CPUID

The CPUID opcode is a processor supplementary instruction (its name derived from CPU IDentification) for the x86 architecture. It was introduced by Intel in 1993 when it introduced the Pentium and SL-Enhanced 486 processors.

By using the CPUID opcode, software can determine processor type and the presence of features (like MMX/SSE). The CPUID opcode is 0Fh, 0A2h (as two bytes, or 0A20Fh as a single word) and the value in the EAX register, and in some cases the ECX register, specifies what information to return.

Prior to the general availability of the CPUID instruction, programmers would write esoteric machine code which exploited minor differences in CPU behavior in order to determine the processor make and model. Outside the x86 family, developers are sometimes still required to use esoteric processes to determine the variations in CPU design that are present. While the CPUID instruction is specific to the x86 architecture, other architectures often provide on-chip registers which can be read to obtain the same sorts of information provided by this instruction.

Calling CPUID

In assembly language the CPUID instruction takes no parameters as CPUID implicitly uses the EAX register. The EAX register should be loaded with a value specifying what information to return. CPUID should be called with EAX = 0 first, as this will return the highest calling parameter that the CPU supports. To obtain extended function information CPUID should be called with bit 31 of EAX set. To determine the highest extended function calling parameter, call CPUID with EAX = 80000000h.

EAX=0: Get vendor ID

This returns the CPU's manufacturer ID string - a twelve character ASCII string stored in EBX, EDX, ECX - in that order. The highest basic calling parameter (largest value that EAX can be set to before calling CPUID) is returned in EAX.

The following are known processor manufacturer ID strings:

• "AMDisbetter!" — early engineering samples of AMD K5 processor
• "AuthenticAMD" — AMD
• "CentaurHauls" — Centaur
• "CyrixInstead" — Cyrix
• "GenuineIntel" — Intel
• "TransmetaCPU" — Transmeta
• "GenuineTMx86" — Transmeta
• "Geode by NSC" — National Semiconductor
• "NexGenDriven" — NexGen
• "RiseRiseRise" — Rise
• "SiS SiS SiS " — SiS
• "UMC UMC UMC " — UMC
• "VIA VIA VIA " — VIA
• "Vortex86 SoC" — Vortex
• "KVMKVMKVM" - KVM

For instance, on a GenuineIntel processor values returned in EBX is 0x756e6547, EDX is 0x49656e69 and ECX is 0x6c65746e. The following code is written in GNU Assembler for the x86-64 architecture and displays the vendor ID string as well as the highest calling parameter that the CPU supports.

	.data

s0:
	.asciz	"Largest basic function number supported: %i\n"
s1:
	.asciz	"Vendor ID: %.12s\n"

	.text

	.align	32
	.globl	_start
_start:
	pushq	%rbp
        pushq   %rbx
	movq	%rsp,%rbp
	subq	$16,%rsp

	xorl	%eax,%eax
	cpuid

	movl	%ebx,0(%rsp)
	movl	%edx,4(%rsp)
	movl	%ecx,8(%rsp)

	movq	$s0,%rdi
	movl	%eax,%esi
	xorb	%al,%al
	call	printf

	movq	$s1,%rdi
	movq	%rsp,%rsi
	xorb	%al,%al
	call	printf

	movq	%rbp,%rsp
        popq    %rbx
	popq	%rbp
	movl    $1,%eax
        int     $0x80

EAX=1: Processor Info and Feature Bits

This returns the CPU's stepping, model, and family information in EAX (also called the signature of a CPU), feature flags in EDX and ECX, and additional feature info in EBX.

The format of the information in EAX is as follows:

• 3:0 - Stepping
• 7:4 - Model
• 11:8 - Family
• 13:12 - Processor Type
• 19:16 - Extended Model
• 27:20 - Extended Family

Intel has suggested applications to display the family of a CPU as the sum of the "Family" and the "Extended Family" fields shown above, and the model as the sum of the "Model" and the 4-bit left-shifted "Extended Model" fields.

AMD recommends the same only if "Family" is equal to 15 (i.e. all bits set to 1). If "Family" is lower than 15, only the "Family" and "Model" fields should be used while the "Extended Family" and "Extended Model" bits are reserved. If "Family" is set to 15, then "Extended Family" and the 4-bit left-shifted "Extended Model" should be added to the respective base values.

The processor info and feature flags are manufacturer specific but usually the Intel values are used by other manufacturers for the sake of compatibility.

The standard Intel feature flags are as follows

EAX=1 CPUID feature bits

Bit	EDX		ECX
	Short	Feature	Short	Feature
0	fpu	Onboard x87 FPU	pni	Prescott New Instructions (SSE3)
1	vme	Virtual mode extensions (VIF)	pclmulqdq	PCLMULQDQ support
2	de	Debugging extensions (CR4 bit 3)	dtes64	64-bit debug store (edx bit 21)
3	pse	Page Size Extension	monitor	MONITOR and MWAIT instructions (SSE3)
4	tsc	Time Stamp Counter	ds_cpl	CPL qualified debug store
5	msr	Model-specific registers	vmx	Virtual Machine eXtensions
6	pae	Physical Address Extension	smx	Safer Mode Extensions (LaGrande)
7	mce	Machine Check Exception	est	Enhanced SpeedStep
8	cx8	CMPXCHG8 (compare-and-swap) instruction	tm2	Thermal Monitor 2
9	apic	Onboard Advanced Programmable Interrupt Controller	ssse3	Supplemental SSE3 instructions
10	(reserved)		cid	Context ID
11	sep	SYSENTER and SYSEXIT instructions	(reserved)
12	mtrr	Memory Type Range Registers	fma	Fused multiply-add (FMA3)
13	pge	Page Global Enable bit in CR4	cx16	CMPXCHG16B instruction
14	mca	Machine check architecture	xtpr	Can disable sending task priority messages
15	cmov	Conditional move and FCMOV instructions	pdcm	Perfmon & debug capability
16	pat	Page Attribute Table	(reserved)
17	pse36	36-bit page size extension	pcid	Process context identifiers (CR4 bit 17)
18	pn	Processor Serial Number	dca	Direct cache access for DMA writes
19	clflush	CLFLUSH instruction (SSE2)	sse4_1	SSE4.1 instructions
20	(reserved)		sse4_2	SSE4.2 instructions
21	dts	Debug store: save trace of executed jumps	x2apic	x2APIC support
22	acpi	Onboard thermal control MSRs for ACPI	movbe	MOVBE instruction (big-endian, Intel Atom only)
23	mmx	MMX instructions	popcnt	POPCNT instruction
24	fxsr	FXSAVE, FXRESTOR instructions, CR4 bit 9	tscdeadline	APIC supports one-shot operation using a TSC deadline value
25	sse	SSE instructions (a.k.a. Katmai New Instructions)	aes	AES instruction set
26	sse2	SSE2 instructions	xsave	XSAVE, XRESTOR, XSETBV, XGETBV
27	ss	CPU cache supports self-snoop	osxsave	XSAVE enabled by OS
28	ht	Hyper-threading	avx	Advanced Vector Extensions
29	tm	Thermal monitor automatically limits temperature	f16c	CVT16 instruction set (half-precision) FP support
30	ia64	IA64 processor emulating x86	rdrnd	RDRAND (on-chip random number generator) support
31	pbe	Pending Break Enable (PBE# pin) wakeup support	hypervisor	Running on a hypervisor (always 0 on a real CPU, but also with some hypervisors)

EAX=2: Cache and TLB Descriptor information

This returns a list of descriptors indicating cache and TLB capabilities in EAX, EBX, ECX and EDX registers.

EAX=3: Processor Serial Number

See also: Pentium III § Controversy about privacy issues

This returns the processor's serial number. The processor serial number was introduced on Intel Pentium III, but due to privacy concerns, this feature is no longer implemented on later models (PSN feature bit is always cleared). Transmeta's Efficeon and Crusoe processors also provide this feature. AMD CPUs however, do not implement this feature in any CPU models.

For Intel Pentium III CPUs, the serial number is returned in EDX:ECX registers. For Transmeta Efficeon CPUs, it is returned in EBX:EAX registers. And for Transmeta Crusoe CPUs, it is returned in EBX register only.

Note that the processor serial number feature must be enabled in the BIOS setting in order to function.

EAX=80000000h: Get Highest Extended Function Supported

The highest calling parameter is returned in EAX.

EAX=80000001h: Extended Processor Info and Feature Bits

This returns extended feature flags in EDX and ECX.

AMD feature flags are as follows

EAX=80000001h CPUID feature bits

Bit	EDX		ECX
	Short	Feature	Short	Feature
0	fpu	Onboard x87 FPU	lahf_lm	LAHF/SAHF in long mode
1	vme	Virtual mode extensions (VIF)	cmp_legacy	Hyperthreading not valid
2	de	Debugging extensions (CR4 bit 3)	svm	Secure Virtual Machine
3	pse	Page Size Extension	extapic	Extended APIC space
4	tsc	Time Stamp Counter	cr8_legacy	CR8 in 32-bit mode
5	msr	Model-specific registers	abm	Advanced bit manipulation (lzcnt and popcnt)
6	pae	Physical Address Extension	sse4a	SSE4a
7	mce	Machine Check Exception	misalignsse	Misaligned SSE mode
8	cx8	CMPXCHG8 (compare-and-swap) instruction	3dnowprefetch	PREFETCH and PREFETCHW instructions
9	apic	Onboard Advanced Programmable Interrupt Controller	osvw	OS Visible Workaround
10	(reserved)		ibs	Instruction Based Sampling
11	syscall	SYSCALL and SYSRET instructions	xop	XOP instruction set
12	mtrr	Memory Type Range Registers	skinit	SKINIT/STGI instructions
13	pge	Page Global Enable bit in CR4	wdt	Watchdog timer
14	mca	Machine check architecture	(reserved)
15	cmov	Conditional move and FCMOV instructions	lwp	Light Weight Profiling
16	pat	Page Attribute Table	fma4	4 operands fused multiply-add
17	pse36	36-bit page size extension	tce	Translation Cache Extension
18	(reserved)
19	mp	Multiprocessor Capable	nodeid_msr	NodeID MSR
20	nx	NX bit	(reserved)
21	(reserved)		tbm	Trailing Bit Manipulation
22	mmxext	Extended MMX	topoext	Topology Extensions
23	mmx	MMX instructions	perfctr_core	Core performance counter extensions
24	fxsr	FXSAVE, FXRSTOR instructions, CR4 bit 9	perfctr_nb	NB performance counter extensions
25	fxsr_opt	FXSAVE/FXRSTOR optimizations	(reserved)
26	pdpe1gb	Gibibyte pages	(reserved)
27	rdtscp	RDTSCP instruction	(reserved)
28	(reserved)
29	lm	Long mode	(reserved)
30	3dnowext	Extended 3DNow!	(reserved)
31	3dnow	3DNow!	(reserved)

EAX=80000002h,80000003h,80000004h: Processor Brand String

These return the processor brand string in EAX, EBX, ECX and EDX. CPUID must be issued with each parameter in sequence to get the entire 48-byte null-terminated ASCII processor brand string. It is necessary to check whether the feature is supported by the CPU by issuing CPUID with EAX = 80000000h first and checking if the returned value is greater or equal to 80000004h.

.section .data

s0 : .asciz "Processor Brand String: %.48s\n"
err : .asciz "Feature unsupported.\n"

.section .text

.global main
.type main,@function
.align 32
main:
	pushq	%rbp
	movq	%rsp,	%rbp
	subq	$48,	%rsp
	pushq	%rbx
	
	movl	$0x80000000,	%eax
	cpuid
	
	cmpl	$0x80000004,	%eax
	jl	error
	
	movl	$0x80000002,	%esi
	movq	%rsp,	%rdi

.align 16
get_brand:
	movl	%esi,	%eax
	cpuid
	
	movl	%eax,	(%rdi)
	movl	%ebx,	4(%rdi)
	movl	%ecx,	8(%rdi)
	movl	%edx,	12(%rdi)
	
	addl	$1,	%esi
	addq	$16,	%rdi
	cmpl	$0x80000004,	%esi
	jle	get_brand

print_brand:
	movq	$s0,	%rdi
	movq	%rsp,	%rsi
	xorb	%al,	%al
	call	printf
	
	jmp	end

.align 16
error:
	movq	$err,	%rdi
	xorb	%al,	%al
	call	printf

.align 16
end:
	popq	%rbx
	movq	%rbp,	%rsp
	popq	%rbp
	xorl	%eax,	%eax
	ret

EAX=80000005h: L1 Cache and TLB Identifiers

This function contains the processor’s L1 cache and TLB characteristics.

EAX=80000006h: Extended L2 Cache Features

Returns details of the L2 cache in ECX, including the line size in bytes, type of associativity (encoded by a 4 bits) and the cache size.

.section .data

info : .ascii "L2 Cache Size : %u KB\nLine size : %u bytes\n"
.asciz "Associativity : %02xh\n"
err : .asciz "Feature unsupported.\n"

.section .text

.global main
.type main,@function
.align 32
main:
	pushq	%rbp
	movq	%rsp,	%rbp
	pushq	%rbx
	
	movl	$0x80000000,	%eax
	cpuid
	
	cmpl	$0x80000006,	%eax
	jl	error
	
	movl	$0x80000006,	%eax
	cpuid
	
	movl	%ecx,	%eax
	
	movl	%eax,	%edx
	andl	$0xff,	%edx
	
	movl	%eax,	%ecx
	shrl	$12,	%ecx
	andl	$0xf,	%ecx
	
	movl	%eax,	%esi
	shrl	$16,	%esi
	andl	$0xffff,%esi
	
	movq	$info,	%rdi
	xorb	%al,	%al
	call	printf
	
	jmp end
	
.align 16
error:
	movq	$err,	%rdi
	xorb	%al,	%al
	call	printf

.align 16
end:
	popq	%rbx
	movq	%rbp,	%rsp
	popq	%rbp
	xorl	%eax,	%eax
	ret

EAX=80000007h: Advanced Power Management Information

This function provides advanced power management feature identifiers.

EAX=80000008h: Virtual and Physical address Sizes

Returns largest virtual and physical address sizes in EAX.

Accessing the id from other languages

This information is easy to access from other languages as well. For instance, the C++ code for gcc below prints the first five values, returned by the cpuid:

#include <iostream>

int main()
{
  int a, b;

  for (a = 0; a < 5; a++)
  {
    __asm__("cpuid;"
            :"=a"(b)                 // EAX into b (output)
            :"0"(a)                  // a into EAX (input)
            :"%ebx","%ecx","%edx");  // clobbered registers

    std::cout << "The code " << a << " gives " << b << std::endl;
  }

  return 0;
}

In C, the code may be shortened to:

int main()
{
  int a, b;

  for (a = 0; a < 5; a++)
  {
    __asm__("cpuid"
            :"=a"(b)                 // EAX into b (output)
            :"0"(a)                  // a into EAX (input)
            :"%ebx","%ecx","%edx");  // clobbered registers

    printf("The code %i gives %i\n", a, b);
  }

  return 0;
}

Or, a generally useful C implementation that works on 32 and 64 bit setups:

#include <stdio.h>

int main() {
    int i;
    unsigned int index = 0;
    unsigned int regs[4];
    int sum;
    __asm__ __volatile__(
#if defined(__x86_64__) || defined(_M_AMD64) || defined (_M_X64)
        "pushq %%rbx     \n\t" /* save %rbx */
#else
        "pushl %%ebx     \n\t" /* save %ebx */
#endif
        "cpuid            \n\t"
        "movl %%ebx ,%[ebx]  \n\t" /* write the result into output var */
#if defined(__x86_64__) || defined(_M_AMD64) || defined (_M_X64)
        "popq %%rbx \n\t"
#else
        "popl %%ebx \n\t"
#endif
        : "=a"(regs[0]), [ebx] "=r"(regs[1]), "=c"(regs[2]), "=d"(regs[3])
        : "a"(index));
    for (i=4; i<8; i++) {
        printf("%c" ,((char *)regs)[i]);
    }
    for (i=12; i<16; i++) {
        printf("%c" ,((char *)regs)[i]);
    }
    for (i=8; i<12; i++) {
        printf("%c" ,((char *)regs)[i]);
    }
    printf("\n");
}

Another version of that:

#include <stdio.h>

void cpuid(unsigned info, unsigned *eax, unsigned *ebx, unsigned *ecx, unsigned *edx)
{
    __asm__(
        "xchg %%ebx, %%edi;" /* 32bit PIC: don't clobber ebx */
        "cpuid;"
        "xchg %%ebx, %%edi;"
        :"=a" (*eax), "=S" (*ebx), "=c" (*ecx), "=d" (*edx)
        :"0" (info)
    );
}

int main()
{
  unsigned int eax, ebx, ecx, edx;
  int i;

  for (i = 0; i < 6; ++i)
  {
    cpuid(i, &eax, &ebx, &ecx, &edx);
    printf("eax=%i: %#010x %#010x %#010x %#010x\n", i, eax, ebx, ecx, edx);
  }

  return 0;
}

Microsoft Visual C compiler has builtin function __cpuid() so cpuid instruction may be embedded without using inline assembly. This is handy since x64 version of MSVC doesn't allow inline assembly at all. The same program for MSVC would be:

#include <iostream>
#include <intrin.h>

int main()
{
  int b[4];

  for (int a = 0; a < 5; a++)
  {
    __cpuid(b, a);
    std::cout << "The code " << a << " gives " << b[0] << std::endl;
  }

  return 0;
}

For Borland/Embarcadero C compilers (bcc32), native asm function calls are necessary, as there is no asm() implementation. The pseudo code:

  unsigned int a, b, c, d;
  unsigned int InfoType = 0;
  __asm xor EBX, EBX;
  __asm xor ECX, ECX;
  __asm xor EDX, EDX;
  __asm mov EAX, InfoType;
  __asm cpuid;
  __asm mov a, EAX;
  __asm mov b, EBX;
  __asm mov c, ECX;
  __asm mov d, EDX;

Uptake of CPUID instructions outside x86

The Intel-AMD x86 family has so far been the only CPU family to have a CPUID instruction. RISC, DSP and transputer like chip families have not taken up the instruction in any noticeable way, in spite of having (in relative terms) as many variations in design. ARM architectures have a CPUID coprocessor register for the same purpose.

See also

• CPU-Z, a Windows utility that uses CPUID to identify various system settings

External links

• x86 architecture CPUID
• Intel CPUID guide (PDF)
• AMD CPUID guide (PDF)