000h.

CPUID leaves greater than 3 but less than 80000000 are accessible only when the model-specific registers have IA32_MISC_ENABLE.BOOT_NT4 [bit 22] = 0 (which is so by default). As the name suggests, Windows NT 4.0 until SP6 did not boot properly unless this bit was set,[4] but later versions of Windows do not need it, so basic leaves greater than 4 can be assumed visible on current Windows systems. As of July 2014, basic valid leaves go up to 14h, but the information returned by some leaves are not disclosed in the publicly available documentation, i.e. they are "reserved".

Some of the more recently added leaves also have sub-leaves, which are selected via the ECX register before calling CPUID.

EAX=0: Highest Function Parameter and Manufacturer ID

This returns the CPU's manufacturer ID string  a twelve-character ASCII string stored in EBX, EDX, ECX (in that order). The highest basic calling parameter (the largest value that EAX can be set to before calling CPUID) is returned in EAX.

Here is a list of processors and the highest function implemented.

Highest Function Parameter
ProcessorsBasicExtended
Earlier Intel 486CPUID Not Implemented
Later Intel 486 and Pentium0x01Not Implemented
Pentium Pro, Pentium II and Celeron0x02Not Implemented
Pentium III0x03Not Implemented
Pentium 40x020x8000 0004
Xeon0x020x8000 0004
Pentium M0x020x8000 0004
Pentium 4 with Hyper-Threading0x050x8000 0008
Pentium D (8xx)0x050x8000 0008
Pentium D (9xx)0x060x8000 0008
Core Duo0x0A0x8000 0008
Core 2 Duo0x0A0x8000 0008
Xeon 3000, 5100, 5200, 5300, 5400 (5000 series)0x0A0x8000 0008
Core 2 Duo 8000 series0x0D0x8000 0008
Xeon 5200, 5400 series0x0A0x8000 0008
Atom0x0A0x8000 0008
Nehalem-based processors0x0B0x8000 0008
Ivy Bridge-based processors 0x0D 0x8000 0008
Skylake-based processors (proc base & max freq; Bus ref. freq) 0x16 0x8000 0008
System-On-Chip Vendor Attribute Enumeration Main Leaf 0x17 0x8000 0008

The following are known processor manufacturer ID strings:

The following are ID strings used by open source soft CPU cores:

  • "MiSTer AO486"  ao486 CPU[6]
  • "GenuineIntel"  v586 core[7] (this is identical to the Intel ID string)

The following are known ID strings from virtual machines:

For instance, on a GenuineIntel processor values returned in EBX is 0x756e6547, EDX is 0x49656e69 and ECX is 0x6c65746e. The following example code displays the vendor ID string as well as the highest calling parameter that the CPU implements.

	.intel_syntax noprefix
	.text
.m0: .string "CPUID: %x\n"
.m1: .string "Largest basic function number implemented: %i\n"
.m2: .string "Vendor ID: %s\n"

    .globl main

main:
	push    r12
	mov	    eax, 1
	sub	    rsp, 16
    cpuid
    lea	    rdi, .m0[rip]
	mov	    esi, eax
	call	printf
	mov     eax, 0
    cpuid
	lea	    rdi, .m1[rip]
	mov	    esi, eax
	mov	    r12d, edx
	mov	    ebp, ecx
	call    printf
	mov     3[rsp], ebx
	lea	    rsi, 3[rsp]
    lea	    rdi, .m2[rip]
    mov     7[rsp], r12d
    mov     11[rsp], ebp
	call	printf
	add	    rsp, 16
	pop	    r12
	ret

    .section .note.GNU-stack,"",@progbits

EAX=1: Processor Info and Feature Bits

This returns the CPU's stepping, model, and family information in register EAX (also called the signature of a CPU), feature flags in registers EDX and ECX, and additional feature info in register EBX.[10]

CPUID EAX=1: Processor Version Information in EAX
EAX
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Reserved Extended Family ID Extended Model ID Reserved Processor Type Family ID Model Stepping ID
  • Stepping ID is a product revision number assigned due to fixed errata or other changes.
  • The actual processor model is derived from the Model, Extended Model ID and Family ID fields. If the Family ID field is either 6 or 15, the model is equal to the sum of the Extended Model ID field shifted left by 4 bits and the Model field. Otherwise, the model is equal to the value of the Model field.
  • The actual processor family is derived from the Family ID and Extended Family ID fields. If the Family ID field is equal to 15, the family is equal to the sum of the Extended Family ID and the Family ID fields. Otherwise, the family is equal to the value of the Family ID field.
  • The meaning of the Processor Type field is given in the table below.
Processor Type
Type Encoding in Binary
Original equipment manufacturer (OEM) Processor 00
Intel Overdrive Processor 01
Dual processor (applicable to Intel P5 Pentium processors only)[11] 10
Reserved value 11
CPUID EAX=1: Additional Information in EBX
Bits EBX Valid
7:0 Brand Index
15:8 CLFLUSH line size (Value * 8 = cache line size in bytes) if CLFLUSH feature flag is set.

CPUID.01.EDX.CLFSH [bit 19]= 1

23:16 Maximum number of addressable IDs for logical processors in this physical package;

The nearest power-of-2 integer that is not smaller than this value is the number of unique initial APIC IDs reserved for addressing different logical processors in a physical package.

Former use: Number of logical processors per physical processor; two for the Pentium 4 processor with Hyper-Threading Technology.[12]

if Hyper-threading feature flag is set.

CPUID.01.EDX.HTT [bit 28]= 1

31:24 Local APIC ID: The initial APIC-ID is used to identify the executing logical processor.

It can also be identified via the cpuid 0BH leaf ( CPUID.0Bh.EDX[x2APIC-ID] ).

Pentium 4 and subsequent processors.

The processor info and feature flags are manufacturer specific but usually, the Intel values are used by other manufacturers for the sake of compatibility.

CPUID EAX=1: Feature Information in EDX and ECX
Bit EDX ECX[lower-alpha 1] Bit
ShortFeature ShortFeature
0 fpuOnboard x87 FPU sse3SSE3 (Prescott New Instructions - PNI) 0
1 vmeVirtual 8086 mode extensions (such as VIF, VIP, PVI) pclmulqdqPCLMULQDQ (carry-less multiply) instruction 1
2 deDebugging extensions (CR4 bit 3) dtes6464-bit debug store (edx bit 21) 2
3 psePage Size Extension (4 MByte pages) monitorMONITOR and MWAIT instructions (PNI) 3
4 tscTime Stamp Counter and RDTSC instruction ds-cplCPL qualified debug store 4
5 msrModel-specific registers and RDMSR/WRMSR instructions vmxVirtual Machine eXtensions 5
6 paePhysical Address Extension smxSafer Mode Extensions (LaGrande) (GETSEC instruction) 6
7 mceMachine Check Exception estEnhanced SpeedStep 7
8 cx8[lower-alpha 2]CMPXCHG8B (compare-and-swap) instruction tm2Thermal Monitor 2 8
9 apic[lower-alpha 3]Onboard Advanced Programmable Interrupt Controller ssse3Supplemental SSE3 instructions 9
10 (mtrr)[lower-alpha 4] (reserved) cnxt-idL1 Context ID 10
11 sep[lower-alpha 5]SYSENTER and SYSEXIT fast system call instructions sdbgSilicon Debug interface 11
12 mtrrMemory Type Range Registers fmaFused multiply-add (FMA3) 12
13 pgePage Global Enable bit in CR4 cx16CMPXCHG16B instruction 13
14 mcaMachine check architecture xtprCan disable sending task priority messages 14
15 cmovConditional move: CMOV, FCMOV and FCOMI instructions[lower-alpha 6] pdcmPerfmon & debug capability 15
16 patPage Attribute Table (reserved)[lower-alpha 7] 16
17 pse-3636-bit page size extension pcidProcess context identifiers (CR4 bit 17) 17
18 psnProcessor Serial Number dcaDirect cache access for DMA writes[20][21] 18
19 clfshCLFLUSH cache line flush instruction (SSE2) sse4.1SSE4.1 instructions 19
20 (nx)No-execute (NX) bit (Itanium only)[22][lower-alpha 8] sse4.2SSE4.2 instructions 20
21 dsDebug store: save trace of executed jumps x2apicx2APIC (enhanced APIC) 21
22 acpiOnboard thermal control MSRs for ACPI movbeMOVBE instruction (big-endian) 22
23 mmxMMX instructions (64-bit SIMD) popcntPOPCNT instruction 23
24 fxsrFXSAVE, FXRSTOR instructions, CR4 bit 9 tsc-deadlineAPIC implements one-shot operation using a TSC deadline value 24
25 sseStreaming SIMD Extensions (SSE) instructions
(aka "Katmai New Instructions"; 128-bit SIMD)
aes-niAES instruction set 25
26 sse2SSE2 instructions xsaveExtensible processor state save/restore:
XSAVE, XRSTOR, XSETBV, XGETBV instructions
26
27 ssCPU cache implements self-snoop osxsaveXSAVE enabled by OS 27
28 httMax APIC IDs reserved field is Valid[lower-alpha 9] avxAdvanced Vector Extensions (256-bit SIMD) 28
29 tmThermal monitor automatically limits temperature f16cFloating-point conversion instructions to/from FP16 format 29
30 ia64IA64 processor emulating x86[22] rdrndRDRAND (on-chip random number generator) feature 30
31 pbePending Break Enable (PBE# pin) wakeup capability hypervisorHypervisor present (always zero on physical CPUs)[25][26] 31
  1. On some older processors, executing CPUID with a leaf index (EAX) greater than 0 may leave EBX and ECX unmodified, keeping their old values. For this reason, it is recommended to zero out EBX and ECX before executing CPUID with a leaf index of 1.

    Processors noted to exhibit this behavior include Cyrix MII[13] and IDT WinChip 2.[14]

  2. On processors from IDT, Transmeta and Rise (vendor IDs CentaurHauls, GenuineTMx86 and RiseRiseRise), the CMPXCHG8B instruction is always supported, however the feature bit for the instruction might not be set. This is a workaround for a bug in Windows NT.[15]
  3. On early AMD K5 (AuthenticAMD Family 5 Model 0) processors only, EDX bit 9 used to indicate support for PGE instead. This was moved to bit 13 from K5 Model 1 onwards.[16]
  4. Intel AP-485, revisions 006[17] to 008, lists CPUID.(EAX=1):EDX[bit 10] as having the name "MTRR" (albeit described as "Reserved"/"Do not count on their value") - this name was removed in later revisions of AP-485, and the bit has been listed as reserved with no name since then.
  5. On Pentium Pro (GenuineIntel Family 6 Model 1) processors only, EDX bit 11 is invalid - the bit it set, but the SYSENTER and SYSEXIT instructions are not supported on the Pentium Pro.[18]
  6. FCMOV and FCOMI instructions only available if onboard x87 FPU also present (indicated by EDX bit 0).
  7. ECX bit 16 is listed as "Reserved" in public Intel and AMD documentation and is not set in any known processor. However, some versions of the Windows Vista kernel are reported to be checking this bit[19] - if it is set, Vista will recognize it as a "processor channels" feature.
  8. On non-Itanium x86 processors, support for the No-execute bit is indicated in CPUID.(EAX=8000_0001):EDX[bit 20] instead.
  9. EDX bit 28, if set, indicates that bits 23:16 of CPUID.(EAX=1):EBX are valid. If this bit is not set, then the CPU package contains only 1 logical processor.

    In older documentation, this bit is often listed as a "Hyper-threading technology"[23] flag - however, while this flag is a prerequisite for Hyper-Threading support, it does not by itself indicate support for Hyper-Threading and it has been set on many CPUs that do not feature any form of multi-threading technology.[24]

Reserved fields should be masked before using them for processor identification purposes.

EAX=2: Cache and TLB Descriptor information

This returns a list of descriptors indicating cache and TLB capabilities in EAX, EBX, ECX and EDX registers.

EAX=3: Processor Serial Number

This returns the processor's serial number. The processor serial number was introduced on Intel Pentium III, but due to privacy concerns, this feature is no longer implemented on later models (the PSN feature bit is always cleared). Transmeta's Efficeon and Crusoe processors also provide this feature. AMD CPUs however, do not implement this feature in any CPU models.

For Intel Pentium III CPUs, the serial number is returned in the EDX:ECX registers. For Transmeta Efficeon CPUs, it is returned in the EBX:EAX registers. And for Transmeta Crusoe CPUs, it is returned in the EBX register only.

Note that the processor serial number feature must be enabled in the BIOS setting in order to function.

EAX=4 and EAX=Bh: Intel thread/core and cache topology

These two leaves are used for processor topology (thread, core, package) and cache hierarchy enumeration in Intel multi-core (and hyperthreaded) processors.[27] As of 2013 AMD does not use these leaves but has alternate ways of doing the core enumeration.[28]

Unlike most other CPUID leaves, leaf Bh will return different values in EDX depending on which logical processor the CPUID instruction runs; the value returned in EDX is actually the x2APIC id of the logical processor. The x2APIC id space is not continuously mapped to logical processors, however; there can be gaps in the mapping, meaning that some intermediate x2APIC ids don't necessarily correspond to any logical processor. Additional information for mapping the x2APIC ids to cores is provided in the other registers. Although the leaf Bh has sub-leaves (selected by ECX as described further below), the value returned in EDX is only affected by the logical processor on which the instruction is running but not by the subleaf.

The processor(s) topology exposed by leaf Bh is a hierarchical one, but with the strange caveat that the order of (logical) levels in this hierarchy doesn't necessarily correspond to the order in the physical hierarchy (SMT/core/package). However, every logical level can be queried as an ECX subleaf (of the Bh leaf) for its correspondence to a "level type", which can be either SMT, core, or "invalid". The level id space starts at 0 and is continuous, meaning that if a level id is invalid, all higher level ids will also be invalid. The level type is returned in bits 15:08 of ECX, while the number of logical processors at the level queried is returned in EBX. Finally, the connection between these levels and x2APIC ids is returned in EAX[4:0] as the number of bits that the x2APIC id must be shifted in order to obtain a unique id at the next level.

As an example, a dual-core Westmere processor capable of hyperthreading (thus having two cores and four threads in total) could have x2APIC ids 0, 1, 4 and 5 for its four logical processors. Leaf Bh (=EAX), subleaf 0 (=ECX) of CPUID could for instance return 100h in ECX, meaning that level 0 describes the SMT (hyperthreading) layer, and return 2 in EBX because there are two logical processors (SMT units) per physical core. The value returned in EAX for this 0-subleaf should be 1 in this case, because shifting the aforementioned x2APIC ids to the right by one bit gives a unique core number (at the next level of the level id hierarchy) and erases the SMT id bit inside each core. A simpler way to interpret this information is that the last bit (bit number 0) of the x2APIC id identifies the SMT/hyperthreading unit inside each core in our example. Advancing to subleaf 1 (by making another call to CPUID with EAX=Bh and ECX=1) could for instance return 201h in ECX, meaning that this is a core-type level, and 4 in EBX because there are 4 logical processors in the package; EAX returned could be any value greater than 3, because it so happens that bit number 2 is used to identify the core in the x2APIC id. Note that bit number 1 of the x2APIC id is not used in this example. However, EAX returned at this level could well be 4 (and it happens to be so on a Clarkdale Core i3 5x0) because that also gives a unique id at the package level (=0 obviously) when shifting the x2APIC id by 4 bits. Finally, you may wonder what the EAX=4 leaf can tell us that we didn't find out already. In EAX[31:26] it returns the APIC mask bits reserved for a package; that would be 111b in our example because bits 0 to 2 are used for identifying logical processors inside this package, but bit 1 is also reserved although not used as part of the logical processor identification scheme. In other words, APIC ids 0 to 7 are reserved for the package, even though half of these values don't map to a logical processor.

The cache hierarchy of the processor is explored by looking at the sub-leaves of leaf 4. The APIC ids are also used in this hierarchy to convey information about how the different levels of cache are shared by the SMT units and cores. To continue our example, the L2 cache, which is shared by SMT units of the same core but not between physical cores on the Westmere is indicated by EAX[26:14] being set to 1, while the information that the L3 cache is shared by the whole package is indicated by setting those bits to (at least) 111b. The cache details, including cache type, size, and associativity are communicated via the other registers on leaf 4.

Beware that older versions of the Intel app note 485 contain some misleading information, particularly with respect to identifying and counting cores in a multi-core processor;[29] errors from misinterpreting this information have even been incorporated in the Microsoft sample code for using CPUID, even for the 2013 edition of Visual Studio,[30] and also in the sandpile.org page for CPUID,[31] but the Intel code sample for identifying processor topology[27] has the correct interpretation, and the current Intel Software Developer’s Manual has a more clear language. The (open source) cross-platform production code[32] from Wildfire Games also implements the correct interpretation of the Intel documentation.

Topology detection examples involving older (pre-2010) Intel processors that lack x2APIC (thus don't implement the EAX=Bh leaf) are given in a 2010 Intel presentation.[33] Beware that using that older detection method on 2010 and newer Intel processors may overestimate the number of cores and logical processors because the old detection method assumes there are no gaps in the APIC id space, and this assumption is violated by some newer processors (starting with the Core i3 5x0 series), but these newer processors also come with an x2APIC, so their topology can be correctly determined using the EAX=Bh leaf method.

EAX=6: Thermal and power management

This returns feature bits in the EAX register and additional information in the EBX, ECX and EDX registers.

CPUID EAX=6: Thermal/power management feature bits in EAX
Bit EAX
Short Feature
0 DTSDigital Thermal Sensor capability
1 Intel Turbo Boost Technology capability
2 ARATAlways Running APIC Timer capability
3 (reserved)
4 PLNPower Limit Notification capability
5 ECMDExtended Clock Modulation Duty capability
6 PTMPackage Thermal Management capability
7 HWPHardware-controlled Performance States. MSRs added:
  • IA32_PM_ENABLE(770h)
  • IA32_HWP_CAPABILITIES(771h)
  • IA32_HWP_REQUEST(774h)
  • IA32_HWP_STATUS(777h
8 HWP_NotificationHWP notification of dynamic guaranteed performance change - IA32_HWP_INTERRUPT(773h) MSR
9 HWP_Activity_­WindowHWP Activity Window control - bits 41:32 of IA32_HWP_REQUEST MSR
10 HWP_Energy_­Performance_­PreferenceHWP Energy/performance preference control - bits 31:24 of IA32_HWP_REQUEST MSR
11 HWP_Package_­Level_RequestHWP Package-level control - IA32_HWP_REQUEST_PKG(772h) MSR
12 (reserved)
13 HDCHardware Duty Cycling supported. MSRs added:
  • IA32_PKG_HDC_CTL (DB0h)
  • IA32_PM_CTL1 (DB1h)
  • IA32_THREAD_STALL (DB2h)
14 Intel Turbo Boost Max Technology 3.0 available
15 Interrupts upon changes to IA32_HWP_CAPABILITIES.Highest_Performance (bits 7:0) supported
16 HWP PECI override supported - bits 63:60 of IA32_HWP_PECI_REQUEST_INFO(775h) MSR
17 Flexible HWP - bits 63:59 of IA32_HWP_REQUEST MSR
18 Fast access mode for IA32_HWP_REQUEST MSR supported[lower-alpha 1]
19 HW_FEEDBACKHardware Feedback Interface. Added MSRs:
  • IA32_HW_FEEDBACK_PTR(17D0h)
  • IA32_HW_FEEDBACK_CONFIG(17D1h) (bit 0 enables HFI, bit 1 enables Intel Thread Director)
20 IA32_HWP_REQUEST of idle logical processor ignored when only one of two logical processors that share a physical processor is active.
21 (reserved)
22 IA32_HWP_CTL(776h) MSR supported
23 Intel Thread Director supported. Added MSRs:
  • IA32_THREAD_FEEDBACK_CHAR(17D2h)
  • IA32_HW_FEEDBACK_THREAD_CONFIG(17D4h)
24 IA32_THERM_INTERRUPT MSR bit 25 supported
 
31:25
 
(reserved)
  1. To enable fast (non-serializing) access mode for the IA32_HWP_REQUEST MSR on CPUs that support it, it is necessary to set bit 0 of the FAST_UNCORE_MSRS_CTL(657h) MSR.
CPUID EAX=6: Thermal/power management feature fields in EBX, ECX and EDX
Bit EBX ECX EDX Bit
0 Number of Interrupt Thresholds in Digital Thermal Sensor Effective frequency interface supported - IA32_MPERF(0E7h) and IA32_APERF(0E8h) MSRs Hardware Feedback reporting: Performance Capability Reporting supported 0
1 (ACNT2 Capability)[lower-alpha 1] Hardware Feedback reporting: Efficiency Capability Reporting supported 1
2 (reserved) (reserved) 2
3 Performance-Energy Bias capability - IA32_ENERGY_PERF_BIAS(1B0h) MSR 3
7:4 (reserved) (reserved) 7:4
11:8 Number of Intel Thread Director classes supported by hardware Size of Hardware Feedback interface structure (in units of 4 Kbytes) minus 1 11:8
15:12 (reserved) 15:12
 
31:16
 
(reserved) Index of this logical processor's row in hardware feedback interface structure  
31:16
 
  1. The "ACNT2 Capability" bit is listed in Intel AP-485 rev 038[34] and 039, but not listed in any revision of the Intel SDM. The feature is known to exist in only a few Intel CPUs, e.g. Xeon "Harpertown" stepping E0.[35]

EAX=7, ECX=0: Extended Features

This returns extended feature flags in EBX, ECX, and EDX. Returns the maximum ECX value for EAX=7 in EAX.

CPUID EAX=7,ECX=0: Extended feature bits in EBX, ECX and EDX
Bit EBX ECX EDX Bit
Short Feature Short Feature Short Feature
0 fsgsbaseAccess to base of %fs and %gs prefetchwt1PREFETCHWT1 instruction (reserved) 0
1 IA32_TSC_ADJUST MSR avx512-vbmiAVX-512 Vector Bit Manipulation Instructions sgx-keysAttestation Services for Intel SGX 1
2 sgxSoftware Guard Extensions umipUser-mode Instruction Prevention avx512-4vnniwAVX-512 4-register Neural Network Instructions 2
3 bmi1Bit Manipulation Instruction Set 1 pkuMemory Protection Keys for User-mode pages avx512-4fmapsAVX-512 4-register Multiply Accumulation Single precision 3
4 hleTSX Hardware Lock Elision ospkePKU enabled by OS fsrmFast Short REP MOVSB 4
5 avx2Advanced Vector Extensions 2 waitpkgTimed pause and user-level monitor/wait instructions (TPAUSE, UMONITOR, UMWAIT) uintrUser Inter-processor Interrupts 5
6 fdp-excptn-onlyx87 FPU data pointer register updated on exceptions only avx512-vbmi2AVX-512 Vector Bit Manipulation Instructions 2 (reserved) 6
7 smepSupervisor Mode Execution Prevention cet_ss/shstkControl flow enforcement (CET): shadow stack (SHSTK alternative name) (reserved) 7
8 bmi2Bit Manipulation Instruction Set 2 gfniGalois Field instructions avx512-vp2intersectAVX-512 vector intersection instructions on 32/64-bit integers 8
9 ermsEnhanced REP MOVSB/STOSB vaesVector AES instruction set (VEX-256/EVEX) srdbs-ctrlSpecial Register Buffer Data Sampling Mitigations 9
10 invpcidINVPCID instruction vpclmulqdqCLMUL instruction set (VEX-256/EVEX) mc-clearVERW instruction clears CPU buffers 10
11 rtmTSX Restricted Transactional Memory avx512-vnniAVX-512 Vector Neural Network Instructions rtm-always-abortAll TSX transactions are aborted 11
12 rdt-m/pqmIntel Resource Director (RDT) Monitoring or AMD Platform QOS Monitoring avx512-bitalgAVX-512 BITALG instructions (reserved) 12
13 x87 FPU CS and DS deprecated tmeTotal Memory Encryption MSRs available TSX_FORCE_ABORT MSR is available 13
14 mpxIntel MPX (Memory Protection Extensions) avx512-vpopcntdqAVX-512 Vector Population Count Double and Quad-word serializeSERIALIZE instruction 14
15 rdt-a/pqeIntel Resource Director (RDT) Allocation or AMD Platform QOS Enforcement (reserved) hybridMixture of CPU types in processor topology (eg. Alder Lake) 15
16 avx512-fAVX-512 Foundation la575-level paging (57 address bits) tsxldtrkTSX load address tracking suspend/resume instructions (TSUSLDTRK and TRESLDTRK) 16
17 avx512-dqAVX-512 Doubleword and Quadword Instructions mawauThe value of userspace MPX Address-Width Adjust used by the BNDLDX and BNDSTX Intel MPX instructions in 64-bit mode (reserved) 17
18 rdseedRDSEED instruction pconfigPlatform configuration (Memory Encryption Technologies Instructions) 18
19 adxIntel ADX (Multi-Precision Add-Carry Instruction Extensions) lbrArchitectural Last Branch Records 19
20 smapSupervisor Mode Access Prevention cet-ibtControl flow enforcement (CET): indirect branch tracking 20
21 avx512-ifmaAVX-512 Integer Fused Multiply-Add Instructions (reserved) 21
22 (pcommit)(PCOMMIT instruction, deprecated)[36] rdpidRDPID (Read Processor ID) instruction and IA32_TSC_AUX MSR amx-bf16AMX tile computation on bfloat16 numbers 22
23 clflushoptCLFLUSHOPT instruction klAES Key Locker avx512-fp16AVX-512 half-precision floating-point arithmetic instructions[37] 23
24 clwbCLWB (Cache line writeback) instruction bus-lock-detectBus lock debug exceptions amx-tileAMX tile load/store instructions 24
25 ptIntel Processor Trace cldemoteCLDEMOTE (Cache line demote) instruction amx-int8AMX tile computation on 8-bit integers 25
26 avx512-pfAVX-512 Prefetch Instructions (reserved) IBRS_IBPB / spec_ctrlSpeculation Control, part of Indirect Branch Control (IBC):
Indirect Branch Restricted Speculation (IBRS) and
Indirect Branch Prediction Barrier (IBPB)[38][39]
26
27 avx512-erAVX-512 Exponential and Reciprocal Instructions movdiriMOVDIRI instruction stibpSingle Thread Indirect Branch Predictor, part of IBC[38] 27
28 avx512-cdAVX-512 Conflict Detection Instructions movdir64bMOVDIR64B (64-byte direct store) instruction L1D_FLUSHIA32_FLUSH_CMD MSR 28
29 shaSHA extensions enqcmdEnqueue Stores and EMQCMD/EMQCMDS instructions IA32_ARCH_CAPABILITIES (lists speculative side channel mitigations[38]) 29
30 avx512-bwAVX-512 Byte and Word Instructions sgx-lcSGX Launch Configuration IA32_CORE_CAPABILITIES MSR (lists model-specific core capabilities) 30
31 avx512-vlAVX-512 Vector Length Extensions pksProtection keys for supervisor-mode pages ssbdSpeculative Store Bypass Disable,[38] as mitigation for Speculative Store Bypass (IA32_SPEC_CTRL) 31

EAX=7, ECX=1: Extended Features

This returns extended feature flags in EAX, EBX, and EDX. ECX is reserved.

CPUID EAX=7,ECX=1: Extended feature bits in EAX, EBX and EDX
Bit EAX EBX EDX Bit
ShortFeature ShortFeature ShortFeature
0 (reserved) IA32_PPIN and IA32_PPIN_CTL MSRs (reserved) 0
1 (reserved) (reserved) (reserved) 1
2 (reserved) (reserved) (reserved) 2
3 rao-intRemote Atomic Operations on integers: AADD, AAND, AOR, AXOR instructions (reserved) (reserved) 3
4 avx-vnniAVX Vector Neural Network Instructions (VNNI) (VEX encoded) (reserved) avx-vnn-int8AVX VNNI INT8 instructions 4
5 avx512-bf16AVX-512 instructions for bfloat16 numbers (reserved) avx-ne-convertAVX no-exception FP conversion instructions (bfloat16↔FP32 and FP16→FP32) 5
6 lassLinear Address Space Separation (reserved) (reserved) 6
7 cmpccxaddCMPccXADD instructions (reserved) (reserved) 7
8 archperfmonextArchitectural Performance Monitoring Extended Leaf (EAX=23h) (reserved) amx-complexAMX support for "complex" tiles (TCMMIMFP16PS and TCMMRLFP16PS) 8
9 (reserved) (reserved) (reserved) 9
10 fast-zero-rep-movsbFast zero-length REP MOVSB (reserved) (reserved) 10
11 fast-short-rep-stosbFast short REP STOSB (reserved) (reserved) 11
12 fast-short-rep-cmpsb-scasbFast short REP CMPSB and REP SCASB (reserved) (reserved) 12
13 (reserved) (reserved) (reserved) 13
14 (reserved) (reserved) prefetchiInstruction-cache prefetch instructions (PREFETCHIT0 and PREFETCHIT1) 14
15 (reserved) (reserved) (reserved) 15
16 (reserved) (reserved) (reserved) 16
17 fredFlexible Return and Event Delivery (reserved) (reserved) 17
18 lkgsLKGS Instruction (reserved) cet-sssControl-Flow Enforcement (CET): Supervisor Shadow Stacks 18
19 wrmsrnsWRMSRNS instruction (non-serializing write to MSRs) (reserved) (reserved) 19
20 (reserved) (reserved) (reserved) 20
21 amx-fp16AMX instructions for FP16 numbers (reserved) (reserved) 21
22 hresetHRESET instruction, IA32_HRESET_ENABLE MSR, and Processor History Reset Leaf (EAX=20h) (reserved) (reserved) 22
23 avx-ifmaAVX IFMA instructions (reserved) (reserved) 23
24 (reserved) (reserved) (reserved) 24
25 (reserved) (reserved) (reserved) 25
26 lamLinear Address Masking (reserved) (reserved) 26
27 msrlistRDMSRLIST and WRMSRLIST instructions, and the IA32_BARRIER MSR (reserved) (reserved) 27
28 (reserved) (reserved) (reserved) 28
29 (reserved) (reserved) (reserved) 29
30 (reserved) (reserved) (reserved) 30
31 (reserved) (reserved) (reserved) 31

EAX=7, ECX=2: Extended Features

This returns extended feature flags in EDX.

EAX, EBX and ECX are reserved.

CPUID EAX=7,ECX=2: Extended feature bits in EDX
Bit EDX
ShortFeature
0 pfsdFast Store Forwarding Predictor disable supported. (SPEC_CTRL (MSR 48h) bit 7)
1 ipred_disIPRED_DIS controls[40] supported. (SPEC_CTRL bits 3 and 4)

IPRED_DIS prevents instructions at an indirect branch target from speculatively executing until the branch target address is resolved.

2 rrsba_ctrlRRSBA behavior[41][40] disable supported. (SPEC_CTRL bits 5 and 6)
3 dppd_uData Dependent Prefetcher disable supported. (SPEC_CTRL bit 8)
4 bhi_ctrlBHI_DIS_S behavior[40] enable supported. (SPEC_CTRL bit 10)

BHI_DIS_S prevents predicted targets of indirect branches executed in ring0/1/2 from being selected based on branch history from branches executed in ring 3.

5 mcdt_noIf set, the processor does not exhibit MXCSR configuration dependent timing.
 
31:6
 
(reserved)

EAX=0Dh: XSAVE features and state-components

This leaf is used to enumerate XSAVE features and state-components.

The XSAVE instruction set extension is designed to save/restore CPU extended state (typically for the purpose of context switching) in a manner that can be extended to cover new instruction set extensions without the OS context-switching code needing to understand the specifics of the new extensions. This is done by defining a series of state-components, each with a size and offset within a given save area, and each corresponding to a subset of the state needed for one CPU extension or another. The EAX=0Dh CPUID leaf is used to provide information about which state-components the CPU supports and what their sizes/offsets are, so that the OS can reserve the proper amount of space and set the associated enable-bits.

The state-components can be subdivided into two groups: user-state (state-items that are visible to the application, e.g. AVX-512 vector registers), and supervisor-state (state items that affect the application but are not directly user-visible, e.g. user-mode interrupt configuration). The user-state items are enabled by setting their associated bits in the XCR0 control register, while the supervisor-state items are enabled by setting their associated bits in the IA32_XSS (0DA0h) MSR - the indicated state items then become the state-components that can be saved and restored with the XSAVE/XRSTOR family of instructions.

The XSAVE mechanism can handle up to 63 state-components in this manner. State-components 0 and 1 (x87 and SSE, respectively) have fixed offsets and sizes - for state-components 2 to 62, their sizes, offsets and a few additional flags can be queried by executing CPUID with EAX=0Dh and ECX set to the index of the state-component. This will return the following items in EAX, EBX and ECX (with EDX being reserved):

CPUID EAX=0Dh, ECX≥2: XSAVE state-component information
BitEAXEBXECXBit
0 Size in bytes of state-component Offset of state-component from the start of the XSAVE/XRSTOR save area

(This offset is 0 for supervisor state-components, since these can only be saved with the XSAVES/XRSTORS instruction, which use compacting.)

User/supervisor state-component:
  • 0=user-state (enabled through XCR0)
  • 1=supervisor-state (enabled through IA32_XSS)
0
1 64-byte alignment enable when state save compaction is used.

If this bit is set for a state-component, then, when storing state with compaction, padding will be inserted between the preceding state-component and this state-component as needed to provide 64-byte alignment. If this byte is not set, the state-component will be stored directly after the preceding one.

1
 
31:2
 
(reserved)  
31:2
 

Attempting to query an unsupported state-component in this manner results in EAX,EBX,ECX and EDX all being set to 0.


Sub-leaves 0 and 1 of CPUID leaf 0Dh are used to provide feature information:

CPUID EAX=0Dh,ECX=0: XSAVE features
EBXECXEDX:EAX
Maximum size (in bytes) of XSAVE save area for the set of state-components currently set in XCR0. Maximum size (in bytes) of XSAVE save area if all state-components supported by XCR0 on this CPU were enabled at the same time. 64-bit bitmap of state-components supported by XCR0 on this CPU.
CPUID EAX=0Dh,ECX=1: XSAVE extended features
EAXEBXEDX:ECX
XSAVE feature flags (see below table) Size (in bytes) of XSAVE area containing all the state-components currently set in XCR0 and IA32_XSS combined. 64-bit bitmap of state-components supported by IA32_XSS on this CPU.
EAX=0Dh,ECX=1: XSAVE feature flags in EAX
BitEAX
ShortFeature
0 xsaveoptXSAVEOPT instruction: save state-components that have been modified since last XRSTOR
1 xsavecXSAVEC instruction: save/restore state with compaction
2 xgetbv_ecx1XGETBV with ECX=1 support
3 xssXSAVES and XRSTORS instructions and IA32_XSS MSR: save/restore state with compaction, including supervisor state.
4 xfdXFD (Extended Feature Disable) supported
 
31:5
 
(reserved)

As of March 2023, the XSAVE state-components that have been architecturally defined are:

XSAVE State-components
IndexDescriptionEnabled with
0 x87 stateXCR0[lower-alpha 1]
1 SSE state: XMM0-XMM15 and MXCSRXCR0
2 AVX state: top halves of YMM0 to YMM15
3 MPX state: BND0-BND3 bounds registers
4 MPX state: BNDCFGU and BNDSTATUS registers
5 AVX-512 state: opmask registers k0-k7
6 AVX-512 "ZMM_Hi256" state: top halves of ZMM0 to ZMM15
7 AVX-512 "Hi16_ZMM" state: ZMM16-ZMM31
8 Processor Trace stateIA32_XSS
9 PKRU (User Protection Keys) registerXCR0
10 PASID (Process Address Space ID) stateIA32_XSS
11 CET_U state (Control-flow Enforcement Technology: user-mode functionality MSRs)
12 CET_S state (CET: shadow stack pointers for rings 0,1,2)
13 HDC (Hardware Duty Cycling) state
14 UINTR (User-Mode Interrupts) state
15 LBR (Last Branch Record) state
16 HWP (Hardware P-state control) state
17 AMX Tile configuration (TILECFG) stateXCR0
18 AMX Tile Data state
 
19 to 61
 
(reserved)
62 Lightweight Profiling (LWP) (AMD only)XCR0
63 (reserved)[lower-alpha 2]
  1. Bit 0 of XCR0 is hardwired to 1, so that the XSAVE instructions will always support save/restore of x87 state.
  2. For the XCR0 and IA32_XSS registers, bit 63 is reserved specifically for bit vector expansion - this precludes the existence of a state-component 63.

EAX=12h, ECX=0: SGX Leaf Functions

CPUID EAX=12h,ECX=0: SGX feature bits
BitEAX
ShortFeature
0 sgx1SGX1 leaf functions
1 sgx2SGX2 leaf functions
2 (reserved)
3 (reserved)
4 (reserved)
5 ossENCLV leaves: EINCVIRTCHILD, EDECVIRTCHILD, and ESETCONTEXT
6  ?ENCLS leaves: ETRACKC, ERDINFO, ELDBC, ELDUC
7  ?ENCLU leaf: EVERIFYREPORT2
8 (reserved)
9 (reserved)
10  ?ENCLS leaf: EUPDATESVN
11  ?ENCLU leaf: EDECSSA
12 (reserved)
13 (reserved)
14 (reserved)
15 (reserved)
16 (reserved)
17 (reserved)
18 (reserved)
19 (reserved)
20 (reserved)
21 (reserved)
22 (reserved)
23 (reserved)
24 (reserved)
25 (reserved)
26 (reserved)
27 (reserved)
28 (reserved)
29 (reserved)
30 (reserved)
31 (reserved)

EAX=14h, ECX=0

CPUID EAX=14h,ECX=0: Processor Trace feature bits in EBX
BitEBX
ShortFeature
0 (reserved)
1 (reserved)
2 (reserved)
3 (reserved)
4 ptwrite ?
5 (reserved)
6 (reserved)
7 (reserved)
8 (reserved)
9 (reserved)
10 (reserved)
11 (reserved)
12 (reserved)
13 (reserved)
14 (reserved)
15 (reserved)
16 (reserved)
17 (reserved)
18 (reserved)
19 (reserved)
20 (reserved)
21 (reserved)
22 (reserved)
23 (reserved)
24 (reserved)
25 (reserved)
26 (reserved)
27 (reserved)
28 (reserved)
29 (reserved)
30 (reserved)
31 (reserved)


EAX=19h: AES Key Locker features

This leaf provides feature information for AES Key Locker in EAX, EBX and ECX. EDX is reserved.

CPUID EAX=19h: Key Locker feature bits in EAX, EBX and ECX
Bit EAX EBX ECX Bit
ShortFeature ShortFeature ShortFeature
0 Key Locker restriction of CPL0-only supported aes_kleAES "Key Locker" Instructions No-backup parameter to LOADIWKEY supported 0
1 Key Locker restriction of no-encrypt supported (reserved) KeySource encoding of 1 (randomization of internal wrapping key) supported 1
2 Key Locker restriction of no-decrypt supported aes_wide_klAES "Wide Key Locker" Instructions (reserved) 2
3 (reserved) (reserved) (reserved) 3
4 (reserved) kl_msrs"Key Locker" MSRs (reserved) 4
 
31:5
 
(reserved) (reserved) (reserved)  
31:5
 

EAX=80000000h: Get Highest Extended Function Implemented

The highest calling parameter is returned in EAX.

EAX=80000001h: Extended Processor Info and Feature Bits

This returns extended feature flags in EDX and ECX.

Many of the bits in EDX (bits 0 through 9, 12 through 17, 23, and 24) are duplicates of EDX from the EAX=1 leaf - these bits are highlighted in light yellow.

AMD feature flags are as follows:[42][43]

CPUID EAX=80000001h: Feature bits in EDX and ECX
Bit EDX ECX Bit
Short Feature Short Feature
0 fpuOnboard x87 FPU lahf_lmLAHF/SAHF in long mode 0
1 vmeVirtual mode extensions (VIF) cmp_legacyHyperthreading not valid 1
2 deDebugging extensions (CR4 bit 3) svmSecure Virtual Machine 2
3 psePage Size Extension extapicExtended APIC space 3
4 tscTime Stamp Counter cr8_legacyCR8 in 32-bit mode 4
5 msrModel-specific registers abm/lzcntAdvanced bit manipulation (LZCNT and POPCNT) 5
6 paePhysical Address Extension sse4aSSE4a 6
7 mceMachine Check Exception misalignsseMisaligned SSE mode 7
8 cx8CMPXCHG8B (compare-and-swap) instruction 3dnowprefetchPREFETCH and PREFETCHW instructions 8
9 apicOnboard Advanced Programmable Interrupt Controller osvwOS Visible Workaround 9
10 (syscall)[lower-alpha 1] (SYSCALL/SYSRET, K6 only) ibsInstruction Based Sampling 10
11 syscall[lower-alpha 2]SYSCALL and SYSRET instructions xopXOP instruction set 11
12 mtrrMemory Type Range Registers skinitSKINIT/STGI instructions 12
13 pgePage Global Enable bit in CR4 wdtWatchdog timer 13
14 mcaMachine check architecture (reserved) 14
15 cmovConditional move and FCMOV instructions lwpLight Weight Profiling[47] 15
16 pat[lower-alpha 3] Page Attribute Table fma44-operand fused multiply-add instructions 16
17 pse3636-bit page size extension tceTranslation Cache Extension 17
18 (reserved) (reserved) 18
19 ecc"Athlon MP" / "Sempron" CPU brand identification[lower-alpha 4] nodeid_msrNodeID MSR (C001_100C)[52] 19
20 nxNX bit (reserved) 20
21 (reserved) tbmTrailing Bit Manipulation 21
22 mmxextExtended MMX topoextTopology Extensions 22
23 mmxMMX instructions perfctr_coreCore performance counter extensions 23
24 fxsr[lower-alpha 3]FXSAVE, FXRSTOR instructions, CR4 bit 9 perfctr_nbNorthbridge performance counter extensions 24
25 fxsr_optFXSAVE/FXRSTOR optimizations (reserved) 25
26 pdpe1gbGigabyte pages dbxData breakpoint extensions 26
27 rdtscpRDTSCP instruction perftscPerformance timestamp counter (PTSC) 27
28 (reserved) pcx_l2iL2I perf counter extensions 28
29 lmLong mode monitorxMONITORX and MWAITX instructions 29
30 3dnowextExtended 3DNow! addr_mask_extAddress mask extension to 32 bits for instruction breakpoints 30
31 3dnow3DNow! (reserved) 31
  1. The use of EDX bit 10 to indicate support for SYSCALL/SYSRET is only valid on AuthenticAMD Family 5 Model 7 CPUs (AMD K6, 250nm "Little Foot") - for all other processors, EDX bit 11 should be used instead.

    These instructions were first introduced on Model 7[44] - the CPUID bit to indicate their support was moved[45] to EDX bit 11 from Model 8 (AMD K6-2) onwards.

  2. On Intel CPUs, the CPUID bit for SYSCALL/SYSRET is only set if the CPUID instruction is executed in 64-bit mode.[46]
  3. On some processors - Cyrix MediaGXm,[48] several Geodes (NatSemi Geode GXm, GXLV, GX1; AMD Geode GX1[49]) and Transmeta Crusoe[50] - EDX bits 16 and 24 have a different meaning:
    • Bit 16: Floating-point Conditional Move (FCMOV) supported
    • Bit 24: 6x86MX Extended MMX instructions supported
  4. EDX bit 19 is used for CPU brand identification on AuthenticAMD Family 6 processors only - the bit is, combined with processor signature and FSB speed, used to identify processors as either multiprocessor-capable or carrying the Sempron brand name.[51]

EAX=80000002h,80000003h,80000004h: Processor Brand String

These return the processor brand string in EAX, EBX, ECX and EDX. CPUID must be issued with each parameter in sequence to get the entire 48-byte null-terminated ASCII processor brand string.[53] It is necessary to check whether the feature is present in the CPU by issuing CPUID with EAX = 80000000h first and checking if the returned value is not less than 80000004h.

#include <stdio.h>
#include <string.h>
#include <cpuid.h>

int main()
{
    unsigned int regs[12];
    char str[sizeof(regs)];

    __cpuid(0x80000000, regs[0], regs[1], regs[2], regs[3]);

    if (regs[0] < 0x80000004)
        return 1;

    __cpuid(0x80000002, regs[0], regs[1], regs[2], regs[3]);
    __cpuid(0x80000003, regs[4], regs[5], regs[6], regs[7]);
    __cpuid(0x80000004, regs[8], regs[9], regs[10], regs[11]);

    memcpy(str, regs, sizeof(regs));
    printf("%s\n", str);

    return 0;
}

EAX=80000005h: L1 Cache and TLB Identifiers

This function contains the processor’s L1 cache and TLB characteristics.

EAX=80000006h: Extended L2 Cache Features

Returns details of the L2 cache in ECX, including the line size in bytes (Bits 07 - 00), type of associativity (encoded by a 4 bits field; Bits 15 - 12) and the cache size in KB (Bits 31 - 16).

#include <stdio.h>
#include <cpuid.h>

int main()
{
    unsigned int eax, ebx, ecx, edx;
    unsigned int lsize, assoc, cache;

    __cpuid(0x80000006, eax, ebx, ecx, edx);
    
    lsize = ecx & 0xff;
    assoc = (ecx >> 12) & 0x07;
    cache = (ecx >> 16) & 0xffff;

    printf("Line size: %d B, Assoc. type: %d, Cache size: %d KB.\n", lsize, assoc, cache);

    return 0;
}

EAX=80000007h: Advanced Power Management Information

This function provides advanced power management feature identifiers. EDX bit 8 indicates support for invariant TSC.

EAX=80000008h: Virtual and Physical address Sizes

CPUID EAX=80000008h: Feature bits in EBX
Bit EBX
ShortFeature
0 clzeroCLZERO instruction
1 retired_instrRetired instruction count MSR (C000_00E9h) supported
2 xrstor_fp_errXRSTOR restores FP errors
3 invlpgbINVLPGB and TLBSYNC instructions
4 rdpruRDPRU instruction
5 (reserved)
6 mbeMemory Bandwidth Enforcement
7 (reserved)
8 mcommitMCOMMIT instruction
9 wbnoinvdWBNOINVD instruction
10 (reserved)
11 (reserved)
12 ibpbIndirect Branch Prediction Barrier
13 wbinvd_intWBINVD and WBNOINVD are interruptible
14 IBRSIndirect Branch Restricted Speculation
15 STIBPSingle Thread Indirect Branch Prediction mode
16 IbrsAlwaysOnIBRS mode has enhanced performance and should be left always on
17 StibpAlwaysOnSTIBP mode has enhanced performance and should be left always on
18 ibrs_preferredIBRS preferred over software
19 ibrs_same_mode_protectionIBRS provides Same Mode Protection
20 no_efer_lmsleEFER.LMSLE is unsupported
21 invlpgb_nestedINVLPGB support for nested pages
22 (reserved)
23 ppinProtected Processor Inventory Number -

PPIN_CTL (C001_02F0) and PPIN (C001_02F1) MSRs are present

24 ssbdSpeculative Store Bypass Disable
25 ssbd_legacySpeculative Store Bypass Disable Legacy
26 ssbd_noSpeculative Store Bypass Disable Not Required
27 cppcCollaborative Processor Performance Control
28 psfdPredictive Store Forward Disable
29 btc_noBranch Type Confusion: Processor not affected
30 (reserved)
31 branch_samplingBranch Sampling Support[54]
CPUID EAX=80000008h: Size and range fields in EAX, ECX, EDX
Bits EAX ECX EDX Bits
7:0 Number of Physical Address Bits Number of Physical Cores (minus 1) Maximum page count for INVLPGB instruction 7:0
11:8 Number of Linear Address Bits (reserved) 11:8
15:12 APIC ID Size 15:12
17:16 Guest Physical Address Size Performance Timestamp Counter size Maximum ECX value recognized by RDPRU instruction 17:16
23:18 (reserved) 23:18
31:24 (reserved) 31:24

EAX=8000000Ah: Secure Virtual Machine features

This leaf returns information about AMD SVM (Secure Virtual Machine) features in EAX, EBX and EDX.

CPUID EAX=8000000Ah: SVM information in EAX, EBX and ECX
Bits EAX EBX ECX Bits
7:0 SVM Revision Number Number of available ASIDs
(address space identifiers)
(reserved) 7:0
31:8 (reserved) 31:8
CPUID EAX=8000000Ah: SVM feature flags in EDX
Bit EDX
ShortFeature
0 NPRapid Virtualization Indexing (Nested Paging)
1 LbrVirtLBR (Last Branch Records) virtualization
2 SVMLSVM-Lock
3 NRIPSnRIP (next sequential instruction pointer) save on #VMEXIT supported
4 TscRateMsrMSR-based TSC rate control (MSR C000_0104h)
5 VmcbCleanVMCB (Virtual Machine Control Block) clean bits supported
6 FlushByAsidTLB flush events (e.g. CR3 writes, CR4.PGE toggles) only flush the TLB entries of the current ASID (address space ID)
7 DecodeAssistDecode assists supported
8 (reserved)
9 (SseIsa10Compat)[lower-alpha 1] (reserved)
10 PauseFilterPAUSE intercept filter supported
11 (reserved)
12 PauseFilter­ThresholdPAUSE filter cycle count threshold supported
13 AVICAMD Advanced Virtualized Interrupt Controller supported
14 (reserved)
15 VMSAVEvirtVMSAVE and VMLOAD virtualization
16 VGIFGlobal Interrupt Flag (GIF) virtualization
17 GMETGuest Mode Execution Trap
18 x2AVICx2APIC mode supported for AVIC
19 SSSCheckSVM Supervisor shadow stack restrictions
20 SpecCtrlSPEC_CTRL (MSR 2E0h) virtualization
21 ROGPTRead-Only Guest Page Table supported
22 (reserved)
23 HOST_MCE_­OVERRIDEGuest mode Machine-check exceptions when host CR4.MCE=1 and guest CR4.MCE=0 cause intercepts instead of shutdowns
24 TlbiCtlINVLPGB/TLBSYNC hypervisor enable in VMCB and TLBSYNC intercept support
25 VNMINMI (Non-Maskable interrupt) virtualization
26 IbsVirtIBS (Instruction-Based Sampling) virtualization
27 ExtLvtOffset­FaultChgRead/Write fault behavior for extended LVT offsets (APIC addresses 0x500-0x530) changed to Read Allowed, Write #VMEXIT[57]
28 VmcbAddr­ChkChgVMCB address check change[57]
29 (reserved)
30 (reserved)
31 (reserved)
  1. EDX bit 9 is briefly listed in some older revisions of AMD's document #25481 "CPUID Specification" - it is not known to have ever been implemented.

    Rev 2.28 of #25481 lists the bit as "Ssse3Sse5Dis"[55] - in rev 2.34, it is listed has having been removed from the spec at rev 2.32 under the name "SseIsa10Compat".[56]

EAX=8000001Fh: Encrypted Memory Capabilities

CPUID EAX=8000001Fh: Encrypted Memory feature bits in EAX
Bit EAX
ShortFeature
0 SMESecure Memory Encryption
1 SEVSecure Encrypted Virtualization
2 PageFlushMSRPage flush MSR (C001_011Eh) supported
3 SEV-ESSEV Encrypted State
4 SEV-SNPSEV Secure Nested Paging
5 VMPLVM Permission Levels
6 RMPQUERYRMPQUERY instruction supported
7 VmplSSSVMPL Supervisor shadow stack supported
8 SecureTSCSecure TSC supported
9 TscAux­VirtualizationVirtualization of TSC_AUX MSR (C000_0103) supported
10 HwEnfCacheCohHardware cache coherency across encryption domains enforced
11 64BitHostSEV Guest execution only allowed from 64-bit host
12 Restricted­InjectionSEV-ES guests can refuse all event-injections except #HV
13 Alternate­InjectionSEV-ES guests can use an encrypted VMCB field for event-injection
14 DebugSwapFull debug state swap supported for SEV-ES guests
15 PreventHostIBSPrevent host IBS for a SEV-ES guest
16 VTEVirtual Transparent Encryption for SEV
17 Vmgexit­ParameterVMGEXIT parameter is supported (using the RAX register)
18 VirtualTomMsrVirtual TOM (top-of-memory) MSR (C001_0135) supported
19 IbsVirtGuestCtlIBS state virtualization is supported for SEV-ES guests
20 (reserved)
21 (reserved)
22 (reserved)
23 (reserved)
24 VmsaRegProtVMSA Register protection supported
25 (reserved)
26 (reserved)
27 (reserved)
28 SVSMComm­PageMSRSVSM Communcation Page MSR (C001_F000h) supported
29 NestedVirt­SnpMsrVIRT_RMPUPDATE (C001_F001h) and VIRT_PSMASH (C001_F002h) MSRs supported
30 (reserved)
31 (reserved)
CPUID EAX=8000001Fh: Encrypted Memory feature information in EBX, ECX and EDX
Bits EBX ECX EDX Bits
5:0 C-bit (encryption enable bit) location in page table entry Maximum ASID value that can be used for a SEV-enabled guest

(=maximum number of encrypted guests that can be supported simultaneously)

Minimum ASID value for a guest that is SEV-enabled but not SEV-ES-enabled 5:0
11:6 Physical address width reduction when memory encryption is enabled 11:6
15:12 Number of VMPLs (VM Privilege Levels) supported 15:12
 
31:16
 
(reserved)  
31:16
 

EAX=80000021h: Extended Feature Identification 2

CPUID EAX=80000021h: Extended feature bits in EAX
Bit EAX
Short Feature
0 NoNestedDataBpProcessor ignores nested data breakpoints
1 FsGsKernelGsBase­NonSerializingWRMSR to the FS_BASE, GS_BASE and KernelGSBase MSRs is non-serializing[58]
2 LFenceAlways­SerializingLFENCE is always dispatch serializing
3 SmmPgCfgLockSMM paging configuration lock supported
4 (reserved)
5 (reserved)
6 NullSelect­ClearsBaseNull segment selector loads also clear the destination segment register base and limit
7 UpperAddress­IgnoreUpper Address Ignore is supported
8 AutomaticIBRSAutomatic IBRS
9 NoSmmCtlMSRSMM_CTL MSR (C0010116h) is not supported
10 FSRSFast short REP STOSB supported
11 FSRCFast short REPE CMPSB supported
12 (reserved)
13 PrefetchCtlMsrPrefetchControl MSR (C0000108h) is supported
14 (reserved)
15 (reserved)
16 (reserved)
17 CpuidUserDisCPUID disable for non-privileged software
18 EPSFEnhanced Predictive Store Forwarding supported
31:19 (reserved)
CPUID EAX=80000021h: Extended feature information in EBX
BitEBX
ShortFeature
11:0 MicrocodePatchSizeThe size of the Microcode patch in 16-byte multiples. If 0, the size of the patch is at most 5568 (15C0h) bytes
31:12 (reserved)

EAX=8FFFFFFFh: AMD Easter Egg

Several AMD CPU models will, for CPUID with EAX=8FFFFFFFh, return an Easter Egg string in EAX, EBX, ECX and EDX.[59][60] Known Easter Egg strings include:

ProcessorString
AMD K6NexGenerationAMD
AMD K8IT'S HAMMER TIME
AMD Jaguar[61]HELLO KITTY! ^-^

CPUID usage from high-level languages

Inline assembly

This information is easy to access from other languages as well. For instance, the C code for gcc below prints the first five values, returned by the cpuid:

#include <stdio.h>
#include <cpuid.h>

int main()
{
    unsigned int i, eax, ebx, ecx, edx;

    for (i = 0; i < 5; i++) {
        __cpuid(i, eax, ebx, ecx, edx);
        printf ("InfoType %x\nEAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n", i, eax, ebx, ecx, edx);
    }

    return 0;
}

In MSVC and Borland/Embarcadero C compilers (bcc32) flavored inline assembly, the clobbering information is implicit in the instructions:

#include <stdio.h>

int main()
{
    unsigned int a, b, c, d, i = 0;

    __asm {
        /* Do the call. */
        mov EAX, i;
        cpuid;
        /* Save results. */
        mov a, EAX;
        mov b, EBX;
        mov c, ECX;
        mov d, EDX;
    }

    printf ("InfoType %x\nEAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n", i, a, b, c, d);
    return 0;
}

If either version was written in plain assembly language, the programmer must manually save the results of EAX, EBX, ECX, and EDX elsewhere if they want to keep using the values.

Wrapper functions

GCC also provides a header called <cpuid.h> on systems that have CPUID. The __cpuid is a macro expanding to inline assembly. Typical usage would be:

#include <stdio.h>
#include <cpuid.h>

int main()
{
    unsigned int eax, ebx, ecx, edx;

    __cpuid(0 /* vendor string */, eax, ebx, ecx, edx);
    printf("EAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n", eax, ebx, ecx, edx);

    return 0;
}

But if one requested an extended feature not present on this CPU, they would not notice and might get random, unexpected results. Safer version is also provided in <cpuid.h>. It checks for extended features and does some more safety checks. The output values are not passed using reference-like macro parameters, but more conventional pointers.

#include <stdio.h>
#include <cpuid.h>

int main()
{
    unsigned int eax, ebx, ecx, edx;

    /* 0x81234567 is nonexistent, but assume it exists */
    if (!__get_cpuid (0x81234567, &eax, &ebx, &ecx, &edx)) {
        printf("Warning: CPUID request 0x81234567 not valid!\n");
        return 1;
    }

    printf("EAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n", eax, ebx, ecx, edx);

    return 0;
}

Notice the ampersands in &a, &b, &c, &d and the conditional statement. If the __get_cpuid call receives a correct request, it will return a non-zero value, if it fails, zero.[62]

Microsoft Visual C compiler has builtin function __cpuid() so the cpuid instruction may be embedded without using inline assembly, which is handy since the x86-64 version of MSVC does not allow inline assembly at all. The same program for MSVC would be:

#include <stdio.h>
#ifdef __MSVC__
    #include <intrin.h>
#endif

int main()
{
    unsigned int regs[4];
    int i;

    for (i = 0; i < 4; i++) {
        __cpuid(regs, i);
        printf("The code %d gives %d, %d, %d, %d", regs[0], regs[1], regs[2], regs[3]);
    }

    return 0;
}

Many interpreted or compiled scripting languages are capable of using CPUID via an FFI library. One such implementation shows usage of the Ruby FFI module to execute assembly language that includes the CPUID opcode.

.NET 5 and later versions provide the System.Runtime.Intrinsics.X86.X86base.CpuId method. For instance, the C# code below prints the processor brand if it supports CPUID instruction:

using System.Runtime.InteropServices;
using System.Runtime.Intrinsics.X86;
using System.Text;

namespace X86CPUID {
    class CPUBrandString {
        public static void Main(string[] args) {
            if (!X86Base.IsSupported) {
                Console.WriteLine("Your CPU does not support CPUID instruction.");
            } else {
                Span<int> raw = stackalloc int[12];
                (raw[0], raw[1], raw[2],  raw[3])  = X86Base.CpuId(unchecked((int)0x80000002), 0);
                (raw[4], raw[5], raw[6],  raw[7])  = X86Base.CpuId(unchecked((int)0x80000003), 0);
                (raw[8], raw[9], raw[10], raw[11]) = X86Base.CpuId(unchecked((int)0x80000004), 0);

                Span<byte> bytes = MemoryMarshal.AsBytes(raw);
                string brand = Encoding.UTF8.GetString(bytes).Trim();
                Console.WriteLine(brand);
            }
        }
    }
}

CPU-specific information outside x86

Some of the non-x86 CPU architectures also provide certain forms of structured information about the processor's abilities, commonly as a set of special registers:

  • ARM architectures have a CPUIDcoprocessor register which requires EL1 or above to access.[63]
  • The IBM System z mainframe processors have a Store CPU ID (STIDP) instruction since the 1983 IBM 4381[64] for querying the processor ID.[65]
  • The IBM System z mainframe processors also have a Store Facilities List Extended (STFLE) instruction which lists the installed hardware features.[65]
  • The MIPS32/64 architecture defines a mandatory Processor Identification (PrId) and a series of daisy-chained Configuration Registers.[66]
  • The PowerPC processor has the 32-bit read-only Processor Version Register (PVR) identifying the processor model in use. The instruction requires supervisor access level.[67]

DSP and transputer-like chip families have not taken up the instruction in any noticeable way, in spite of having (in relative terms) as many variations in design. Alternate ways of silicon identification might be present; for example, DSPs from Texas Instruments contain a memory-based register set for each functional unit that starts with identifiers determining the unit type and model, its ASIC design revision and features selected at the design phase, and continues with unit-specific control and data registers. Access to these areas is performed by simply using the existing load and store instructions; thus, for such devices, there is no need for extending the register set for device identification purposes.

See also

References

  1. "Intel 64 and IA-32 Architectures Software Developer's Manual" (PDF). Intel.com. Retrieved 2013-04-11.
  2. "Detecting Intel Processors - Knowing the generation of a system CPU". Rcollins.org. Retrieved 2013-04-11.
  3. "LXR linux-old/arch/i386/kernel/head.S". Lxr.linux.no. Archived from the original on 2012-07-13. Retrieved 2013-04-11.
  4. "CPUID, EAX=4 - Strange results (Solved)". Software.intel.com. Retrieved 2014-07-10.
  5. instlatx64, CPUID dump for RDC IAD 100. Retrieved 22 December 2022.
  6. "ao486 CPUID instruction". GitHub. 12 March 2022.
  7. "v586: 586 compatible soft core for FPGA". GitHub. 6 December 2021.
  8. "Steam Hardware & Software Survey". store.steampowered.com. Retrieved 2022-07-26.
  9. "Fun with Timers and cpuid - by Jim Cownie - CPU fun". 3 March 2021.
  10. "Chapter 3 Instruction Set Reference, A-L" (PDF). Intel® 64 and IA-32 Architectures Software Developer's Manual. Intel Corporation. 2018-12-20. Retrieved 2018-12-20.
  11. Intel, Pentium® Processor Family Developer’s Manual, 1997, order no. 241428-005, sections 3.4.1.2 (page 91), 17.5.1 (page 489) and appendix A (page 522) provide more detail on how the "processor type" field and the "dual processor" designation work.
  12. http://bochs.sourceforge.net/techspec/24161821.pdf
  13. Linux 6.3 kernel sources, /arch/x86/include/asm/cpuid.h, line 69
  14. gcc-patches mailing list, CPUID Patch for IDT Winchip, May 21, 2019
  15. Geoff Chappell, CMPXCHG8B Support in the 32-Bit Windows Kernel, Jan 23, 2008
  16. AMD, AMD Processor Recognition Application Note, publication #20734, rev D, Jan 1997, page 13
  17. Intel, AP-485 Application Note - Intel Processor Identification and the CPUID Instruction, order no. 241618-006, march 1997, table 5 on page 10, see bit 10.
  18. Michal Necasek, SYSENTER, Where Are You?, OS/2 Museum, July 20, 2017
  19. Geoff Chappell, ECX From CPUID Leaf 1, Jan 26, 2020. Archived on May 9, 2020.
  20. Huggahalli, Ram; Iyer, Ravi; Tetrick, Scott (2005). "Direct Cache Access for High Bandwidth Network I/O". ACM SIGARCH Computer Architecture News. 33 (2): 50–59. doi:10.1145/1080695.1069976. CiteSeerX:10.1.1.91.957.
  21. Drepper, Ulrich (2007), What Every Programmer Should Know About Memory, CiteSeerX:10.1.1.91.957
  22. Intel, Itanium Architecture Software Developer's Manual, rev 2.3, volume 4: IA-32 Instruction Set, may 2010, document number: 323208, table 2-5, page 4:81, see bits 20 and 30. Archived on Feb 15, 2012.
  23. Intel, AP-485, Processor Identification and the CPUID Instruction flag, rev 30, jan 2006, page 26
  24. Michal Necasek, HTT Means Hyper-Threading, Right?, OS/2 Museum, dec 11, 2017
  25. "Mechanisms to determine if software is running in a VMware virtual machine". VMware Knowledge Base. VMWare. 2015-05-01. Intel and AMD CPUs have reserved bit 31 of ECX of CPUID leaf 0x1 as the hypervisor present bit. This bit allows hypervisors to indicate their presence to the guest operating system. Hypervisors set this bit and physical CPUs (all existing and future CPUs) set this bit to zero. Guest operating systems can test bit 31 to detect if they are running inside a virtual machine.
  26. Kataria, Alok; Hecht, Dan (2008-10-01). "Hypervisor CPUID Interface Proposal". LKML Archive on lore.kernel.org. Archived from the original on 2019-03-15. Bit 31 of ECX of CPUID leaf 0x1. This bit has been reserved by Intel & AMD for use by hypervisors and indicates the presence of a hypervisor. Virtual CPU's (hypervisors) set this bit to 1 and physical CPU's (all existing and future CPU's) set this bit to zero. This bit can be probed by the guest software to detect whether they are running inside a virtual machine.
  27. Shih Kuo (Jan 27, 2012). "Intel® 64 Architecture Processor Topology Enumeration".
  28. "Processor and Core Enumeration Using CPUID | AMD". Developer.amd.com. Archived from the original on 2014-07-14. Retrieved 2014-07-10.
  29. "Sandybridge processors report incorrect core number?". Software.intel.com. 2012-12-29. Retrieved 2014-07-10.
  30. "cpuid, __cpuidex". Msdn.microsoft.com. 2014-06-20. Retrieved 2014-07-10.
  31. "x86 architecture - CPUID". sandpile.org. Retrieved 2014-07-10.
  32. "topology.cpp in ps/trunk/source/lib/sysdep/arch/x86_x64 – Wildfire Games". Trac.wildfiregames.com. 2011-12-27. Retrieved 2014-07-10.
  33. Hyper-Threading Technology and Multi-Core Processor Detection
  34. Intel, Processor Identification and the CPUID Instruction, order no. 241618-038, apr 2012, p.38
  35. Intel, Product Change Notification 108701, 1 aug 2008. Archived on May 11, 2023
  36. Intel, Deprecating the PCOMMIT instruction, sep 12, 2016. Archived on Apr 23, 2023.
  37. Intel, AVX512-FP16 Architecture Specification (PDF), document number 347407-001, June 2021. Archived on Oct 26, 2022
  38. "Speculative Execution Side Channel Mitigations" (PDF). Revision 2.0. Intel. May 2018 [January 2018]. Document Number: 336996-002. Retrieved 2018-05-26.
  39. "IBRS patch series [LWN.net]".
  40. Intel, Branch History Injection and Intra-mode Branch Target Injection / CVE-2022-0001, CVE-2022-0002 / INTEL-SA-00598, 4 Aug 2022. Archived on 5 May 2023.
  41. Intel, Return Stack Buffer Underflow / CVE-2022-29901, CVE-2022-28693 / INTEL-SA-00702, 12 Jul 2022. Archived on 13 Jul 2022.
  42. CPUID Specification, publication no.25481, rev 2.34 (PDF), AMD, September 2010, retrieved 2023-04-25
  43. Linux kernel source code
  44. AMD, AMD-K6 Processor Data Sheet, order no. 20695H/0, march 1998, section 24.2, page 283
  45. AMD, AMD-K6 Processor Revision Guide, order no. 21846H/0, June 1999, section 3.2.1, page 17
  46. Intel, Intel® 64 and IA-32 Architectures Software Developer’s Manual, order no. 325462-079, march 2023, table 3-8 on page 3-238
  47. Lightweight Profiling Specification (PDF), AMD, August 2010, archived from the original (PDF) on 2012-11-27, retrieved 2013-04-03
  48. Cyrix, Cyrix CPU Detection Guide, rev 1.01, oct 2, 1997, page 12
  49. AMD, Geode™ GX1 Processor Data Book, rev 5.0, december 2003, pages 202 and 226
  50. Transmeta, Processor Recognition, 2002-05-07, page 5
  51. AMD, Processor Recognition Application Note, pub.no. 20734, rev. 3.13, december 2005. Section 2.2.2 (p.20) and Section 3 (pages 33 to 40) provide details on how CPUID:(EAX=80000001).EDX[bit 19] should be used to identify processors. Archived from the original on Jun 26, 2006.
  52. AMD, Family 10h BKDG, document no. 31116, rev 3.62, jan 11, 2013, p. 388 - lists the NodeId bit.
  53. "Intel® Processor Identification and the CPUID Instruction" (PDF). Download.intel.com. 2012-03-06. Retrieved 2013-04-11.
  54. AMD, PPR for AMD Family 19h Model 01h, Revision B1 Processors, Volume 1 of 2, document no. 55898, rev 0.50, may 27, 2021, page 98 - lists branch-sampling bit. Archived on Jul 24, 2022
  55. AMD, CPUID specification, publication #25481, revision 2.28, apr 2008, page 21.
  56. AMD, CPUID specification, publication #25481, revision 2.34, sep 2010, page 5 - lists "SseIsa10Compat" as having been dropped in November 2009.
  57. AMD, PPR for AMD Family 19h Model 61h, Revision B1 processors, document no. 56713, rev 3.05, mar 8 2023, page 102. Archived on Apr 25, 2023.
  58. AMD, PPR for AMD Family 19h Model 61h, Revision B1 processors, document no. 56713, rev 3.05, mar 8 2023, page 116. Archived on Apr 25, 2023.
  59. Ferrie, Peter. "Attacks on Virtual Machine Emulators" (PDF). symantec.com. Symantec Advanced Threat Research. Archived from the original (PDF) on 2007-02-07. Retrieved 15 March 2017.
  60. Sandpile, x86 architecture CPUID. Retrieved 22 December 2022.
  61. instlatx64, CPUID dump of AMD A4-5000, lists "HELLO KITTY" string for CPUID leaf 8FFFFFFFh. Retrieved 22 December 2022.
  62. "GCC-mirror/GCC". GitHub. 13 March 2022.
  63. "ARM Information Center". Infocenter.arm.com. Retrieved 2013-04-11.
  64. "Processor version codes and SRM constants". Archived from the original on 2014-09-08. Retrieved 2014-09-08.
  65. "IBM System z10 Enterprise Class Technical Guide" (PDF).
  66. "MIPS32 Architecture For Programmers, Volume III: The MIPS32 Privileged Resource Architecture" (PDF). MIPS Technologies, Inc. 2001-03-12.
  67. "PowerPC Operating Environment Architecture, book III" (PDF).

Further reading

This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.