![]() | This articlemay be too technical for most readers to understand. Pleasehelp improve it tomake it understandable to non-experts, without removing the technical details.(January 2025) (Learn how and when to remove this message) |
In thex86 architecture, theCPUID instruction (identified by aCPUID
opcode) is aprocessor supplementary instruction (its name derived from "CPU Identification") allowing software to discover details of the processor. It was introduced byIntel in 1993 with the launch of thePentium andSL-enhanced 486 processors.[1]
A program can use theCPUID
to determine processor type and whether features such asMMX/SSE are implemented.
Prior to the general availability of theCPUID
instruction, programmers would write esotericmachine code which exploited minor differences in CPU behavior in order to determine the processor make and model.[2][3][4][5] With the introduction of the 80386 processor, EDX on reset indicated the revision but this was only readable after reset and there was no standard way for applications to read the value.
Outside the x86 family, developers are mostly still required to use esoteric processes (involving instruction timing or CPU fault triggers) to determine the variations in CPU design that are present.
For example, in theMotorola 68000 series — which never had aCPUID
instruction of any kind — certain specific instructions required elevated privileges. These could be used to tell various CPU family members apart. In theMotorola 68010 the instructionMOVE from SR became privileged. Because the68000 offered an unprivilegedMOVE from SR the two different CPUs could be told apart by a CPU error condition being triggered.
While theCPUID
instruction is specific to the x86 architecture, other architectures (like ARM) often provide on-chip registers which can be read in prescribed ways to obtain the same sorts of information provided by the x86CPUID
instruction.
TheCPUID
opcode is0F A2
.
Inassembly language, theCPUID
instruction takes no parameters asCPUID
implicitly uses the EAX register to determine the main category of information returned. In Intel's more recent terminology, this is called the CPUID leaf.CPUID
should be called withEAX = 0
first, as this will store in the EAX register the highest EAX calling parameter (leaf) that the CPU implements.
To obtain extended function informationCPUID
should be called with the most significant bit of EAX set. To determine the highest extended function calling parameter, callCPUID
withEAX = 80000000h
.
CPUID leaves greater than 3 but less than 80000000 are accessible only when themodel-specific registers have IA32_MISC_ENABLE.BOOT_NT4 [bit 22] = 0 (which is so by default). As the name suggests,Windows NT 4.0 until SP6 did not boot properly unless this bit was set,[6] but later versions of Windows do not need it, so basic leaves greater than 4 can be assumed visible on current Windows systems. As of April 2024[update], basic valid leaves go up to 23h, but the information returned by some leaves are not disclosed in the publicly available documentation, i.e. they are "reserved".
Some of the more recently added leaves also have sub-leaves, which are selected via the ECX register before callingCPUID
.
This returns the CPU's manufacturer ID string – a twelve-characterASCII string stored in EBX, EDX, ECX (in that order). The highest basic calling parameter (the largest value that EAX can be set to before callingCPUID
) is returned in EAX.
Here is a list of processors and the highest function implemented.
Processors | Basic | Extended |
---|---|---|
EarlierIntel 486 | CPUID Not Implemented | |
Later Intel 486 andPentium | 0x01 | Not Implemented |
Pentium Pro,Pentium II andCeleron | 0x02 | Not Implemented |
Pentium III | 0x03 | Not Implemented |
Pentium 4 | 0x02 | 0x8000 0004 |
Xeon | 0x02 | 0x8000 0004 |
Pentium M | 0x02 | 0x8000 0004 |
Pentium 4 withHyper-Threading | 0x05 | 0x8000 0008 |
Pentium D (8xx) | 0x05 | 0x8000 0008 |
Pentium D (9xx) | 0x06 | 0x8000 0008 |
Core Duo | 0x0A | 0x8000 0008 |
Core 2 Duo | 0x0A | 0x8000 0008 |
Xeon3000, 5100, 5200, 5300, 5400 (5000 series) | 0x0A | 0x8000 0008 |
Core 2 Duo8000 series | 0x0D | 0x8000 0008 |
Xeon 5200, 5400 series | 0x0A | 0x8000 0008 |
Atom | 0x0A | 0x8000 0008 |
Nehalem-based processors | 0x0B | 0x8000 0008 |
Ivy Bridge-based processors | 0x0D | 0x8000 0008 |
Skylake-based processors (proc base & max freq; Bus ref. freq) | 0x16 | 0x8000 0008 |
System-On-Chip Vendor Attribute Enumeration Main Leaf | 0x17 | 0x8000 0008 |
Meteor Lake-based processors | 0x23 | 0x8000 0008 |
The following are known processor manufacturer ID strings:
"AuthenticAMD"
– AMD"CentaurHauls"
– IDT WinChip/Centaur (Including some VIA and Zhaoxin CPUs)"CyrixInstead"
– Cyrix/earlySTMicroelectronics andIBM"GenuineIntel"
– Intel"GenuineIotel"
– Intel (rare)[7][8]"TransmetaCPU"
– Transmeta"GenuineTMx86"
– Transmeta"Geode by NSC"
– National Semiconductor"NexGenDriven"
– NexGen"RiseRiseRise"
– Rise"SiS SiS SiS "
– SiS"UMC UMC UMC "
– UMC"Vortex86 SoC"
– DM&PVortex86" Shanghai "
– Zhaoxin"HygonGenuine"
– Hygon"Genuine RDC"
– RDC Semiconductor Co. Ltd.[9]"E2K MACHINE"
– MCST Elbrus[10]"VIA VIA VIA "
– VIA[citation needed]"AMD ISBETTER"
– early engineering samples ofAMD K5 processor[11][12][better source needed]The following are ID strings used by open sourcesoft CPU cores:
"GenuineAO486"
– ao486 CPU (old)[13][14]"MiSTer AO486"
– ao486 CPU (new)[15][14]"GenuineIntel"
– v586 core[16] (this is identical to the Intel ID string)The following are known ID strings from virtual machines:
"MicrosoftXTA"
– Microsoft x86-to-ARM[17]"GenuineIntel"
– Apple Rosetta 2[18]"VirtualApple"
– Newer versions of Apple Rosetta 2"PowerVM Lx86"
– PowerVM Lx86 (x86 emulator for IBMPOWER5/POWER6 processors)[19]"Neko Project"
– Neko Project II (PC-98 emulator) (used when the CPU to emulate is set to "Neko Processor II")[20][21]For instance, on aGenuineIntel
processor, values returned in EBX is0x756e6547
, EDX is0x49656e69
and ECX is0x6c65746e
. The following example code displays the vendor ID string as well as the highest calling parameter that the CPU implements.
.intel_syntaxnoprefix.text.m0:.string"CPUID: %x\n".m1:.string"Largest basic function number implemented: %i\n".m2:.string"Vendor ID: %s\n".globlmainmain:pushr12moveax,1subrsp,16cpuidleardi,.m0[rip]movesi,eaxcallprintfmoveax,0cpuidleardi,.m1[rip]movesi,eaxmovr12d,edxmovebp,ecxcallprintfmov3[rsp],ebxlearsi,3[rsp]leardi,.m2[rip]mov7[rsp],r12dmov11[rsp],ebpcallprintfaddrsp,16popr12ret.section.note.GNU-stack,"",@progbits
On some processors, it is possible to modify the Manufacturer ID string reported by CPUID.(EAX=0) by writing a new ID string to particular MSRs (Model-specific registers) using theWRMSR
instruction. This has been used on non-Intel processors to enable features and optimizations that have been disabled in software for CPUs that don't return theGenuineIntel
ID string.[22] Processors that are known to possess such MSRs include:
Processor | MSRs |
---|---|
IDTWinChip | 108h-109h [23] |
VIA C3,C7 | 1108h-1109h [24] |
VIA Nano | 1206h-1207h [25] |
Transmeta Crusoe,Efficeon | 80860001h-80860003h [26][27] |
AMDGeode GX, LX | 3000h-3001h [28] |
DM&PVortex86EX2 | 52444300h-52444301h [29] |
This returns the CPU'sstepping, model, and family information in register EAX (also called thesignature of a CPU), feature flags in registers EDX and ECX, and additional feature info in register EBX.[30]
EAX | |||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
Reserved | Extended Family ID | Extended Model ID | Reserved | Processor Type | Family ID | Model | Stepping ID |
Type | Encoding inBinary |
---|---|
Original equipment manufacturer (OEM) Processor | 00 |
Intel Overdrive Processor | 01 |
Dual processor (applicable to IntelP5 Pentium processors only)[31] | 10 |
Reserved value | 11 |
As of October 2023, the following x86 processor family IDs are known:[32]
Family ID + Extended Family ID | Intel | AMD | Other |
---|---|---|---|
0h | — | — | — |
1h | — | — | — |
2h | — | — | — |
3h | [a] | — | — |
4h | 486 | 486,[33] 5x86, Élan SC4xx/5xx[34] | Cyrix 5x86,[35] CyrixMediaGX,[36] UMC Green CPU,[4] MCST Elbrus (most models),[10] MiSTer ao486[37] |
5h | Pentium, Pentium MMX, Quark X1000 | K5, K6 | Cyrix 6x86, CyrixMediaGXm,[36] Geode (except NX), NexGen Nx586,[4] IDTWinChip, IDT WinChip 2, IDT WinChip 3, Transmeta Crusoe, RisemP6, SiS 550, DM&PVortex86 (early),[38] RDC IAD 100, MCST Elbrus-8C2[10] |
6h | Pentium Pro, Pentium II, Pentium III, Pentium M, Intel Core (all variants), Intel Atom (all variants), Xeon (except NetBurstvariants), Xeon Phi (except KNC) | K7:Athlon, Athlon XP | Cyrix 6x86MX/MII, VIA C3, VIA C7, VIA Nano, DM&PVortex86 (DX3,EX2[39]), Zhaoxin ZX-A/B/C/C+, (Centaur CNS[40]), MCST Elbrus-12C/16C/2C3[10] |
7h | Itanium (in IA-32 mode) | — | Zhaoxin KaiXian, Zhaoxin KaisHeng |
8h | [b] | — | — |
9h | — | — | — |
0Ah | — | — | — |
0Bh | Xeon Phi (Knights Corner)[42] | — | — |
0Ch | — | — | — |
0Dh | — | — | — |
0Eh | — | — | — |
0Fh | NetBurst (Pentium 4) | K8/Hammer (Athlon 64) | Transmeta Efficeon |
10h | — | K10:Phenom | — |
11h | Itanium 2[43] (in IA-32 mode) | Turion X2 | — |
12h | — | Llano | — |
13h | Intel Core (Panther Cove and up)[44] | — | — |
14h | — | Bobcat | — |
15h | — | Bulldozer, Piledriver, Steamroller, Excavator | — |
16h | — | Jaguar, Puma | — |
17h | — | Zen 1, Zen 2 | — |
18h | — | Hygon Dhyana | |
19h | — | Zen 3, Zen 4 | — |
1Ah | — | Zen 5 | — |
Bits | EBX | Valid |
---|---|---|
7:0 | Brand Index | |
15:8 | CLFLUSH line size (Value * 8 = cache line size in bytes) | ifCLFLUSH feature flag is set.CPUID.01.EDX.CLFSH [bit 19]= 1 |
23:16 | Maximum number of addressable IDs for logical processors in this physical package; The nearest power-of-2 integer that is not smaller than this value is the number of unique initial APIC IDs reserved for addressing different logical processors in a physical package.[a] Former use: Number of logical processors per physical processor; two for the Pentium 4 processor with Hyper-Threading Technology.[47] | ifHyper-threading feature flag is set. CPUID.01.EDX.HTT [bit 28]= 1 |
31:24 | Local APIC ID: The initial APIC-ID is used to identify the executing logical processor.[b] | Pentium 4 and subsequent processors. |
The processor info and feature flags are manufacturer specific but usually, the Intel values are used by other manufacturers for the sake of compatibility.
Bit | EDX | ECX[a] | Bit | |||
---|---|---|---|---|---|---|
Short | Feature | Short | Feature | |||
0 | fpu | Onboardx87 FPU | sse3 | SSE3 (Prescott New Instructions - PNI) | 0 | |
1 | vme | Virtual 8086 mode extensions (such as VIF, VIP, PVI) | pclmulqdq | PCLMULQDQ (carry-less multiply) instruction | 1 | |
2 | de | Debugging extensions (CR4 bit 3) | dtes64 | 64-bit debug store (edx bit 21) | 2 | |
3 | pse | Page Size Extension (4 MB pages) | monitor | MONITOR andMWAIT instructions (PNI) | 3 | |
4 | tsc | Time Stamp Counter andRDTSC instruction | ds-cpl | CPL qualified debug store | 4 | |
5 | msr | Model-specific registers andRDMSR /WRMSR instructions | vmx | Virtual Machine eXtensions | 5 | |
6 | pae | Physical Address Extension | smx | Safer Mode Extensions (LaGrande) (GETSEC instruction) | 6 | |
7 | mce | Machine Check Exception | est | EnhancedSpeedStep | 7 | |
8 | cx8[b] | CMPXCHG8B (compare-and-swap) instruction | tm2 | Thermal Monitor 2 | 8 | |
9 | apic[c] | OnboardAdvanced Programmable Interrupt Controller | ssse3 | Supplemental SSE3 instructions | 9 | |
10 | (mtrr)[d] | (reserved) | cnxt-id | L1 Context ID | 10 | |
11 | sep[e] | SYSENTER andSYSEXIT fast system call instructions | sdbg | Silicon Debug interface | 11 | |
12 | mtrr | Memory Type Range Registers[f] | fma | Fused multiply-add (FMA3) | 12 | |
13 | pge | Page Global Enable bit inCR4 | cx16 | CMPXCHG16B instruction[g] | 13 | |
14 | mca | Machine check architecture | xtpr | Can disable sending task priority messages | 14 | |
15 | cmov | Conditional move:CMOV ,FCMOV andFCOMI instructions[h] | pdcm | Perfmon & debug capability | 15 | |
16 | pat | Page Attribute Table | (reserved)[i] | 16 | ||
17 | pse-36 | 36-bit page size extension | pcid | Process context identifiers (CR4 bit 17) | 17 | |
18 | psn | Processor Serial Number supported and enabled[j] | dca | Direct cache access for DMA writes[58][59] | 18 | |
19 | clfsh | CLFLUSH cache line flush instruction (SSE2) | sse4.1 | SSE4.1 instructions | 19 | |
20 | (nx) | No-execute (NX) bit (Itanium only, reserved on other CPUs)[60][k] | sse4.2 | SSE4.2 instructions | 20 | |
21 | ds | Debug store: save trace of executed jumps | x2apic | x2APIC (enhanced APIC) | 21 | |
22 | acpi | Onboard thermal control MSRs forACPI | movbe | MOVBE instruction (big-endian) | 22 | |
23 | mmx | MMX instructions (64-bit SIMD) | popcnt | POPCNT instruction | 23 | |
24 | fxsr | FXSAVE ,FXRSTOR instructions,CR4 bit 9 | tsc-deadline | APIC implements one-shot operation using a TSC deadline value | 24 | |
25 | sse | Streaming SIMD Extensions (SSE) instructions (aka "Katmai New Instructions"; 128-bit SIMD) | aes-ni | AES instruction set | 25 | |
26 | sse2 | SSE2 instructions | xsave | Extensible processor state save/restore:XSAVE ,XRSTOR ,XSETBV ,XGETBV instructions | 26 | |
27 | ss | CPU cache implements self-snoop | osxsave | XSAVE enabled by OS | 27 | |
28 | htt | Max APIC IDs reserved field is Valid[l] | avx | Advanced Vector Extensions (256-bit SIMD) | 28 | |
29 | tm | Thermal monitor automatically limits temperature | f16c | Floating-point conversion instructions to/fromFP16 format | 29 | |
30 | ia64 | IA64 processor emulating x86[60] | rdrnd | RDRAND (on-chip random number generator) feature | 30 | |
31 | pbe | Pending Break Enable (PBE# pin) wakeup capability | hypervisor | Hypervisor present (always zero on physical CPUs)[63][64][65] | 31 |
CPUID
with a leaf index (EAX) greater than 0 may leave EBX and ECX unmodified, keeping their old values. For this reason, it is recommended to zero out EBX and ECX before executingCPUID
with a leaf index of 1.Processors noted to exhibit this behavior include Cyrix MII[48] and IDT WinChip 2.[49]
CentaurHauls
,GenuineTMx86
andRiseRiseRise
), theCMPXCHG8B
instruction is always supported, however the feature bit for the instruction might not be set. This is a workaround for a bug in Windows NT.[50]AuthenticAMD
Family 5 Model 0) processors only, EDX bit 9 used to indicate support for PGE instead. This was moved to bit 13 from K5 Model 1 onwards.[51]GenuineIntel
Family 6 Model 1) processors only, EDX bit 11 is invalid - the bit is set, but theSYSENTER
andSYSEXIT
instructions are not supported on the Pentium Pro.[53]MTRRCAP
MSR (MSR0FEh
). This MSR has the following layout:Bits | Usage |
---|---|
7:0 | Number of variable-range MTRRs |
8 | Fixed-range MTRRs supported |
9 | (Reserved) |
10 | Write-Combining memory type supported |
11 | SMRR (System-Management Range Register) supported |
12 | PRMRR (Processor Reserved Memory Range Register, part ofSGX) supported |
13 | SMRR2 supported[54] |
14 | SMRR-lock supported |
15 | SEAMRR (SEcure Arbitration Mode Range Register, part ofTDX) supported[55] |
63:16 | (Reserved) |
CMPXCHG16B
feature bit set even though they do not support the instruction - this applies toGenuineIntel
Family0Fh
Model 3 Stepping 4 chips (90nm Pentium 4) only.[56]FCMOV
andFCOMI
instructions only available if onboard x87 FPU also present (indicated by EDX bit 0).119h
(BBL_CR_CTL
) to 1. Doing so will remove leaf 3 and causeCPUID.(EAX=1):EDX[bit 18] to return 0.In older documentation, this bit is often listed as a "Hyper-threading technology"[61] flag - however, while this flag is a prerequisite for Hyper-Threading support, it does not by itself indicate support for Hyper-Threading and it has been set on many CPUs that do not feature any form of multi-threading technology.[62]
Reserved fields should be masked before using them for processor identification purposes.
This returns a list of descriptors indicating cache andTLB capabilities in EAX, EBX, ECX and EDX registers.
On processors that support this leaf, callingCPUID
with EAX=2 will cause the bottom byte of EAX to be set to01h
[a] and the remaining 15 bytes of EAX/EBX/ECX/EDX to be filled with 15 descriptors, one byte each. These descriptors provide information about the processor's caches, TLBs and prefetch. This is typically one cache or TLB per descriptor, but some descriptor-values provide other information as well - in particular,00h
is used for an empty descriptor,FFh
indicates that the leaf does not contain valid cache information and that leaf 4h should be used instead, andFEh
indicates that the leaf does not contain valid TLB information and that leaf 18h should be used instead. The descriptors may appear in any order.
For each of the four registers (EAX,EBX,ECX,EDX), if bit 31 is set, then the register should not be considered to contain valid descriptors (e.g. on Itanium in IA-32 mode, CPUID(EAX=2) returns80000000h
in EDX - this should be interpreted to mean that EDX contains no valid information, not that it contains a descriptor for a 512K L2 cache.)
The table below provides, for known descriptor values, a condensed description of the cache or TLB indicated by that descriptor value (or other information, where that applies). The suffixes used in the table are:
Level-1 instruction or data cache | Level-2 cache | Level-3 cache | Instruction or data TLB | Level-2 shared TLB | Other information | (reserved) |
x0 | x1 | x2 | x3 | x4 | x5 | x6 | x7 | x8 | x9 | xA | xB | xC | xD | xE | xF | |||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
0x | null descriptor | ITLB: 32E, 4Kp, 4A | ITLB: 2E, 4Mp, FA | DTLB: 64E, 4Kp, 4A | DTLB: 8E, 4Mp, 4A | DTLB: 32E, 4Mp, 4A | L1I: 8K, 4A, 32L | 0x | L1I: 16K, 4A, 32L | L1I: 32K, 4A, 64L | L1D: 8K, 2A, 32L | ITLB: 4E, 4Mp, FA | L1D: 16K, 4A, 32L | L1D: 16K, 4A, 64L[b] | L1D: 24K, 6A, 64L[b] | 0x | ||
1x | (L1D: 16K, 4A, 32L)[c] | (L1I: 16K, 4A, 32L)[c] | 1x | (L2C: 96K, 6A, 64L)[c] | L2C: 128K, 2A, 64L | 1x | ||||||||||||
2x | L2C: 256K, 8A, 64L[d] | L3C: 512K, 4A, 64L, 2S | L3C: 1M, 8A, 64L, 2S | L2C: 1M, 16A, 64L | L3C: 2M, 8A, 64L, 2S | (128-byte prefetch)[e] | (128-byte prefetch)[e] | 2x | (128-byte prefetch)[e] | L3C: 4M, 8A, 64L, 2S | L1D: 32K, 8A, 64L | 2x | ||||||
3x | L1I: 32K, 8A, 64L | 3x | L2C: 128K, 4A, 64L, 2S[f] | L2C: 192K, 6A, 64L, 2S[f] | L2C: 128K, 2A, 64L, 2S[f] | L2C: 256K, 4A, 64L, 2S[f] | L2C: 384K, 6A, 64L, 2S[f] | L2C: 512K, 4A, 64L, 2S[f] | L2C: 256K, 2A, 64L[g] | 3x | ||||||||
4x | no L3 cache present | L2C: 128K, 4A, 32L | L2C: 256K, 4A, 32L[h] | L2C: 512K, 4A, 32L | L2C: 1M, 4A, 32L | L2C: 2M, 4A, 32L | L3C: 4M, 4A, 64L | L3C: 8M, 8A, 64L | 4x | L2C: 3M, 12A, 64L | L2C/L3C:[i] 4M, 16A, 64L | L3C: 6M, 12A, 64L | L3C: 8M, 16A, 64L | L3C: 12M, 12A, 64L | L3C: 16M, 16A, 64L | L2C: 6M, 24A, 64L | ITLB: 32E, 4Kp[j] | 4x |
5x | ITLB: 64E,FA, 4K/2M/4Mp | ITLB: 128E,FA, 4K/2M/4Mp | ITLB: 256E,FA, 4K/2M/4Mp | ITLB: 7E, 2M/4Mp, FA | DTLB: 16E, 4Mp, 4A | DTLB: 16E, 4Kp, 4A | 5x | DTLB: 16E, 4Kp, FA | DTLB: 32E, 2M/4Mp, 4A | DTLB: 64E 4K/4Mp, FA | DTLB: 128E, 4K/4Mp, FA | DTLB: 256E, 4K/4Mp, FA | 5x | |||||
6x | L1D: 16K, 8A, 64L | ITLB: 48E, 4Kp, FA | Two DTLBs: 32E, 2M/4Mp, 4A + 4E, 1Gp, FA | DTLB: 512E, 4Kp, 4A | L1D: 8K, 4A, 64L | L1D: 16K, 4A, 64L | 6x | L1D: 32K, 4A, 64L | DTLB: 64E, 4Kp, 8A | DTLB: 256E, 4Kp, 8A | DTLB: 128E, 2M/4Mp, 8A | DTLB: 16E, 1Gp, FA | 6x | |||||
7x | Trace cache, 12K-μop, 8A[k] | Trace cache, 16K-μop, 8A | Trace cache, 32K-μop, 8A | Trace cache, 64K-μop, 8A[f] | [h] | ITLB: 8E, 2M/4Mp, FA[l] | (L1I: 16K, 4A, 64L)[m][h] | 7x | L2C: 1M, 4A, 64L | L2C: 128K, 8A, 64L, 2S | L2C: 256K, 8A, 64L, 2S | L2C: 512K, 8A, 64L, 2S | L2C: 1M, 8A, 64L, 2S | L2C: 2M, 8A, 64L | (L2C: 256K, 8A, 128L)[m] | L2C: 512K, 2A, 64L | 7x | |
8x | L2C: 512K, 8A, 64L[k] | (L2C: 128K, 8A, 32L)[e] | L2C: 256K, 8A, 32L[h] | L2C: 512K, 8A, 32L | L2C: 1M, 8A, 32L | L2C: 2M, 8A, 32L | L2C: 512K, 4A, 64L | L2C: 1M, 8A, 64L | 8x | (L3C: 2M, 4A, 64L)[c] | (L3C: 4M, 4A, 64L)[c] | (L3C: 8M, 4A, 64L)[c] | (L3C: 3M, 12A, 128L)[m][n] | 8x | ||||
9x | (ITLB: 64E,FA, 4K-256Mp)[c] | (DTLB: 32E,FA, 4K-256Mp)[c] | 9x | (DTLB: 96E,FA, 4K-256Mp)[c] | 9x | |||||||||||||
Ax | DTLB: 32E, 4Kp, FA | Ax | Ax | |||||||||||||||
Bx | ITLB: 128E, 4Kp, 4A | ITLB: 8E, 2M/4Mp, 4A[o] | ITLB: 64E, 4Kp, 4A | DTLB: 128E, 4Kp, 4A | DTLB: 256E, 4Kp, 4A | ITLB: 64E, 4Kp, 8A | ITLB: 128E, 4Kp, 8A | Bx | DTLB: 64E, 4Kp, 4A | Bx | ||||||||
Cx | DTLB: 8E, 4K/4Mp, 4A | L2TLB: 1024E, 4K/2Mp, 8A | DTLB: 16E, 2M/4Mp, 4A[83] | Two L2 STLBs: 1536E, 4K/2Mp, 6A[p] + 16E, 1Gp, 4A | DTLB: 32E, 2M/4Mp, 4A | Cx | L2TLB: 512E, 4Kp, 4A | Cx | ||||||||||
Dx | L3C: 512K, 4A, 64L | L3C: 1M, 4A, 64L | L3C: 2M, 4A, 64L | L3C: 1M, 8A, 64L | L3C: 2M, 8A, 64L | Dx | L3C: 4M, 8A, 64L | L3C: 1.5M, 12A, 64L | L3C: 3M, 12A, 64L | L3C: 6M, 12A, 64L | Dx | |||||||
Ex | L3C: 2M, 16A, 64L | L3C: 4M, 16A, 64L | L3C: 8M, 16A, 64L | Ex | L3C: 12M, 24A, 64L | L3C: 18M, 24A, 64L[86] | L3C: 24M, 24A, 64L | Ex | ||||||||||
Fx | 64-byte prefetch[q] | 128-byte prefetch[q] | Fx | Leaf 2 has no TLB info, use leaf 18h | Leaf 2 has no cache info, use leaf 4 | Fx | ||||||||||||
x0 | x1 | x2 | x3 | x4 | x5 | x6 | x7 | x8 | x9 | xA | xB | xC | xD | xE | xF |
CPUID
must be called with EAX=2 to get hold of all the cache/TLB descriptors. However, all known processors that implement this leaf return01h
in this byte, and newer Intel documentation (SDM rev 053[66] and later) specifies this byte as having the value01h
.0Dh
and0Eh
, Intel AP-485 rev 37[67] lists the caches they describe as havingECC - this was removed in rev 38 and later Intel documentation.10h
,15h
,1Ah
,88h
,89h
,8Ah
,90h
,96h
,9Bh
are documented for the IA-32 operation mode ofItanium only.[68]21h
is in some places (e.g. AP-485 rev 36[69] but not rev 37) referred to as an "MLC" (Mid-Level Cache).26h
,27h
,28h
and81h
are not listed in Intel documentation and are not used in any known released CPU. (81h
has been seen in engineering samples of the cancelledIntel Timna.[79]) They have nevertheless been reported to be recognized by theWindows NT kernel v5.1 (Windows XP) and higher.81h
is also recognized by v5.0 (Windows 2000).[80]39h-3Eh
and73h
are listed in rev 36 of Intel AP-485,[69] but have been removed from later Intel documentation even though several of them have been used in Intel CPUs (mostly inNetburst-based Celeron CPUs, e.g.39h
in"Willamette-128",[70]3Bh
in "Northwood-128",[71] and3Ch
in "Prescott-256"[72]).3Fh
is, as of November 2024, not listed in any known Intel documentation - it is nevertheless used in IntelTolapai processors,[73] and is listed in an Intel-provided Linux kernel patch.[74]CyrixInstead
Family 6 Model 5) indicates that this processor uses descriptor values74h
and77h
for its TLBs, and values42h
and82h
for its caches - but does not specify which caches/TLBs in the processor each of these descriptor values correspond to.[75]49h
indicates a level-3 cache onGenuineIntel
Family 0Fh Model 6 (Pentium 4 based Xeon) CPUs, and a level-2 cache on other CPUs.4Fh
. The processors that use this descriptor (Intel Atom"Bonnell"[76]) are described elsewhere as having a fully-associative 32-entry ITLB.[77]CyrixInstead
andGeode by NSC
), descriptors70h
and80h
have a different meaning:[78]70h
indicates a 32-entry shared instruction+data 4-way-set-associative TLB with a 4K page size.80h
indicates a 16 KB shared instruction+data L1 cache with 4-way set-associativity and a cache-line size of 16 bytes.76h
is listed as an 1 MB L2 cache in rev 37 of Intel AP-485,[67] but as an instruction TLB in rev 38 and all later Intel documentation.77h
,7Eh
,8Dh
are documented for the IA-32 operation mode ofItanium 2 only.[81]B1h
, the TLB capacity is 8 elements when using 2 MB pages, but reduced to 4 elements when using 4 MB pages.C3h
, many Intel processors that use this descriptor have an L2 TLB that is 12-way set-associative, not 6-way set-associative. This applies to at least Skylake[84] and Whiskey/Kaby/Coffee/Comet Lake[85] CPUs.F0h
andF1h
is the recommended stride for memory prefetching with thePREFETCHNTA
instruction.[87]This returns the processor's serial number. The processor serial number was introduced on IntelPentium III, but due to privacy concerns, this feature is no longer implemented on later models (the PSN feature bit is always cleared).Transmeta's Efficeon and Crusoe processors also provide this feature. AMD CPUs however, do not implement this feature in any CPU models.
For Intel Pentium III CPUs, the serial number is returned in the EDX:ECX registers. For Transmeta Efficeon CPUs, it is returned in the EBX:EAX registers. And for Transmeta Crusoe CPUs, it is returned in the EBX register only.
Note that the processor serial number feature must be enabled in theBIOS setting in order to function.
These two leaves are used to provide information about thecache hierarchy levels available to the processor core on which theCPUID
instruction is run. Leaf4
is used on Intel processors and leaf8000'001Dh
is used on AMD processors - they both return data in EAX, EBX, ECX and EDX, using the same data format except that leaf4
returns a few additional fields that are considered "reserved" for leaf8000'001Dh
. They both provide CPU cache information in a series of sub-leaves selected by ECX - to get information about all the cache levels, it is necessary to invokeCPUID
repeatedly, with EAX=4
or8000'001Dh
and ECX set to increasing values starting from 0 (0,1,2,...) until a sub-leaf not describing any caches (EAX[4:0]=0) is found. The sub-leaves that do return cache information may appear in any order, but all of them will appear before the first sub-leaf not describing any caches.
In the below table, fields that are defined for leaf4
but not for leaf8000'001Dh
are highlighted with yellow cell coloring and a(#4) item.
Bit | EAX | EBX | EDX[a] | Bit | ||
---|---|---|---|---|---|---|
0 | Cache Type:
| Systemcoherency line size in bytes,minus 1 | WBINVD cache invalidation execution scope.A value of 0 indicates that the INVD /WBINVD instructions will invalidate all lower-levels caches of this cache, including caches that belong to sibling processors sharing this cache. A value of 1 indicates that lower-level caches of sibling processors that are sharing this cache are not guaranteed to be all cleared. | 0 | ||
1 | Cache inclusiveness. If 1, then cache is inclusive of lower-level caches. | 1 | ||||
2 | Complex cache indexing. If 1, then cache uses a complex function for cache indexing, else the cache is direct-mapped.(#4) | 2 | ||||
3 | (reserved) | 3 | ||||
4 | (reserved) | 4 | ||||
7:5 | Cache Level (starting from 1) | (reserved) | 7:5 | |||
8 | Self initializing cache level (1=doesn't need software initialization after reset) | (reserved) | 8 | |||
9 | Fully Associative Cache | (reserved) | 9 | |||
10 | (WBINVD cache invalidation execution scope)[b](#4) | (reserved) | 10 | |||
11 | (Cache Inclusiveness)[b](#4) | (reserved) | 11 | |||
13:12 | (reserved) | Physical line partitions (number of cache lines that share a cache address tag),minus 1 | (reserved) | 13:12 | ||
21:14 | Maximum number of addressable IDs for logical processors sharing this cache,minus 1 | (reserved) | 21:14 | |||
25:22 | Ways ofcache associativity,minus 1 | (reserved) | 25:22 | |||
31:26 | Maximum number of addressable IDs for processor cores in physical package,minus 1(#4) | (reserved) | 31:26 |
GenuineIntel
Family0Bh
) processor only.[42] For other processors, bits 1:0 of EDX should be used instead.For any caches that are valid and not fully-associative, the value returned in ECX is the number of sets in the cache minus 1. (For fully-associative caches, ECX should be treated as if it return the value 0.)For any given cache described by a sub-leaf ofCPUID
leaf4
or8000'001Dh
, the total cache size in bytes can be computed as:
CacheSize = (EBX[11:0]+1) * (EBX[21:12]+1) * (EBX[31:22]+1) * (ECX+1)
For example, on IntelCrystalwell CPUs, executing CPUID with EAX=4 and ECX=4 will cause the processor to return the following size information for its level-4 cache in EBX and ECX:EBX=03C0F03F
andECX=00001FFF
- this should be taken to mean that this cache has a cache line size of 64 bytes (EBX[11:0]+1), has 16 cache lines per tag (EBX[21:12]+1), is 16-way set-associative (EBX[31:22]+1) with 8192 sets (ECX+1), for a total size of 64*16*16*8192=134217728 bytes, or 128 binary megabytes.
These two leaves are used for processor topology (thread, core, package) and cache hierarchy enumeration in Intel multi-core (and hyperthreaded) processors.[89] As of 2013[update] AMD does not use these leaves but has alternate ways of doing the core enumeration.[90]
Unlike most other CPUID leaves, leaf Bh will return different values in EDX depending on which logical processor the CPUID instruction runs; the value returned in EDX is actually thex2APIC id of the logical processor. The x2APIC id space is not continuously mapped to logical processors, however; there can be gaps in the mapping, meaning that some intermediate x2APIC ids don't necessarily correspond to any logical processor. Additional information for mapping the x2APIC ids to cores is provided in the other registers. Although the leaf Bh has sub-leaves (selected by ECX as described further below), the value returned in EDX is only affected by the logical processor on which the instruction is running but not by the subleaf.
The processor(s) topology exposed by leaf Bh is a hierarchical one, but with the strange caveat that the order of (logical) levels in this hierarchy doesn't necessarily correspond to the order in the physical hierarchy (SMT/core/package). However, every logical level can be queried as an ECX subleaf (of the Bh leaf) for its correspondence to a "level type", which can be either SMT, core, or "invalid". The level id space starts at 0 and is continuous, meaning that if a level id is invalid, all higher level ids will also be invalid. The level type is returned in bits 15:08 of ECX, while the number of logical processors at the level queried is returned in EBX. Finally, the connection between these levels and x2APIC ids is returned in EAX[4:0] as the number of bits that the x2APIC id must be shifted in order to obtain a unique id at the next level.
As an example, a dual-coreWestmere processor capable ofhyperthreading (thus having two cores and four threads in total) could have x2APIC ids 0, 1, 4 and 5 for its four logical processors. Leaf Bh (=EAX), subleaf 0 (=ECX) of CPUID could for instance return 100h in ECX, meaning that level 0 describes the SMT (hyperthreading) layer, and return 2 in EBX because there are two logical processors (SMT units) per physical core. The value returned in EAX for this 0-subleaf should be 1 in this case, because shifting the aforementioned x2APIC ids to the right by one bit gives a unique core number (at the next level of the level id hierarchy) and erases the SMT id bit inside each core. A simpler way to interpret this information is that the last bit (bit number 0) of the x2APIC id identifies the SMT/hyperthreading unit inside each core in our example. Advancing to subleaf 1 (by making another call to CPUID with EAX=Bh and ECX=1) could for instance return 201h in ECX, meaning that this is a core-type level, and 4 in EBX because there are 4 logical processors in the package; EAX returned could be any value greater than 3, because it so happens that bit number 2 is used to identify the core in the x2APIC id. Note that bit number 1 of the x2APIC id is not used in this example. However, EAX returned at this level could well be 4 (and it happens to be so on a Clarkdale Core i3 5x0) because that also gives a unique id at the package level (=0 obviously) when shifting the x2APIC id by 4 bits. Finally, you may wonder what the EAX=4 leaf can tell us that we didn't find out already. In EAX[31:26] it returns the APIC mask bitsreserved for a package; that would be 111b in our example because bits 0 to 2 are used for identifying logical processors inside this package, but bit 1 is also reserved although not used as part of the logical processor identification scheme. In other words, APIC ids 0 to 7 are reserved for the package, even though half of these values don't map to a logical processor.
The cache hierarchy of the processor is explored by looking at the sub-leaves of leaf 4. The APIC ids are also used in this hierarchy to convey information about how the different levels of cache are shared by the SMT units and cores. To continue our example, the L2 cache, which is shared by SMT units of the same core but not between physical cores on the Westmere is indicated by EAX[26:14] being set to 1, while the information that the L3 cache is shared by the whole package is indicated by setting those bits to (at least) 111b. The cache details, including cache type, size, and associativity are communicated via the other registers on leaf 4.
Beware that older versions of the Intel app note 485 contain some misleading information, particularly with respect to identifying and counting cores in a multi-core processor;[91] errors from misinterpreting this information have even been incorporated in the Microsoft sample code for using CPUID, even for the 2013 edition of Visual Studio,[92] and also in the sandpile.org page for CPUID,[93] but the Intel code sample for identifying processor topology[89] has the correct interpretation, and the current Intel Software Developer's Manual has a more clear language. The (open source) cross-platform production code[94] fromWildfire Games also implements the correct interpretation of the Intel documentation.
Topology detection examples involving older (pre-2010) Intel processors that lack x2APIC (thus don't implement the EAX=Bh leaf) are given in a 2010 Intel presentation.[95] Beware that using that older detection method on 2010 and newer Intel processors may overestimate the number of cores and logical processors because the old detection method assumes there are no gaps in the APIC id space, and this assumption is violated by some newer processors (starting with the Core i3 5x0 series), but these newer processors also come with an x2APIC, so their topology can be correctly determined using the EAX=Bh leaf method.
This returns feature information related to theMONITOR
andMWAIT
instructions in the EAX, EBX, ECX and EDX registers.
Bit | EAX | EBX | EDX | Bit | ||
---|---|---|---|---|---|---|
3:0 | Smallest monitor-line size in bytes | Largest monitor-line size in bytes | Number of C0[a] sub-states supported forMWAIT | 3:0 | ||
7:4 | Number of C1 sub-states supported forMWAIT | 7:4 | ||||
11:8 | Number of C2 sub-states supported forMWAIT | 11:8 | ||||
15:12 | Number of C3 sub-states supported forMWAIT | 15:12 | ||||
19:16 | (reserved) | (reserved) | Number of C4 sub-states supported forMWAIT | 19:16 | ||
23:20 | Number of C5 sub-states supported forMWAIT | 23:20 | ||||
27:24 | Number of C6 sub-states supported forMWAIT | 27:24 | ||||
31:28 | Number of C7 sub-states supported forMWAIT | 31:28 |
Bit | ECX | |
---|---|---|
Short | Feature | |
0 | EMX | Enumeration of MONITOR/MWAIT extensions in ECX and EDX supported |
1 | IBE | Supports treating interrupts as break-events forMWAIT even when interrupts are disabled |
2 | (reserved) | |
3 | Monitorless_MWAIT | AllowMWAIT to be used for power management without setting up memory monitoring withMONITOR [96] |
31:4 | (reserved) |
This returns feature bits in the EAX register and additional information in the EBX, ECX and EDX registers.
Bit | EAX | |
---|---|---|
Short | Feature | |
0 | DTS | Digital Thermal Sensor capability |
1 | Intel Turbo Boost Technology capability | |
2 | ARAT[a] | Always RunningAPIC Timer capability |
3 | (reserved) | |
4 | PLN | Power Limit Notification capability |
5 | ECMD | Extended Clock Modulation Duty capability |
6 | PTM | Package Thermal Management capability |
7 | HWP | Hardware-controlledPerformance States. MSRs added:
|
8 | HWP_Notification | HWP notification of dynamic guaranteed performance change -IA32_HWP_INTERRUPT (773h ) MSR |
9 | HWP_Activity_Window | HWP Activity Window control - bits 41:32 ofIA32_HWP_REQUEST MSR |
10 | HWP_Energy_Performance_Preference | HWP Energy/performance preference control - bits 31:24 ofIA32_HWP_REQUEST MSR |
11 | HWP_Package_Level_Request | HWP Package-level control -IA32_HWP_REQUEST_PKG (772h ) MSR |
12 | (reserved) | |
13 | HDC | HardwareDuty Cycling supported. MSRs added:
|
14 | Intel Turbo Boost Max Technology 3.0 available | |
15 | Interrupts upon changes toIA32_HWP_CAPABILITIES .Highest_Performance (bits 7:0) supported | |
16 | HWPPECI override supported - bits 63:60 ofIA32_HWP_PECI_REQUEST_INFO (775h ) MSR | |
17 | Flexible HWP - bits 63:59 ofIA32_HWP_REQUEST MSR | |
18 | Fast Access Mode | Fast access mode forIA32_HWP_REQUEST MSR supported[b] |
19 | HW_FEEDBACK | Hardware Feedback Interface. Added MSRs:
|
20 | IA32_HWP_REQUEST of idle logical processor ignored when only one of two logical processors thatshare a physical processor is active. | |
21 | (reserved) | |
22 | HWP Control MSR | IA32_HWP_CTL (776h ) MSR supported[98] |
23 | Intel Thread Director supported. Added MSRs:
| |
24 | IA32_THERM_INTERRUPT MSR bit 25 supported | |
31:25 | (reserved) |
Bit | EBX | ECX | EDX | Bit | ||
---|---|---|---|---|---|---|
0 | Number of Interrupt Thresholds in Digital Thermal Sensor | Effective frequency interface supported -IA32_MPERF (0E7h ) andIA32_APERF (0E8h ) MSRs | Hardware Feedback reporting: Performance Capability Reporting supported | 0 | ||
1 | (ACNT2 Capability)[a] | Hardware Feedback reporting: Efficiency Capability Reporting supported | 1 | |||
2 | (reserved) | (reserved) | 2 | |||
3 | Performance-Energy Bias capability -IA32_ENERGY_PERF_BIAS (1B0h ) MSR | 3 | ||||
7:4 | (reserved) | (reserved) | 7:4 | |||
11:8 | Number of Intel Thread Director classes supported by hardware | Size of Hardware Feedback interface structure (in units of 4 KB) minus 1 | 11:8 | |||
15:12 | (reserved) | 15:12 | ||||
31:16 | (reserved) | Index of this logical processor's row in hardware feedback interface structure | 31:16 |
This returns extended feature flags in EBX, ECX, and EDX. Returns the maximum ECX value for EAX=7 in EAX.
Bit | EBX | ECX | EDX | Bit | |||||
---|---|---|---|---|---|---|---|---|---|
Short | Feature | Short | Feature | Short | Feature | ||||
0 | fsgsbase | Access to base of %fs and %gs | prefetchwt1 | PREFETCHWT1 instruction | (sgx-tem)[a] | ? | 0 | ||
1 | IA32_TSC_ADJUST MSR | avx512-vbmi | AVX-512 Vector Bit Manipulation Instructions | sgx-keys | Attestation Services forIntel SGX | 1 | |||
2 | sgx | Software Guard Extensions | umip | User-mode Instruction Prevention | avx512-4vnniw | AVX-512 4-register Neural Network Instructions | 2 | ||
3 | bmi1 | Bit Manipulation Instruction Set 1 | pku | Memory Protection Keys for User-mode pages | avx512-4fmaps | AVX-512 4-register Multiply Accumulation Single precision | 3 | ||
4 | hle | TSX Hardware Lock Elision | ospke | PKU enabled by OS | fsrm | Fast ShortREP MOVSB | 4 | ||
5 | avx2 | Advanced Vector Extensions 2 | waitpkg | Timed pause and user-level monitor/wait instructions (TPAUSE ,UMONITOR ,UMWAIT ) | uintr | User Inter-processor Interrupts | 5 | ||
6 | fdp-excptn-only | x87 FPU data pointer register updated on exceptions only | avx512-vbmi2 | AVX-512 Vector Bit Manipulation Instructions 2 | (reserved) | 6 | |||
7 | smep | Supervisor Mode Execution Prevention | cet_ss/shstk | Control flow enforcement (CET): shadow stack (SHSTK alternative name) | (reserved) | 7 | |||
8 | bmi2 | Bit Manipulation Instruction Set 2 | gfni | Galois Field instructions | avx512-vp2intersect | AVX-512 vector intersection instructions on 32/64-bit integers | 8 | ||
9 | erms | EnhancedREP MOVSB/STOSB | vaes | VectorAES instruction set (VEX-256/EVEX) | srbds-ctrl | Special Register Buffer Data Sampling Mitigations | 9 | ||
10 | invpcid | INVPCID instruction | vpclmulqdq | CLMUL instruction set (VEX-256/EVEX) | md-clear | VERW instruction clears CPU buffers | 10 | ||
11 | rtm | TSX Restricted Transactional Memory | avx512-vnni | AVX-512 Vector Neural Network Instructions | rtm-always-abort[101] | All TSX transactions are aborted | 11 | ||
12 | rdt-m/pqm | Intel Resource Director (RDT) Monitoringor AMD Platform QOS Monitoring | avx512-bitalg | AVX-512 BITALG instructions | (reserved) | 12 | |||
13 | x87 FPU CS and DS deprecated | tme_en | Total Memory Encryption MSRs available | rtm-force-abort[101] | TSX_FORCE_ABORT (MSR0x10f ) is available | 13 | |||
14 | mpx | Intel MPX (Memory Protection Extensions) | avx512-vpopcntdq | AVX-512 Vector Population Count Double and Quad-word | serialize | SERIALIZE instruction | 14 | ||
15 | rdt-a/pqe | Intel Resource Director (RDT) Allocationor AMD Platform QOS Enforcement | (fzm)[a] | ? | hybrid | Mixture of CPU types in processor topology (e.g.Alder Lake) | 15 | ||
16 | avx512-f | AVX-512 Foundation | la57 | 5-level paging (57 address bits) | tsxldtrk | TSX load address tracking suspend/resume instructions (TSUSLDTRK andTRESLDTRK ) | 16 | ||
17 | avx512-dq | AVX-512 Doubleword and Quadword Instructions | mawau | The value of userspace MPX Address-Width Adjust used by theBNDLDX andBNDSTX Intel MPX instructions in 64-bit mode | (reserved) | 17 | |||
18 | rdseed | RDSEED instruction | pconfig | Platform configuration (Memory Encryption Technologies Instructions) | 18 | ||||
19 | adx | Intel ADX (Multi-Precision Add-Carry Instruction Extensions) | lbr | Architectural Last Branch Records | 19 | ||||
20 | smap | Supervisor Mode Access Prevention | cet-ibt | Control flow enforcement (CET): indirect branch tracking | 20 | ||||
21 | avx512-ifma | AVX-512 Integer Fused Multiply-Add Instructions | (reserved) | 21 | |||||
22 | (pcommit) | (PCOMMIT instruction, deprecated)[103] | rdpid | RDPID (Read Processor ID) instruction and IA32_TSC_AUX MSR | amx-bf16 | AMX tile computation onbfloat16 numbers | 22 | ||
23 | clflushopt | CLFLUSHOPT instruction | kl | AES Key Locker | avx512-fp16 | AVX-512half-precision floating-point arithmetic instructions[104] | 23 | ||
24 | clwb | CLWB (Cache line writeback) instruction | bus-lock-detect | Bus lock debug exceptions | amx-tile | AMX tile load/store instructions | 24 | ||
25 | pt | Intel Processor Trace | cldemote | CLDEMOTE (Cache line demote) instruction | amx-int8 | AMX tile computation on 8-bit integers | 25 | ||
26 | avx512-pf | AVX-512 Prefetch Instructions | (mprr)[a] | ? | ibrs / spec_ctrl | Speculation Control, part of Indirect Branch Control (IBC): Indirect Branch Restricted Speculation (IBRS) and Indirect Branch Prediction Barrier (IBPB)[105][106] | 26 | ||
27 | avx512-er | AVX-512 Exponential and Reciprocal Instructions | movdiri | MOVDIRI instruction | stibp | Single Thread Indirect Branch Predictor, part of IBC[105] | 27 | ||
28 | avx512-cd | AVX-512 Conflict Detection Instructions | movdir64b | MOVDIR64B (64-byte direct store) instruction | L1D_FLUSH | IA32_FLUSH_CMD MSR | 28 | ||
29 | sha | SHA-1 and SHA-256 extensions | enqcmd | Enqueue Stores andEMQCMD /EMQCMDS instructions | IA32_ARCH_CAPABILITIES MSR (lists speculative side channel mitigations[105]) | 29 | |||
30 | avx512-bw | AVX-512 Byte and Word Instructions | sgx-lc | SGX Launch Configuration | IA32_CORE_CAPABILITIES MSR (lists model-specific core capabilities) | 30 | |||
31 | avx512-vl | AVX-512 Vector Length Extensions | pks | Protection keys for supervisor-mode pages | ssbd | Speculative Store Bypass Disable,[105] as mitigation forSpeculative Store Bypass (IA32_SPEC_CTRL) | 31 |
This returns extended feature flags in all four registers.
Bit | EAX | EBX | ECX | EDX | Bit | |||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Short | Feature | Short | Feature | Short | Feature | Short | Feature | |||||
0 | sha512 | SHA-512 extensions | Intel PPIN (Protected Processor Inventory Number): IA32_PPIN_CTL (04Eh ) and IA32_PPIN (04Fh ) MSRs. | (reserved) | (reserved) | 0 | ||||||
1 | sm3 | SM3 hash extensions | pbndkb | Total Storage Encryption:PBNDKB instruction and TSE_CAPABILITY (9F1h ) MSR. | (reserved) | (reserved) | 1 | |||||
2 | sm4 | SM4 cipher extensions | (reserved) | (legacy_reduced_isa) | (X86S,[107] cancelled[108]) | (reserved) | 2 | |||||
3 | rao-int | Remote Atomic Operations on integers:AADD ,AAND ,AOR ,AXOR instructions | CPUIDMAXVAL_LIM_RMV | If 1, then bit 22 ofIA32_MISC_ENABLE cannot be set to 1 to limit the value returned byCPUID.(EAX=0):EAX[7:0] . | (reserved) | (reserved) | 3 | |||||
4 | avx-vnni | AVX Vector Neural Network Instructions (VNNI) (VEX encoded) | (reserved) | (sipi64) | 64-bit SIPI (Startup InterProcessor Interrupt) (part of cancelled X86S) | avx-vnni-int8 | AVX VNNI INT8 instructions | 4 | ||||
5 | avx512-bf16 | AVX-512 instructions forbfloat16 numbers | (reserved) | MSR_IMM | Immediate forms of theRDMSR andWRMSRNS instructions | avx-ne-convert | AVX no-exception FP conversion instructions (bfloat16↔FP32 andFP16→FP32) | 5 | ||||
6 | lass | Linear Address Space Separation (CR4 bit 27) | (reserved) | (reserved) | (reserved) | 6 | ||||||
7 | cmpccxadd | CMPccXADD instructions | (reserved) | (reserved) | (reserved) | 7 | ||||||
8 | archperfmonext | Architectural Performance Monitoring Extended Leaf (EAX=23h) | (reserved) | (reserved) | amx-complex | AMX support for "complex" tiles (TCMMIMFP16PS andTCMMRLFP16PS ) | 8 | |||||
9 | (dedup)[a] | ? | (reserved) | (reserved) | (reserved) | 9 | ||||||
10 | fzrm | Fast zero-length REP MOVSB | (reserved) | (reserved) | avx-vnni-int16 | AVX VNNI INT16 instructions | 10 | |||||
11 | fsrs | Fast shortREP STOSB | (reserved) | (reserved) | (reserved) | 11 | ||||||
12 | rsrcs | Fast shortREP CMPSB andREP SCASB | (reserved) | (reserved) | (reserved) | 12 | ||||||
13 | (reserved) | (reserved) | (reserved) | utmr | User-timer events: IA32_UINTR_TIMER (1B00h ) MSR | 13 | ||||||
14 | (reserved) | (reserved) | (reserved) | prefetchi | Instruction-cache prefetch instructions (PREFETCHIT0 andPREFETCHIT1 ) | 14 | ||||||
15 | (reserved) | (reserved) | (reserved) | user_msr | User-mode MSR access instructions (URDMSR andUWRMSR ) | 15 | ||||||
16 | (reserved) | (reserved) | (reserved) | (reserved) | 16 | |||||||
17 | fred | Flexible Return and Event Delivery[109] | (reserved) | (reserved) | uiret-uif-from-rflags | If 1, theUIRET (User Interrupt Return) instruction will set UIF (User Interrupt Flag) to the value of bit 1 of the RFLAGS image popped off the stack. | 17 | |||||
18 | lkgs | LKGS Instruction[109] | (reserved) | (reserved) | cet-sss | If 1, then Control-Flow Enforcement (CET) Supervisor Shadow Stacks (SSS) are guaranteed not to become prematurely busy as long as shadow stack switching does not cause page faults on the stack being switched to.[110][111] | 18 | |||||
19 | wrmsrns | WRMSRNS instruction (non-serializing write toMSRs) | (reserved) | (reserved) | avx10 | AVX10 Converged Vector ISA (see also leaf 24h)[112] | 19 | |||||
20 | nmi_src | NMI source reporting[109] | (reserved) | (reserved) | (reserved) | 20 | ||||||
21 | amx-fp16 | AMX instructions forFP16 numbers | (reserved) | (reserved) | APX_F | Advanced Performance Extensions, Foundation (adds REX2 and extendedEVEX prefix encodings to support 32 GPRs, as well as some new instructions)[113] | 21 | |||||
22 | hreset | HRESET instruction, IA32_HRESET_ENABLE (17DAh ) MSR, and Processor History Reset Leaf (EAX=20h) | (reserved) | (reserved) | (reserved) | 22 | ||||||
23 | avx-ifma | AVX IFMA instructions | (reserved) | (reserved) | mwait | MWAIT instruction[b] | 23 | |||||
24 | (reserved) | (reserved) | (reserved) | (reserved) | 24 | |||||||
25 | (reserved) | (reserved) | (reserved) | (reserved) | 25 | |||||||
26 | lam | Linear Address Masking | (reserved) | (reserved) | (reserved) | 26 | ||||||
27 | msrlist | RDMSRLIST andWRMSRLIST instructions, and the IA32_BARRIER (02Fh ) MSR | (reserved) | (reserved) | (reserved) | 27 | ||||||
28 | (reserved) | (reserved) | (reserved) | (reserved) | 28 | |||||||
29 | (reserved) | (reserved) | (reserved) | (reserved) | 29 | |||||||
30 | invd_disable_post_bios_done | If 1, supportsINVD instruction execution prevention after BIOS Done. | (reserved) | (reserved) | (reserved) | 30 | ||||||
31 | MOVRS | MOVRS andPREFETCHRST2 instructions supported (memory read/prefetch with read-shared hint) | (reserved) | (reserved) | (reserved) | 31 |
MWAIT
instruction may be indicated by eitherCPUID.(EAX=1).ECX[3] orCPUID.(EAX=7,ECX=1).EDX[23]. (One or both may be set.) The former indicates support for theMONITOR
instruction as well, while the latter does not indicate one way or another whether theMONITOR
instruction is present.MWAIT
withoutMONITOR
may be present in systems that support the "Monitorless MWAIT" feature (which is itself indicated byCPUID.(EAX=5).ECX[3].)This returns extended feature flags in EDX.
EAX, EBX and ECX are reserved.
Bit | EDX | |
---|---|---|
Short | Feature | |
0 | psfd | Fast Store Forwarding Predictor[114] disable supported. (SPEC_CTRL (MSR48h ) bit 7) |
1 | ipred_ctrl | IPRED_DIS controls[115] supported. (SPEC_CTRL bits 3 and 4)IPRED_DIS prevents instructions at an indirect branch target from speculatively executing until the branch target address is resolved. |
2 | rrsba_ctrl | RRSBA behavior[116][115] disable supported. (SPEC_CTRL bits 5 and 6) |
3 | ddpd_u | Data Dependent Prefetcher[117] disable supported. (SPEC_CTRL bit 8) |
4 | bhi_ctrl | BHI_DIS_S behavior[115] enable supported. (SPEC_CTRL bit 10)BHI_DIS_S prevents predicted targets of indirect branches executed in ring0/1/2 from being selected based on branch history from branches executed in ring 3. |
5 | mcdt_no | If set, the processor does not exhibitMXCSR configuration dependent timing. |
6 | UC-lock disable feature supported. | |
7 | monitor_mitg_no | If set, indicates that theMONITOR /UMONITOR instructions are not affected by performance/power issues caused by the instructions exceeding the capacity of an internal monitor tracking table.[118] |
31:8 | (reserved) |
This leaf is used to enumerate XSAVE features and state components.
The XSAVE instruction set extension is designed to save/restore CPU extended state (typically for the purpose ofcontext switching) in a manner that can be extended to cover new instruction set extensions without the OS context-switching code needing to understand the specifics of the new extensions. This is done by defining a series ofstate-components, each with a size and offset within a given save area, and each corresponding to a subset of the state needed for one CPU extension or another. TheEAX=0Dh
CPUID leaf is used to provide information about which state-components the CPU supports and what their sizes/offsets are, so that the OS can reserve the proper amount of space and set the associated enable-bits.
The state-components can be subdivided into two groups: user-state (state-items that are visible to the application, e.g.AVX-512 vector registers), and supervisor-state (state items that affect the application but are not directly user-visible, e.g. user-mode interrupt configuration). The user-state items are enabled by setting their associated bits in theXCR0
control register, while the supervisor-state items are enabled by setting their associated bits in theIA32_XSS
(0DA0h
) MSR - the indicated state items then become the state-components that can be saved and restored with theXSAVE
/XRSTOR
family of instructions.
The XSAVE mechanism can handle up to 63 state-components in this manner. State-components 0 and 1 (x87 andSSE, respectively) have fixed offsets and sizes - for state-components 2 to 62, their sizes, offsets and a few additional flags can be queried by executingCPUID
withEAX=0Dh
andECX
set to the index of the state-component. This will return the following items in EAX, EBX and ECX (with EDX being reserved):
Bit | EAX | EBX | ECX | Bit |
---|---|---|---|---|
0 | Size in bytes of state-component | Offset of state-component from the start of theXSAVE /XRSTOR save area(This offset is 0 for supervisor state-components, since these can only be saved with the | User/supervisor state-component:
| 0 |
1 | 64-byte alignment enable when state save compaction is used. If this bit is set for a state-component, then, when storing state with compaction, padding will be inserted between the preceding state-component and this state-component as needed to provide 64-byte alignment. If this bit is not set, the state-component will be stored directly after the preceding one. | 1 | ||
31:2 | (reserved) | 31:2 |
Attempting to query an unsupported state-component in this manner results in EAX,EBX,ECX and EDX all being set to 0.
Sub-leaves 0 and 1 ofCPUID
leaf0Dh
are used to provide feature information:
EBX | ECX | EDX:EAX |
---|---|---|
Maximum size (in bytes) of XSAVE save area for the set of state-components currently set inXCR0 . | Maximum size (in bytes) of XSAVE save area if all state-components supported byXCR0 on this CPU were enabled at the same time. | 64-bit bitmap of state-components supported byXCR0 on this CPU. |
EAX | EBX | EDX:ECX |
---|---|---|
XSAVE feature flags (see below table) | Size (in bytes) of XSAVE area containing all the state-components currently set inXCR0 andIA32_XSS combined. | 64-bit bitmap of state-components supported byIA32_XSS on this CPU. |
Bit | EAX | |
---|---|---|
Short | Feature | |
0 | xsaveopt | XSAVEOPT instruction: save state-components that have been modified since lastXRSTOR |
1 | xsavec | XSAVEC instruction: save/restore state with compaction |
2 | xgetbv_ecx1 | XGETBV withECX=1 support |
3 | xss | XSAVES andXRSTORS instructions andIA32_XSS MSR: save/restore state with compaction, including supervisor state. |
4 | xfd | XFD (Extended Feature Disable) supported |
31:5 | (reserved) |
As of July 2023, the XSAVE state-components that have been architecturally defined are:
Index | Description | Enabled with |
---|---|---|
0 | x87 state | XCR0[a] |
1 | SSE state:XMM0 -XMM15 andMXCSR | XCR0 |
2 | AVX state: top halves ofYMM0 toYMM15 | |
3 | MPX state:BND0 -BND3 bounds registers | |
4 | MPX state:BNDCFGU andBNDSTATUS registers | |
5 | AVX-512 state: opmask registersk0 -k7 | |
6 | AVX-512 "ZMM_Hi256" state: top halves ofZMM0 toZMM15 | |
7 | AVX-512 "Hi16_ZMM" state:ZMM16 -ZMM31 | |
8 | Processor Trace state | IA32_XSS |
9 | PKRU (User Protection Keys) register | XCR0 |
10 | PASID (Process Address Space ID) state | IA32_XSS |
11 | CET_U state (Control-flow Enforcement Technology: user-mode functionality MSRs) | |
12 | CET_S state (CET: shadow stack pointers for rings 0,1,2) | |
13 | HDC (Hardware Duty Cycling) state | |
14 | UINTR (User-Mode Interrupts) state | |
15 | LBR (Last Branch Record) state | |
16 | HWP (Hardware P-state control) state | |
17 | AMX tile configuration state:TILECFG | XCR0 |
18 | AMX tile data registers:tmm0 -tmm7 | |
19 | APX extended general-purpose registers:r16 -r31 [113] | |
20 to 61 | (reserved) | |
62 | Lightweight Profiling (LWP) (AMD only) | XCR0 |
63 | (reserved)[b] |
This leaf provides information about the supported capabilities of the IntelSoftware Guard Extensions (SGX) feature. The leaf provides multiple sub-leaves, selected with ECX.
Sub-leaf 0 provides information about supported SGX leaf functions in EAX and maximum supported SGX enclave sizes in EDX; ECX is reserved. EBX provides a bitmap of bits that can be set in the MISCSELECT field in the SECS (SGX Enclave Control Structure) - this field is used to control information written to the MISC region of the SSA (SGX Save State Area) when an AEX (SGX Asynchronous Enclave Exit) occurs.
Bit | EAX | EBX | EDX | Bit | |||||
---|---|---|---|---|---|---|---|---|---|
Short | Feature | Short | Feature | Short | Feature | ||||
0 | sgx1 | SGX1 leaf functions | EXINFO | MISCSELECT: report information about page fault and general protection exception that occurred inside enclave | MaxEnclaveSize_Not64 | Log2 of maximum enclave size supported in non-64-bit mode | 0 | ||
1 | sgx2 | SGX2 leaf functions | CPINFO | MISCSELECT: report information about control protection exception that occurred inside enclave | 1 | ||||
2 | (reserved) | (reserved) | 2 | ||||||
3 | (reserved) | (reserved) | 3 | ||||||
4 | (reserved) | (reserved) | 4 | ||||||
5 | oss | ENCLV leaves:EINCVIRTCHILD ,EDECVIRTCHILD , andESETCONTEXT | (reserved) | 5 | |||||
6 | ENCLS leaves:ETRACKC ,ERDINFO ,ELDBC ,ELDUC | (reserved) | 6 | ||||||
7 | ENCLU leaf:EVERIFYREPORT2 | (reserved) | 7 | ||||||
8 | (reserved) | (reserved) | MaxEnclaveSize_64 | Log2 of maximum enclave size supported in 64-bit mode | 8 | ||||
9 | (reserved) | (reserved) | 9 | ||||||
10 | ENCLS leaf:EUPDATESVN | (reserved) | 10 | ||||||
11 | ENCLU leaf:EDECSSA | (reserved) | 11 | ||||||
12 | (reserved) | (reserved) | 12 | ||||||
13 | (reserved) | (reserved) | 13 | ||||||
14 | (reserved) | (reserved) | 14 | ||||||
15 | (reserved) | (reserved) | 15 | ||||||
31:16 | (reserved) | (reserved) | (reserved) | 31:16 |
Sub-leaf 1 provides a bitmap of which bits can be set in the 128-bit ATTRIBUTES field of SECS in EDX:ECX:EBX:EAX (this applies to the SECS copy used as input to theENCLS[ECREATE]
leaf function). The top 64 bits (given in EDX:ECX) are a bitmap of which bits can be set in the XFRM (X-feature request mask) - this mask is a bitmask of which CPU state-components (see leaf 0Dh) will be saved to the SSA in case of an AEX; this has the same layout as theXCR0
control register. The other bits are given in EAX and EBX, as follows:
Bit | EAX | EBX | Bit | |||
---|---|---|---|---|---|---|
Short | Feature | Short | Feature | |||
0 | (INIT) | (must be 0)[a] | (reserved) | 0 | ||
1 | DEBUG | Permit debugger to read and write enclave data usingEDBGRD andEDBGWR | 1 | |||
2 | MODE64BIT | 64-bit-mode enclave | 2 | |||
3 | (reserved) | 3 | ||||
4 | PROVISIONKEY | Provisioning key available fromEGETKEY | 4 | |||
5 | EINITTOKEN_KEY | EINIT token key available fromEGETKEY | 5 | |||
6 | CET | CET (Control-Flow Enforcement Technology) attributes enable | 6 | |||
7 | KSS | Key Separation and Sharing | 7 | |||
8 | (reserved) | 8 | ||||
9 | (reserved) | 9 | ||||
10 | AEXNOTIFY | Threads inside enclave may receive AEX notifications[119] | 10 | |||
31:11 | (reserved) | 31:11 |
ENCLS[EINIT]
. This bit must be 0 in the SECS copy that is given as input toENCLS[CREATE]
.Sub-leaves 2 and up are used to provide information about which physical memory regions are available for use as EPC (Enclave Page Cache) sections under SGX.
Bits | EAX | EBX | ECX | EDX | Bits | |||
---|---|---|---|---|---|---|---|---|
3:0 | Sub-leaf type:
| Bits 51:32 of physical base address of EPC section | EPC Section properties:
| Bits 51:32 of size of EPC section | 3:0 | |||
11:4 | (reserved) | (reserved) | 11:4 | |||||
19:12 | Bits 31:12 of physical base address of EPC section | Bits 31:12 of size of EPC section | 19:12 | |||||
31:20 | (reserved) | (reserved) | 31:20 |
This sub-leaf provides feature information for IntelProcessor Trace (also known as Real Time Instruction Trace).
The value returned in EAX is the index of the highest sub-leaf supported for CPUID with EAX=14h. EBX and ECX provide feature flags, EDX is reserved.
Bit | EBX | ECX | Bit | |||
---|---|---|---|---|---|---|
Short | Feature | Short | Feature | |||
0 | CR3 filtering supported | topaout | ToPA (Table of Physical Addresses) output mechanism for trace packets supported | 0 | ||
1 | Configurable PSB (Packet Stream Boundary) packet rate and Cycle-Accurate Mode (CYC packets) supported | mentry | ToPA tables can contain hold multiple output entries | 1 | ||
2 | IP filtering, TraceStop filtering and preservation of PT MSRs across warm reset supported | snglrngout | Single-Range Output scheme supported | 2 | ||
3 | MTC (Mini Time Counter) timing packets supported, and suppression of COFI (Change of Flow Instructions) packets supported. | Output to Trace Transport subsystem supported | 3 | |||
4 | ptwrite | PTWRITE instruction supported | (reserved) | 4 | ||
5 | Power Event Trace supported | (reserved) | 5 | |||
6 | Preservation of PSB and PMI (performance monitoring interrupt) supported | (reserved) | 6 | |||
7 | Event Trace packet generation supported | (reserved) | 7 | |||
8 | TNT (Branch Taken-Not-Taken) packet generation disable supported. | (reserved) | 8 | |||
9 | PTTT (Processor Trace Trigger Tracing) supported | (reserved) | 9 | |||
30:10 | (reserved) | (reserved) | 30:10 | |||
31 | (reserved) | IP (Instruction Pointer) format for trace packets that contain IP payloads:
| 31 |
These two leaves provide information about various frequencies in the CPU in EAX, EBX and ECX (EDX is reserved in both leaves).
EAX | EBX | ECX |
---|---|---|
Ratio of TSC frequency to Core Crystal Clock frequency, denominator | Ratio of TSC frequency to Core Crystal Clock frequency, numerator[a] | Core Crystal Clock frequency, in units ofHz[a] |
Bits | EAX | EBX | ECX | Bits |
---|---|---|---|---|
15:0 | Processor Base Frequency (in MHz)[a] | Processor Maximum Frequency (in MHz)[a] | Bus/Reference frequency (in MHz)[a] | 15:0 |
31:16 | (reserved) | (reserved) | (reserved) | 31:16 |
If the returned values in EBX and ECX of leaf 15h are both nonzero, then the TSC (Time Stamp Counter) frequency in Hz is given byTSCFreq = ECX*(EBX/EAX)
.
On some processors (e.g. IntelSkylake), CPUID_15h_ECX is zero but CPUID_16h_EAX is present and not zero. On all known processors where this is the case,[120] the TSC frequency is equal to the Processor Base Frequency, and the Core Crystal Clock Frequency in Hz can be computed asCoreCrystalFreq = (CPUID_16h_EAX * 10000000) * (CPUID_15h_EAX/CPUID_15h_EBX)
.
On processors that enumerate the TSC/Core Crystal Clock ratio in CPUID leaf 15h, theAPIC timer frequency will be the Core Crystal Clock frequency divided by the divisor specified by the APIC's Divide Configuration Register.[121]
This leaf is present in systems where an x86 CPUIP core is implemented in an SoC (System on chip) from another vendor - whereas the other leaves ofCPUID
provide information about the x86 CPU core, this leaf provides information about the SoC. This leaf takes a sub-leaf index in ECX.
Sub-leaf 0 returns a maximum sub-leaf index in EAX (at least 3), and SoC identification information in EBX/ECX/EDX:
Bit | EBX | ECX | EDX | Bit | ||
---|---|---|---|---|---|---|
15:0 | SoC Vendor ID | SoC Project ID | SoC Stepping ID within an SoC project | 15:0 | ||
16 | SoC Vendor ID scheme | 16 | ||||
31:17 | (reserved) | 31:17 |
ID | Vendor |
---|---|
1 | Spreadtrum[122] |
Sub-leaves 1 to 3 return a 48-byte SoC vendor brand string inUTF-8 format. Sub-leaf 1 returns the first 16 bytes in EAX,EBX,ECX,EDX (in that order); sub-leaf 2 returns the next 16 bytes and sub-leaf 3 returns the last 16 bytes. The string is allowed but not required to benull-terminated.
This leaf provides feature information for Intel Key Locker in EAX, EBX and ECX. EDX is reserved.
Bit | EAX | EBX | ECX | Bit | |||||
---|---|---|---|---|---|---|---|---|---|
Short | Feature | Short | Feature | Short | Feature | ||||
0 | Key Locker restriction of CPL0-only supported | aes_kle | AES "Key Locker" Instructions enabled | No-backup parameter toLOADIWKEY supported | 0 | ||||
1 | Key Locker restriction of no-encrypt supported | (reserved) | KeySource encoding of 1 (randomization of internal wrapping key) supported | 1 | |||||
2 | Key Locker restriction of no-decrypt supported | aes_wide_kl | AES "Wide Key Locker" Instructions | (reserved) | 2 | ||||
3 | (Process Restriction)[a] | (reserved) | (reserved) | 3 | |||||
4 | (reserved) | kl_msrs | "Key Locker" MSRs | (reserved) | 4 | ||||
31:5 | (reserved) | (reserved) | (reserved) | 31:5 |
WhenECX=0
, the highest supported "palette" subleaf is enumerated in EAX. WhenECX≥1
, information on paletten is returned.
Bits | EAX | EBX | ECX | EDX | Bits | |||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Short | Feature | Short | Feature | Short | Feature | Short | Feature | |||||
15:0 | total_tile_bytes | Size of all tile registers, in bytes (8192) | bytes_per_row | (64) | max_rows | (16) | (reserved) | 15:0 | ||||
31:16 | bytes_per_tile | Size of one tile, in bytes (1024) | max_names | Number of tile registers (8) | (reserved) | (reserved) | 31:16 |
TMUL
InformationThis leaf returns information on theTMUL
(tile multiplier) unit.
Bits | EAX | EBX | ECX | EDX | Bits | |||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Short | Feature | Short | Feature | Short | Feature | Short | Feature | |||||
7:0 | (reserved) | tmul_maxk | Maximum number of rows or columns (16) | (reserved) | (reserved) | 7:0 | ||||||
15:8 | (reserved) | tmul_maxn | Maximum number of bytes per column (64) | (reserved) | (reserved) | 15:8 | ||||||
23:16 | (reserved) | (reserved) | (reserved) | (reserved) | 23:16 | |||||||
31:24 | (reserved) | (reserved) | (reserved) | (reserved) | 31:24 |
TMUL
InformationThis leaf returns feature flags on theTMUL
(tile multiplier) unit.
Bits | EAX | EBX | ECX | EDX | Bits | |||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Short | Feature | Short | Feature | Short | Feature | Short | Feature | |||||
0 | amx-int8 | 8-bit integer support | (reserved) | (reserved) | (reserved) | 0 | ||||||
1 | amx-bf16 | bfloat16 support | (reserved) | (reserved) | (reserved) | 1 | ||||||
2 | amx-complex | Complex number support | (reserved) | (reserved) | (reserved) | 2 | ||||||
3 | amx-fp16 | float16 support | (reserved) | (reserved) | (reserved) | 3 | ||||||
4 | amx-fp8 | float8 support | (reserved) | (reserved) | (reserved) | 4 | ||||||
5 | amx-transpose | Transposition instruction support | (reserved) | (reserved) | (reserved) | 5 | ||||||
6 | amx-tf32 | tf32/fp19 support | (reserved) | (reserved) | (reserved) | 6 | ||||||
7 | amx-avx512 | AMX-AVX512 support | (reserved) | (reserved) | (reserved) | 7 | ||||||
8 | amx-movrs | AMX-MOVRS support | (reserved) | (reserved) | (reserved) | 8 | ||||||
31:9 | (reserved) | (reserved) | (reserved) | (reserved) | 31:9 |
When Intel TDX (Trust Domain Extensions) is active, attempts to execute theCPUID
instruction by a TD (Trust Domain) guest will be intercepted by the TDX module.This module will, whenCPUID
is invoked withEAX=21h
andECX=0
(leaf21h
, sub-leaf 0), return the index of the highest supported sub-leaf for leaf21h
inEAX
and a TDX module vendor ID string as a 12-byte ASCII string in EBX,EDX,ECX (in that order). Intel's own module implementation returns the vendor ID string"IntelTDX "
(with four trailing spaces)[123] - for this module, additional feature information is not available throughCPUID
and must instead be obtained through the TDX-specificTDCALL
instruction.
This leaf is reserved in hardware and will (on processors whose highest basic leaf is21h
or higher) return 0 in EAX/EBX/ECX/EDX when run directly on the CPU.
This returns a maximum supported sub-leaf in EAX and AVX10 feature information in EBX.[112] (ECX and EDX are reserved.)
Bit | EBX | |
---|---|---|
Short | Feature | |
7:0 | AVX10 Converged Vector ISA version (≥1) | |
16:8 | (reserved) | |
17 | avx10-256 | 256-bit vector support is present |
18 | avx10-512 | 512-bit vector support is present |
31:19 | (reserved) |
Subleaf 1 is reserved for AVX10 features not bound to a version. None are currently defined.
The highest function is returned in EAX.This leaf is only present onXeon Phi processors.[124]
This function returns feature flags.
Bit | EAX | EBX | ECX | EDX | Bit | |||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Short | Feature | Short | Feature | Short | Feature | Short | Feature | |||||
3:0 | (reserved) | (reserved) | (reserved) | (reserved) | 3:0 | |||||||
4 | (reserved) | (reserved) | (reserved) | k1om | K1OM[124] | 4 | ||||||
31:5 | (reserved) | (reserved) | (reserved) | (reserved) | 31:5 |
When theCPUID
instruction is executed underIntel VT-x or AMD-v virtualization, it will be intercepted by the hypervisor, enabling the hypervisor to returnCPUID
feature flags that differ from those of the underlying hardware.CPUID
leaves40000000h
to4FFFFFFFh
are not implemented in hardware, and are reserved for use by hypervisors to provide hypervisor-specific identification and feature information through this interception mechanism.
For leaf40000000h
, the hypervisor is expected to return the index of the highest supported hypervisor CPUID leaf in EAX, and a 12-character hypervisor ID string in EBX,ECX,EDX (in that order). For leaf40000001h
, the hypervisor may return an interface identification signature in EAX - e.g. hypervisors that wish to advertise that they areHyper-V compatible may return0x31237648
—"Hv#1"
in EAX.[125][126] The formats of leaves40000001h
and up to the highest supported leaf are otherwise hypervisor-specific. Hypervisors that implement these leaves will normally also set bit 31 of ECX for CPUID leaf 1 to indicate their presence.
Hypervisors that expose more than one hypervisor interface may provide additional sets of CPUID leaves for the additional interfaces, at a spacing of100h
leaves per interface. For example, whenQEMU is configured to provide bothHyper-V andKVM interfaces, it will provide Hyper-V information starting from CPUID leaf40000000h
and KVM information starting from leaf40000100h
.[127][128]
Some hypervisors that are known to return a hypervisor ID string in leaf40000000h
include:
Hypervisor | ID String (ASCII) | Notes |
---|---|---|
MicrosoftHyper-V, Windows Virtual PC | "Microsoft Hv" [125] | |
LinuxKVM | "KVMKVMKVM\0\0\0" [129] | \0 denotes an ASCII NUL character. |
"Linux KVM Hv" [130] | Hyper-V emulation[131] | |
bhyve | "BHyVE BHyVE " ,"bhyve bhyve " | ID string changed from mixed-case to lower-case in 2013.[132] Lower-case string also used in bhyve-derived hypervisors such as xhyve and HyperKit.[133] |
Xen | "XenVMMXenVMM" [134] | Only when using HVM (hardware virtual machine) mode. |
QEMU | "TCGTCGTCGTCG" [135] | Only when the TCG (Tiny Code Generator) is enabled. |
Parallels | " lrpepyh vr" | (it possibly should be "prl hyperv", but it is encoded as " lrpepyh vr" due to anendianness mismatch)[citation needed] |
VMware | "VMwareVMware" [136] | |
Project ACRN | "ACRNACRNACRN" [137] | |
VirtualBox | "VBoxVBoxVBox" [138] | Only when configured to use the "hyperv" paravirtualization provider. |
QNX Hypervisor | "QXNQSBMV" | The QNX hypervisor detection method provided in the official QNX documentation[139] checks only the first 8 characters of the string, as provided in EBX and ECX (including an endianness swap) - EDX is ignored and may take any value. |
NetBSD NVMM | "___ NVMM ___" [140] | |
OpenBSD VMM | "OpenBSDVMM58" [141] | |
Jailhouse | "Jailhouse\0\0\0" [142] | \0 denotes an ASCII NUL character. |
Intel HAXM | "HAXMHAXMHAXM" [143] | Project discontinued. |
Intel KGT (Trusty) | "EVMMEVMMEVMM" [144] | On "trusty" branch of KGT only, which is used for theIntel x86 Architecture Distribution of Trusty OS (archive) (KGT also returns a signature in |
Unisys s-Par | "UnisysSpar64" [145] | |
Lockheed Martin LMHS | "SRESRESRESRE" [146] |
The highest calling parameter is returned in EAX.
EBX/ECX/EDX return the manufacturer ID string (same as EAX=0) on AMD but not Intel CPUs.
This returns extended feature flags in EDX and ECX.
Many of the bits inEDX
(bits 0 through 9, 12 through 17, 23, and 24) are duplicates ofEDX
from theEAX=1
leaf - these bits are highlighted in light yellow. (These duplicated bits are present on AMD but not Intel CPUs.)
AMD feature flags are as follows:[147][148]
Bit | EDX | ECX | Bit | |||
---|---|---|---|---|---|---|
Short | Feature | Short | Feature | |||
0 | fpu | Onboardx87 FPU | lahf_lm | LAHF /SAHF in long mode | 0 | |
1 | vme | Virtual mode extensions (VIF) | cmp_legacy | Hyperthreading not valid | 1 | |
2 | de | Debugging extensions (CR4 bit 3) | svm | Secure Virtual Machine | 2 | |
3 | pse | Page Size Extension | extapic | ExtendedAPIC space | 3 | |
4 | tsc | Time Stamp Counter | cr8_legacy | CR8 in 32-bit mode | 4 | |
5 | msr | Model-specific registers | abm/lzcnt | Advanced bit manipulation(LZCNT andPOPCNT ) | 5 | |
6 | pae | Physical Address Extension | sse4a | SSE4a | 6 | |
7 | mce | Machine Check Exception | misalignsse | MisalignedSSE mode | 7 | |
8 | cx8 | CMPXCHG8B (compare-and-swap) instruction | 3dnowprefetch | PREFETCH andPREFETCHW instructions | 8 | |
9 | apic | OnboardAdvanced Programmable Interrupt Controller | osvw | OS Visible Workaround | 9 | |
10 | (syscall)[a] | (SYSCALL /SYSRET , K6 only) | ibs | Instruction Based Sampling | 10 | |
11 | syscall[b] | SYSCALL andSYSRET instructions | xop | XOP instruction set | 11 | |
12 | mtrr | Memory Type Range Registers | skinit | SKINIT /STGI instructions | 12 | |
13 | pge | Page Global Enable bit inCR4 | wdt | Watchdog timer | 13 | |
14 | mca | Machine check architecture | (reserved) | 14 | ||
15 | cmov | Conditional move andFCMOV instructions | lwp | Light Weight Profiling[152] | 15 | |
16 | pat[c] | Page Attribute Table | fma4 | 4-operand fused multiply-add instructions | 16 | |
17 | pse36 | 36-bit page size extension | tce | Translation Cache Extension | 17 | |
18 | (reserved) | (reserved) | 18 | |||
19 | ecc | "Athlon MP" / "Sempron" CPU brand identification[d] | nodeid_msr | NodeID MSR (C001_100C )[157] | 19 | |
20 | nx | NX bit | (reserved) | 20 | ||
21 | (reserved) | tbm | Trailing Bit Manipulation | 21 | ||
22 | mmxext | Extended MMX | topoext | Topology Extensions | 22 | |
23 | mmx | MMX instructions | perfctr_core | Core performance counter extensions | 23 | |
24 | fxsr[c] | FXSAVE ,FXRSTOR instructions,CR4 bit 9 | perfctr_nb | Northbridge performance counter extensions | 24 | |
25 | fxsr_opt | FXSAVE /FXRSTOR optimizations | (StreamPerfMon) | (Streaming performance monitor architecture)[e] | 25 | |
26 | pdpe1gb | Gigabyte pages | dbx | Data breakpoint extensions | 26 | |
27 | rdtscp | RDTSCP instruction | perftsc | Performance timestamp counter (PTSC) | 27 | |
28 | (reserved) | pcx_l2i | L2I perf counter extensions | 28 | ||
29 | lm | Long mode | monitorx | MONITORX andMWAITX instructions | 29 | |
30 | 3dnowext | Extended 3DNow! | addr_mask_ext | Address mask extension to 32 bits for instruction breakpoints | 30 | |
31 | 3dnow | 3DNow! | (reserved) | 31 |
SYSCALL
/SYSRET
is only valid onAuthenticAMD
Family 5 Model 7 CPUs (AMD K6, 250nm "Little Foot") - for all other processors, EDX bit 11 should be used instead.These instructions were first introduced on Model 7[149] - the CPUID bit to indicate their support was moved[150] to EDX bit 11 from Model 8 (AMD K6-2) onwards.
SYSCALL
/SYSRET
is only set if theCPUID
instruction is executed in 64-bit mode.[151]FCMOV
) supportedAuthenticAMD
Family 6 processors only - the bit is, combined with processor signature andFSB speed, used to identify processors as either multiprocessor-capable or carrying theSempron brand name.[156]These return the processor brand string in EAX, EBX, ECX and EDX.CPUID
must be issued with each parameter in sequence to get the entire 48-byte ASCII processor brand string.[159] It is necessary to check whether the feature is present in the CPU by issuingCPUID
withEAX = 80000000h
first and checking if the returned value is not less than80000004h
.
The string is specified in Intel/AMD documentation to benull-terminated, however this is not always the case (e.g. DM&PVortex86DX3 and AMDRyzen 7 6800HS are known to return non-null-terminated brand strings in leaves80000002h
-80000004h
[160][161]), and software should not rely on it.
#include<stdio.h>#include<string.h>#include<cpuid.h>intmain(){unsignedintregs[12];charstr[sizeof(regs)+1];__cpuid(0x80000000,regs[0],regs[1],regs[2],regs[3]);if(regs[0]<0x80000004)return1;__cpuid(0x80000002,regs[0],regs[1],regs[2],regs[3]);__cpuid(0x80000003,regs[4],regs[5],regs[6],regs[7]);__cpuid(0x80000004,regs[8],regs[9],regs[10],regs[11]);memcpy(str,regs,sizeof(regs));str[sizeof(regs)]='\0';printf("%s\n",str);return0;}
On AMD processors, from180nm Athlon onwards (AuthenticAMD
Family 6 Model 2 and later), it is possible to modify the processor brand string returned by CPUID leaves80000002h
-80000004h
by using theWRMSR
instruction to write a 48-byte replacement string to MSRsC0010030h
-C0010035h
.[156][162] This can also be done on AMD Geode GX/LX, albeit using MSRs300Ah
-300Fh
.[163]
In some cases, determining the CPU vendor requires examining not just the Vendor ID in CPUID leaf 0 and the CPU signature in leaf 1, but also the Processor Brand String in leaves80000002h
-80000004h
. Known cases include:
Montage
in the brand string of the Montage CPUs (e.g. Montage Jintide C2460[164] and Intel Xeon Platinum 8160[165] - both of which identify themselves asGenuineIntel
Family 6 Model 55h Stepping 4 - can be distinguished in this manner.)CentaurHauls
Family 6 CPUs may be either VIA or Zhaoxin CPUs - these can be distinguished by the presence of the substringZHAOXIN
in the brand string of the Zhaoxin CPUs (e.g. Zhaoxin KaiXian ZX-C+ C4580[166] and VIA Eden X4 C4250[167] - both of which identify themselves asCentaurHauls
Family 6 Model 0Fh Stepping 0Eh - can be distinguished in this manner.)This provides information about the processor's level-1 cache andTLB characteristics in EAX, EBX, ECX and EDX as follows:[a]
Bits | EAX | EBX | ECX | EDX | Bits | |
---|---|---|---|---|---|---|
7:0 | Number of instruction TLB entries[c] | Cache line size in bytes | 7:0 | |||
15:8 | instruction TLB associativity[d] | Number of cache lines per tag | 15:8 | |||
23:16 | Number of data TLB entries[c] | Cache associativity[d] | 23:16 | |||
31:24 | Data TLB associativity[d] | Cache size in kilobytes | 31:24 |
CyrixInstead
/Geode by NSC
Family 5 Model 4 CPUs only), leaf80000005h
exists but has a completely different format, similar to that of leaf 2.[168]0x80000005
in EAX. This has the same meaning as EAX=0, i.e. no hugepage TLBs.FFh
is used to indicate a 256-entry TLB.80000005h
, the following values are used:Value | Meaning |
---|---|
0 | (reserved) |
1 | Direct-mapped |
2 toFEh | N-way set-associative (field encodes N) |
FFh | Fully-associative |
Returns details of the L2 cache in ECX, including the line size in bytes (Bits 07 - 00), type of associativity (encoded by a 4 bits field; Bits 15 - 12) and the cache size in KB (Bits 31 - 16).
#include<stdio.h>#include<cpuid.h>intmain(){unsignedinteax,ebx,ecx,edx;unsignedintlsize,assoc,cache;__cpuid(0x80000006,eax,ebx,ecx,edx);lsize=ecx&0xff;assoc=(ecx>>12)&0x07;cache=(ecx>>16)&0xffff;printf("Line size: %d B, Assoc. type: %d, Cache size: %d KB.\n",lsize,assoc,cache);return0;}
This function provides information about power management, power reporting and RAS (Reliability, availability and serviceability) capabilities of the CPU.
Bit | EBX | EDX | Bit | |||
---|---|---|---|---|---|---|
Short | Feature | Short | Feature | |||
0 | MCAOverflowRecov | MCA (Machine Check Architecture) overflow recovery support | TS | Temperature Sensor | 0 | |
1 | SUCCOR | Software uncorrectable error containment and recovery capability | FID | Frequency ID Control | 1 | |
2 | HWA | Hardware assert support (MSRsC001_10C0 toC001_10DF | VID | Voltage ID Control | 2 | |
3 | ScalableMca | Scalable MCA supported | TTP | THERMTRIP | 3 | |
4 | (reserved) | TM | Hardware thermal control (HTC) supported | 4 | ||
5 | (reserved) | STC | Software thermal control (STC) supported[170] | 5 | ||
6 | (reserved) | 100MHzSteps | 100 MHz multiplier control | 6 | ||
7 | (reserved) | HwPstate | Hardware P-state control (MSRsC001_0061 toC001_0063 ) | 7 | ||
8 | (reserved) | TscInvariant | Invariant TSC - TSC (Time Stamp Counter) rate is guaranteed to be invariant across all P-states, C-states and sop grant transitions. | 8 | ||
9 | (reserved) | CPB | Core Performance Boost | 9 | ||
10 | (reserved) | EffFreqRO | Read-only effective frequency interface (MSRsC000_00E7 andC000_00E8 ) | 10 | ||
11 | (reserved) | ProcFeedbackInterface | Processor Feedback Interface supported | 11 | ||
12 | (reserved) | ProcPowerReporting | Processor power reporting interface supported | 12 | ||
13 | (reserved) | ConnectedStandby | Connected Standby[171] | 13 | ||
14 | (reserved) | RAPL | Running Average Power Limit[171] | 14 | ||
15 | (reserved) | FastCPPC | Fast CPPC (Collaborative Processor Performance Control) supported[171] | 15 | ||
31:16 | (reserved) | (reserved) | 31:16 |
Bits | EAX | ECX | Bits | |||
---|---|---|---|---|---|---|
Short | Feature | Short | Feature | |||
7:0 | NumberOfMonitors | Number of Processor Feedback MSR pairs available, starting from MSRC001_0080 onwards[172] | CpuPwrSampleTimeRatio | Ratio of compute unit power accumulator sample period to TSC counter period. | 7:0 | |
15:8 | Version | Processor Feedback Capabilities version | 15:8 | |||
31:16 | MaxWrapTime | Maximum time between reads (in milliseconds) that software should use to avoid two wraps. | 31:16 |
Bit | EBX | |
---|---|---|
Short | Feature | |
0 | clzero | CLZERO instruction |
1 | retired_instr | Retired instruction count MSR (C000_00E9h ) supported |
2 | xrstor_fp_err | XRSTOR restores FP errors |
3 | invlpgb | INVLPGB andTLBSYNC instructions |
4 | rdpru | RDPRU instruction |
5 | (reserved) | |
6 | mbe | Memory Bandwidth Enforcement |
7 | (reserved) | |
8 | mcommit | MCOMMIT instruction |
9 | wbnoinvd | WBNOINVD instruction |
10 | (reserved) | |
11 | (reserved) | |
12 | IBPB | Indirect Branch Prediction Barrier (performed by writing 1 to bit 0 ofPRED_CMD (MSR049h )) |
13 | wbinvd_int | WBINVD andWBNOINVD are interruptible |
14 | IBRS | Indirect Branch Restricted Speculation |
15 | STIBP | Single Thread Indirect Branch Prediction mode |
16 | IbrsAlwaysOn | IBRS mode has enhanced performance and should be left always on |
17 | StibpAlwaysOn | STIBP mode has enhanced performance and should be left always on |
18 | ibrs_preferred | IBRS preferred over software |
19 | ibrs_same_mode_protection | IBRS provides Same Mode Protection |
20 | no_efer_lmsle | EFER.LMSLE is unsupported[a] |
21 | invlpgb_nested | INVLPGB support for nested pages |
22 | (reserved) | |
23 | ppin | Protected Processor Inventory Number -
|
24 | ssbd | Speculative Store Bypass Disable |
25 | ssbd_legacy | Speculative Store Bypass Disable Legacy |
26 | ssbd_no | Speculative Store Bypass Disable Not Required |
27 | cppc | Collaborative Processor Performance Control |
28 | psfd | Predictive Store Forward Disable |
29 | btc_no | Branch Type Confusion: Processor not affected |
30 | IBPB_RET | IBPB (see bit 12) also clears return address predictor |
31 | branch_sampling | Branch Sampling Support[174] |
Bits | EAX | ECX | EDX | Bits | ||
---|---|---|---|---|---|---|
7:0 | Number of Physical Address Bits | Number of Physical Threads in processor (minus 1) | Maximum page count forINVLPGB instruction | 7:0 | ||
11:8 | Number of Linear Address Bits | (reserved) | 11:8 | |||
15:12 | APIC ID Size | 15:12 | ||||
17:16 | Guest Physical Address Size[b] | Performance Timestamp Counter size | Maximum ECX value recognized byRDPRU instruction | 17:16 | ||
23:18 | (reserved) | 23:18 | ||||
31:24 | (reserved) | 31:24 |
AuthenticAMD
Family 0Fh Model 14h[173] (90nm Athlon64/Opteron) CPUs and is present in all later AMD CPUs - except the ones with the 'no_efer_lmsle' flag set.This leaf returns information about AMD SVM (Secure Virtual Machine) features in EAX, EBX and EDX.
Bits | EAX | EBX | ECX | Bits | ||
---|---|---|---|---|---|---|
7:0 | SVM Revision Number | Number of available ASIDs (address space identifiers) | (reserved) | 7:0 | ||
8 | (hypervisor)[a] | 8 | ||||
31:9 | (reserved) | 31:9 |
Bit | EDX | |
---|---|---|
Short | Feature | |
0 | NP | Rapid Virtualization Indexing (Nested Paging) |
1 | LbrVirt | LBR (Last Branch Records) virtualization |
2 | SVML | SVM-Lock |
3 | NRIPS | nRIP (next sequential instruction pointer) save on #VMEXIT supported |
4 | TscRateMsr | MSR-basedTSC rate control (MSRC000_0104h ) |
5 | VmcbClean | VMCB (Virtual Machine Control Block) clean bits supported |
6 | FlushByAsid | TLB flush events (e.g.CR3 writes,CR4.PGE toggles) only flush the TLB entries of the current ASID (address space ID) |
7 | DecodeAssist | Decode assists supported |
8 | PmcVirt | PMC (Performance Monitoring Counters) virtualization |
9 | (SseIsa10Compat)[b] | (reserved) |
10 | PauseFilter | PAUSE intercept filter supported |
11 | (reserved) | |
12 | PauseFilterThreshold | PAUSE filter cycle count threshold supported |
13 | AVIC | AMD Advanced Virtualized Interrupt Controller supported |
14 | (reserved) | |
15 | VMSAVEvirt | VMSAVE andVMLOAD virtualization |
16 | VGIF | Global Interrupt Flag (GIF) virtualization |
17 | GMET | Guest Mode Execution Trap |
18 | x2AVIC | x2APIC mode supported for AVIC |
19 | SSSCheck | SVM Supervisorshadow stack restrictions |
20 | SpecCtrl | SPEC_CTRL (MSR2E0h ) virtualization |
21 | ROGPT | Read-Only Guest Page Table supported |
22 | (reserved) | |
23 | HOST_MCE_OVERRIDE | Guest modeMachine-check exceptions when hostCR4.MCE=1 and guestCR4.MCE=0 cause intercepts instead of shutdowns |
24 | TlbiCtl | INVLPGB /TLBSYNC hypervisor enable in VMCB andTLBSYNC intercept support |
25 | VNMI | NMI (Non-Maskable interrupt) virtualization |
26 | IbsVirt | IBS (Instruction-Based Sampling) virtualization |
27 | ExtLvtOffsetFaultChg | Read/Write fault behavior for extended LVT offsets (APIC addresses0x500-0x530 ) changed to Read Allowed, Write #VMEXIT[181] |
28 | VmcbAddrChkChg | VMCB address check change[181] |
29 | BusLockThreshold | Bus Lock Threshold |
30 | IdleHltIntercept | Idle HLT (HLT instruction executed while no virtual interrupt is pending) intercept |
31 | EnhancedShutdownIntercept | Support for EXITINFO1 on shutdown intercept, and nested shutdown intercepts will result in a non-interceptible shutdown.[182] |
Later AMD documentation, such as #25481 "CPUID specification" rev 2.18[176] and later, only lists the bit as reserved.
In rev 2.30[177] and later, a different bit is listed as reserved for hypervisor use:CPUID.(EAX=1):ECX[bit 31].
Rev 2.28 of #25481 lists the bit as "Ssse3Sse5Dis"[179] - in rev 2.34, it is listed as having been removed from the spec at rev 2.32 under the name "SseIsa10Compat".[180]
Bit | EAX | |
---|---|---|
Short | Feature | |
0 | SME | Secure Memory Encryption |
1 | SEV | Secure Encrypted Virtualization |
2 | PageFlushMSR | Page flush MSR (C001_011Eh ) supported |
3 | SEV-ES | SEV Encrypted State |
4 | SEV-SNP | SEV Secure Nested Paging |
5 | VMPL | VM Privilege Levels |
6 | RMPQUERY | RMPQUERY instruction supported |
7 | VmplSSS | VMPL Supervisorshadow stack supported |
8 | SecureTSC | SecureTSC supported |
9 | TscAuxVirtualization | Virtualization ofTSC_AUX MSR (C000_0103 ) supported |
10 | HwEnfCacheCoh | Hardware cache coherency across encryption domains enforced |
11 | 64BitHost | SEV Guest execution only allowed from 64-bit host |
12 | RestrictedInjection | SEV-ES guests can refuse all event-injections except #HV (Hypervisor Injection Exception) |
13 | AlternateInjection | SEV-ES guests can use an encrypted VMCB field for event-injection |
14 | DebugVirt | Full debug state virtualization supported for SEV-ES and SEV-SNP guests |
15 | PreventHostIBS | Prevent host IBS for a SEV-ES guest |
16 | VTE | Virtual Transparent Encryption for SEV |
17 | VmgexitParameter | VMGEXIT parameter is supported (using the RAX register) |
18 | VirtualTomMsr | Virtual TOM (top-of-memory) MSR (C001_0135 ) supported |
19 | IbsVirtGuestCtl | IBS virtualization is supported for SEV-ES and SEV-SNP guests |
20 | PmcVirtGuestCtl | PMC virtualization is supported for SEV-ES and SEV-SNP guests |
21 | RMPREAD | RMPREAD instruction supported |
22 | GuestInterceptControl | Guest Intercept control supported for SEV-ES guests |
23 | SegmentedRmp | Segmented RMP (Reverse-Map Table) supported |
24 | VmsaRegProt | VMSA (VM Save Area) register protection supported |
25 | SmtProtection | SMT Protection supported |
26 | SecureAvic | Secure AVIC supported |
27 | AllowedSEVfeatures | ALLOWED_SEV_FEATURES_MASK field in VMCB (offset138h ) supported |
28 | SVSMCommPageMSR | SVSM (Secure VM Service Module[183]) communication page MSR (C001_F000h ) supported |
29 | NestedVirtSnpMsr | VIRT_RMPUPDATE (C001_F001h ) andVIRT_PSMASH (C001_F002h ) MSRs supported |
30 | HvInUseWrAllowed | Writes to Hypervisor-owned paged allowed when marked in-use |
31 | IbpbOnEntry | IBPB on entry to virtual machine supported |
Bits | EBX | ECX | EDX | Bits |
---|---|---|---|---|
5:0 | C-bit (encryption enable bit) location in page table entry | Maximum ASID value that can be used for a SEV-enabled guest (maximum number of encrypted guests that can be supported simultaneously) | Minimum ASID value for a guest that is SEV-enabled but not SEV-ES-enabled | 5:0 |
11:6 | Physical address width reduction when memory encryption is enabled | 11:6 | ||
15:12 | Number of VMPLs (VM Privilege Levels) supported | 15:12 | ||
31:16 | (reserved) | 31:16 |
Bit | EAX | |
---|---|---|
Short | Feature | |
0 | NoNestedDataBp | Processor ignores nested data breakpoints |
1 | FsGsKernelGsBaseNonSerializing | WRMSR to theFS_BASE ,GS_BASE andKernelGSBase MSRs is non-serializing[184] |
2 | LFenceAlwaysSerializing | LFENCE is always dispatch serializing |
3 | SmmPgCfgLock | SMM paging configuration lock supported |
4 | (reserved) | |
5 | (reserved) | |
6 | NullSelectClearsBase | Null segment selector loads also clear the destination segment register base and limit |
7 | UpperAddressIgnore | Upper Address Ignore is supported |
8 | AutomaticIBRS | Automatic IBRS |
9 | NoSmmCtlMSR | SMM_CTL MSR (C0010116h ) is not supported |
10 | FSRS | Fast shortREP STOSB supported |
11 | FSRC | Fast shortREPE CMPSB supported |
12 | PMC2PreciseRetire | PreciseRetire performance counter control bit (MSRC0010002h bit 43) supported[182] |
13 | PrefetchCtlMsr | PrefetchControl MSR (C0000108h ) is supported |
14 | L2TlbSIzeX32 | If set, L2 TLB sizes (leaf80000006h ) are encoded as multiples of 32 |
15 | AMD_ERMSB | Processor supports AMD implementation of EnhancedREP MOVSB andREP STOSB |
16 | OPCODE_0F017_RECLAIM | Reserves opcode0F 01 /7 for AMD use, returning #UD.[182] |
17 | CpuidUserDis | CPUID disable for non-privileged software (#GP) |
18 | EPSF | Enhanced Predictive Store Forwarding supported[184] |
19 | FAST_REP_SCASB | Fast ShortREP SCASB supported |
20 | PREFETCHI | Instruction Cache prefetch instructions supported |
21 | FP512_DOWNGRADE | Downgrade of 512-bit datapath to 256-bit supported.[a] |
22 | WL_CLASS_SUPPORT | Support for workload-based heuristic feedback to OS for scheduling decisions |
23 | (reserved) | |
24 | ERAPS | Enhanced Return Address Predictor Security (see also EBX[23:16] "RapSize") |
25 | (reserved) | |
26 | (reserved) | |
27 | SBPB | Selective Branch Predictor Barrier supported[186] |
28 | IBPB_BRTYPE | IBPB flushes all branch type predictions[186] |
29 | SRSO_NO | CPU is not subject to SRSO (Speculative Return Stack Overflow) vulnerability[186] |
30 | SRSO_USER_KERNEL_NO | CPU is not subject to SRSO vulnerability across user/kernel boundary[186] |
31 | SRSO_MSR_FIX | SRSO can be mitigated by setting bit 4 of BP_CFG (MSR C001_102E )[186] |
Bit | EBX | |
---|---|---|
Short | Feature | |
15:0 | MicrocodePatchSize | The size of the Microcode patch in 16-byte multiples. If 0, the size of the patch is at most 5568 (15C0h) bytes |
23:16 | RapSize | Return Address Predictor Size. RapSize * 8 is the minimum number of CALL instructions without matchingRET instructions that are needed to flush the Return Address Predictor. |
31:24 | (reserved) |
Several AMD CPU models will, for CPUID withEAX=8FFFFFFFh
, return an Easter Egg string in EAX, EBX, ECX and EDX.[187][188] Known Easter Egg strings include:
Processor | String |
---|---|
AMD K6 | NexGenerationAMD |
AMD K8 | IT'SHAMMER TIME |
AMD Jaguar[189] | HELLO KITTY! ^-^ |
Returns index of highest Centaur leaf in EAX. If the returned value in EAX is less thanC0000001h
, then Centaur extended leaves are not supported.
Present in CPUs fromVIA andZhaoxin.
On IDTWinChip CPUs (CentaurHauls
Family 5), the extended leavesC0000001h-C0000005h
do not encode any Centaur-specific functionality but are instead aliases of leaves80000001h-80000005h
.[190]
This leaf returns Centaur feature information (mainlyVIA/Zhaoxin PadLock) in EDX.[191][192][193][194] (EAX, EBX and ECX are reserved.)
Bit | EDX | |
---|---|---|
Short | Feature | |
0 | sm2[a] | GMISM2 instruction present |
1 | sm2_en[a] | SM2 enabled |
2 | rng | PadLockRNG present:XSTORE andREP XSTORE instructions |
3 | rng_en | RNG enabled |
4 | ccs[a] | GMISM3/SM4 instructions present:CCS_HASH andCCS_ENCRYPT |
5 | ccs_en[a] | SM3/SM4 instructions enabled |
6 | xcrypt | PadLock Advanced Cryptographic Engine (ACE, usingAES cipher) present:REP XCRYPT(ECB,CBC,CFB,OFB) instructions |
7 | xcrypt_en | ACE enabled |
8 | ace2 | ACE v2 present:REP XCRYPTCTR instruction, as well as support for digest mode and misaligned data for ACE'sREP XCRYPT* instructions. |
9 | ace2_en | ACE v2 enabled |
10 | phe | PadLock Hash Engine (PHE):REP XSHA1 andREP XSHA256 instructions |
11 | phe_en | PHE enabled |
12 | pmm | PadLockMontgomery Multiplier (PMM):REP MONTMUL instruction |
13 | pmm_en | PMM enabled |
14 | (reserved) | |
15 | zx_fma | FMA supported |
16 | parallax | AdaptiveP-state control present |
17 | parallax_en | Adaptive P-state control enabled |
18 | overstress | Overstress feature for auto overclock present |
19 | overstress_en | Overstress feature for auto overclock enabled |
20 | tm3 | Thermal Monitor 3 present |
21 | tm3_en | Thermal Monitor 3 enabled |
22 | rng2 | RNG v2 - second generation RNG present:REP XRNG2 instruction |
23 | rng2_en | RNG v2 enabled |
24 | sem | SME feature present |
25 | phe2 | PHE v2: SHA384 and SHA512 present |
26 | phe2_en | PHE v2 enabled |
27 | xmodx | RSA instructions present:XMODEXP andMONTMUL2 instructions |
28 | xmodx_en | RSA instructions enabled |
29 | vex | VEX instructions present |
30 | vex_en | VEX instructions enabled |
31 | stk | STK is present |
This information is easy to access from other languages as well. For instance, the C code for gcc below prints the first five values, returned by the cpuid:
#include<stdio.h>#include<cpuid.h>intmain(){unsignedinti,eax,ebx,ecx,edx;for(i=0;i<5;i++){__cpuid(i,eax,ebx,ecx,edx);printf("InfoType %x\nEAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n",i,eax,ebx,ecx,edx);}return0;}
In MSVC and Borland/Embarcadero C compilers (bcc32) flavored inline assembly, the clobbering information is implicit in the instructions:
#include<stdio.h>intmain(){unsignedinta,b,c,d,i=0;__asm{/* Do the call. */movEAX,i;cpuid;/* Save results. */mova,EAX;movb,EBX;movc,ECX;movd,EDX;}printf("InfoType %x\nEAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n",i,a,b,c,d);return0;}
If either version was written in plain assembly language, the programmer must manually save the results of EAX, EBX, ECX, and EDX elsewhere if they want to keep using the values.
GCC also provides a header called<cpuid.h>
on systems that have CPUID. The__cpuid
is a macro expanding to inline assembly. Typical usage would be:
#include<stdio.h>#include<cpuid.h>intmain(){unsignedinteax,ebx,ecx,edx;__cpuid(0/* vendor string */,eax,ebx,ecx,edx);printf("EAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n",eax,ebx,ecx,edx);return0;}
But if one requested an extended feature not present on this CPU, they would not notice and might get random, unexpected results. Safer version is also provided in<cpuid.h>
. It checks for extended features and does some more safety checks. The output values are not passed using reference-like macro parameters, but more conventional pointers.
#include<stdio.h>#include<cpuid.h>intmain(){unsignedinteax,ebx,ecx,edx;/* 0x81234567 is nonexistent, but assume it exists */if(!__get_cpuid(0x81234567,&eax,&ebx,&ecx,&edx)){printf("Warning: CPUID request 0x81234567 not valid!\n");return1;}printf("EAX: %x\nEBX: %x\nECX: %x\nEDX: %x\n",eax,ebx,ecx,edx);return0;}
Notice the ampersands in&a, &b, &c, &d
and the conditional statement. If the__get_cpuid
call receives a correct request, it will return a non-zero value, if it fails, zero.[196]
Microsoft Visual C compiler has builtin function__cpuid()
so the cpuid instruction may be embedded without using inline assembly, which is handy since the x86-64 version of MSVC does not allow inline assembly at all. The same program forMSVC would be:
#include<stdio.h>#ifdef _MSC_VER#include<intrin.h>#endifintmain(){unsignedintregs[4];inti;for(i=0;i<4;i++){__cpuid(regs,i);printf("The code %d gives %d, %d, %d, %d",regs[0],regs[1],regs[2],regs[3]);}return0;}
Many interpreted or compiled scripting languages are capable of using CPUID via anFFI library.One such implementation shows usage of the Ruby FFI module to execute assembly language that includes the CPUID opcode.
.NET 5 and later versions provide theSystem.Runtime.Intrinsics.X86.X86base.CpuId
method. For instance, the C# code below prints the processor brand if it supports CPUID instruction:
usingSystem.Runtime.InteropServices;usingSystem.Runtime.Intrinsics.X86;usingSystem.Text;namespaceX86CPUID{classCPUBrandString{publicstaticvoidMain(string[]args){if(!X86Base.IsSupported){Console.WriteLine("Your CPU does not support CPUID instruction.");}else{Span<int>raw=stackallocint[12];(raw[0],raw[1],raw[2],raw[3])=X86Base.CpuId(unchecked((int)0x80000002),0);(raw[4],raw[5],raw[6],raw[7])=X86Base.CpuId(unchecked((int)0x80000003),0);(raw[8],raw[9],raw[10],raw[11])=X86Base.CpuId(unchecked((int)0x80000004),0);Span<byte>bytes=MemoryMarshal.AsBytes(raw);stringbrand=Encoding.UTF8.GetString(bytes).Trim();Console.WriteLine(brand);}}}}
Some of the non-x86 CPU architectures also provide certain forms of structured information about the processor's abilities, commonly as a set of special registers:
CPUID
coprocessor register which requiresexception level EL1 or above to access.[197]STIDP
) instruction since the 1983IBM 4381[198] for querying the processor ID.[199]STFLE
) instruction which lists the installed hardware features.[199]PrId
) and a series of daisy-chainedConfiguration Registers.[200]PVR
) identifying the processor model in use. The instruction requires supervisor access level.[201]DSP andtransputer-like chip families have not taken up the instruction in any noticeable way, in spite of having (in relative terms) as many variations in design. Alternate ways of silicon identification might be present; for example, DSPs fromTexas Instruments contain a memory-based register set for each functional unit that starts with identifiers determining the unit type and model, itsASIC design revision and features selected at the design phase, and continues with unit-specific control and data registers. Access to these areas is performed by simply using the existing load and store instructions; thus, for such devices, there is no need for extending the register set for device identification purposes.[citation needed]
CPUID
to identify various system settingsIntel and AMD CPUs have reserved bit 31 of ECX of CPUID leaf 0x1 as the hypervisor present bit. This bit allows hypervisors to indicate their presence to the guest operating system. Hypervisors set this bit and physical CPUs (all existing and future CPUs) set this bit to zero. Guest operating systems can test bit 31 to detect if they are running inside a virtual machine.
Bit 31 of ECX of CPUID leaf 0x1. This bit has been reserved by Intel & AMD for use by hypervisors and indicates the presence of a hypervisor. Virtual CPU's (hypervisors) set this bit to 1 and physical CPU's (all existing and future CPU's) set this bit to zero. This bit can be probed by the guest software to detect whether they are running inside a virtual machine.
15.2.2 Guest Mode This new processor mode is entered through the VMRUN instruction. When in guest mode, the behavior of some x86 instructions changes to facilitate virtualization. The CPUID function numbers 4000_0000h-4000_00FFh have been reserved for software use. Hypervisors can use these function numbers to provide an interface to pass information from the hypervisor to the guest. This is similar to extracting information about a physical CPU by using CPUID. Hypervisors use the CPUID Fn 400000[FF:00] bit to denote a virtual platform. Feature bit CPUID Fn0000_0001_ECX[31] has been reserved for use by hypervisors to indicate the presence of a hypervisor. Hypervisors set this bit to 1 and physical CPU's set this bit to zero. This bit can be probed by the guest software to detect whether they are running inside a virtual machine.
8FFFFFFFh
. Retrieved 22 December 2022.