CPUIDopcode is a processor supplementary instruction (its name derived from CPU IDentification) for the x86 architecture allowing software to discover details of the processor. It was introduced by Intel in 1993 when it introduced the Pentium and SL-enhanced 486 processors.
By using the
CPUIDopcode, software can determine processor type and the presence of features (like MMX/SSE). The
CPUIDopcode is 0Fh, A2h (as two bytes, or 0FA2h as a single word) and the value in the EAX register, and in some cases the ECX register, specifies what information to return.
Prior to the general availability of the
CPUIDinstruction, programmers would write esoteric machine code which exploited minor differences in CPU behavior in order to determine the processor make and model.
Outside the x86 family, developers are mostly still required to use esoteric processes to determine the variations in CPU design that are present. While the
CPUIDinstruction is specific to the x86 architecture, other architectures (like ARM) often provide on-chip registers which can be read to obtain the same sorts of information provided by this instruction.
In assembly language the
CPUIDinstruction takes no parameters as
CPUIDimplicitly uses the EAX register to determine the main category of information returned. In Intel's more recent terminology, this is called the CPUID leaf.
CPUIDshould be called with
EAX = 0first, as this will return in the EAX register the highest EAX calling parameter (leaf) that the CPU supports.
To obtain extended function information
CPUIDshould be called with the most significant bit of EAX set. To determine the highest extended function calling parameter, call
EAX = 80000000h.
CPUID leaves greater than 3 but less than 80000000 are accessible only when the model-specific registers have IA32_MISC_ENABLE.BOOT_NT4 [bit 22] = 0 (which is so by default). As the name suggests, Windows NT4 did not boot properly unless this bit was set, but later versions of Windows do not need it, so basic leaves greater than 4 can be assumed visible on current Windows systems. As of July 2014, basic valid leaves go up to 14h, but the information returned by some leaves are not disclosed in publicly available documentation, i.e. they are "reserved".
Some of the more recently added leaves also have sub-leaves, which are selected via the ECX register before calling CPUID.
EAX=0: Highest Function Parameter
Here is a list of processors and the highest function supported.
|Earlier Intel 486||CPUID Not Implemented|
|Later Intel 486 and Pentium||0x01||Not Implemented|
|Pentium Pro, Pentium II and Celeron||0x02||Not Implemented|
|Pentium III||0x03||Not Implemented|
|Pentium 4||0x02||0x8000 0004|
|Pentium M||0x02||0x8000 0004|
|Pentium 4 with Hyper-Threading||0x05||0x8000 0008|
|Pentium D (8xx)||0x05||0x8000 0008|
|Pentium D (9xx)||0x06||0x8000 0008|
|Core Duo||0x0A||0x8000 0008|
|Core 2 Duo||0x0A||0x8000 0008|
|Xeon 3000, 5100, 5200, 5300, 5400 series||0x0A||0x8000 0008|
|Core 2 Duo 8000 series||0x0D||0x8000 0008|
|Xeon 5200, 5400 series||0x0A||0x8000 0008|
|Core i7[which?]||0x0B||0x8000 0008|
EAX=0: Get vendor ID
This returns the CPU's manufacturer ID string – a twelve-character ASCII string stored in EBX, EDX, ECX (in that order). The highest basic calling parameter (largest value that EAX can be set to before calling
CPUID) is returned in EAX.
The following are known processor manufacturer ID strings:
- "AMDisbetter!" – early engineering samples of AMD K5 processor
- "AuthenticAMD" – AMD
- "CentaurHauls" – Centaur (Including some VIA CPU)
- "CyrixInstead" – Cyrix
- "GenuineIntel" – Intel
- "TransmetaCPU" – Transmeta
- "GenuineTMx86" – Transmeta
- "Geode by NSC" – National Semiconductor
- "NexGenDriven" – NexGen
- "RiseRiseRise" – Rise
- "SiS SiS SiS " – SiS
- "UMC UMC UMC " – UMC
- "VIA VIA VIA " – VIA
- "Vortex86 SoC" – Vortex
- "KVMKVMKVMKVM" – KVM
- "Microsoft Hv" – Microsoft Hyper-V or Windows Virtual PC
- "VMwareVMware" – VMware
- "XenVMMXenVMM" – Xen HVM
For instance, on a GenuineIntel processor values returned in EBX is 0x756e6547, EDX is 0x49656e69 and ECX is 0x6c65746e. The following code is written in GNU Assemblerfor the x86-64 architecture and displays the vendor ID string as well as the highest calling parameter that the CPU supports.
EAX=1: Processor Info and Feature Bits
|This section requires expansionwith: stuff returned in EBX, including the initial APIC id. (July 2014)|
This returns the CPU's stepping, model, and family information in EAX (also called the signature of a CPU), feature flags in EDX and ECX, and additional feature info in EBX.
The format of the information in EAX is as follows:
- 3:0 – Stepping
- 7:4 – Model
- 11:8 – Family
- 13:12 – Processor Type
- 19:16 – Extended Model
- 27:20 – Extended Family
Intel and AMD have suggested applications to display the family of a CPU as the sum of the "Family" and the "Extended Family" fields shown above, and the model as the sum of the "Model" and the 4-bit left-shifted "Extended Model" fields. If "Family" is lower than 15, only the "Family" and "Model" fields should be used while the "Extended Family" and "Extended Model" bits are reserved. If "Family" is set to 15, then "Extended Family" and the 4-bit left-shifted "Extended Model" should be added to the respective base values.
The processor info and feature flags are manufacturer specific but usually the Intel values are used by other manufacturers for the sake of compatibility.
|0||fpu||Onboard x87 FPU||sse3||Prescott New Instructions-SSE3 (PNI)|
|1||vme||Virtual 8086 mode extensions (such as VIF, VIP, PIV)||pclmulqdq||PCLMULQDQ support|
|2||de||Debugging extensions (CR4 bit 3)||dtes64||64-bit debug store (edx bit 21)|
|3||pse||Page Size Extension||monitor||MONITOR and MWAIT instructions (SSE3)|
|4||tsc||Time Stamp Counter||ds-cpl||CPL qualified debug store|
|5||msr||Model-specific registers||vmx||Virtual Machine eXtensions|
|6||pae||Physical Address Extension||smx||Safer Mode Extensions (LaGrande)|
|7||mce||Machine Check Exception||est||Enhanced SpeedStep|
|8||cx8||CMPXCHG8 (compare-and-swap) instruction||tm2||Thermal Monitor 2|
|9||apic||Onboard Advanced Programmable Interrupt Controller||ssse3||Supplemental SSE3 instructions|
|10||(reserved)||cnxt-id||L1 Context ID|
|11||sep||SYSENTER and SYSEXIT instructions||(reserved)|
|12||mtrr||Memory Type Range Registers||fma||Fused multiply-add (FMA3)|
|13||pge||Page Global Enable bit in CR4||cx16||CMPXCHG16B instruction|
|14||mca||Machine check architecture||xtpr||Can disable sending task priority messages|
|15||cmov||Conditional move and FCMOV instructions||pdcm||Perfmon & debug capability|
|16||pat||Page Attribute Table||(reserved)|
|17||pse-36||36-bit page size extension||pcid||Process context identifiers (CR4 bit 17)|
|18||psn||Processor Serial Number||dca||Direct cache access for DMA writes|
|19||clfsh||CLFLUSH instruction (SSE2)||sse4.1||SSE4.1 instructions|
|21||ds||Debug store: save trace of executed jumps||x2apic||x2APIC support|
|22||acpi||Onboard thermal control MSRs for ACPI||movbe||MOVBE instruction (big-endian)|
|23||mmx||MMX instructions||popcnt||POPCNT instruction|
|24||fxsr||FXSAVE, FXRESTOR instructions, CR4 bit 9||tsc-deadline||APIC supports one-shot operation using a TSC deadline value|
|25||sse||SSE instructions (a.k.a. Katmai New Instructions)||aes||AES instruction set|
|26||sse2||SSE2 instructions||xsave||XSAVE, XRESTOR, XSETBV, XGETBV|
|27||ss||CPU cache supports self-snoop||osxsave||XSAVE enabled by OS|
|28||htt||Hyper-threading||avx||Advanced Vector Extensions|
|29||tm||Thermal monitor automatically limits temperature||f16c||F16C (half-precision) FP support|
|30||ia64||IA64 processor emulating x86||rdrnd||RDRAND (on-chip random number generator) support|
|31||pbe||Pending Break Enable (PBE# pin) wakeup support||hypervisor||Running on a hypervisor (always 0 on a real CPU, but also with some hypervisors)|
EAX=2: Cache and TLB Descriptor information
This returns a list of descriptors indicating cache and TLB capabilities in EAX, EBX, ECX and EDX registers.
EAX=3: Processor Serial Number
This returns the processor's serial number. The processor serial number was introduced on Intel Pentium III, but due to privacy concerns, this feature is no longer implemented on later models (PSN feature bit is always cleared). Transmeta's Efficeon and Crusoe processors also provide this feature. AMD CPUs however, do not implement this feature in any CPU models.
For Intel Pentium III CPUs, the serial number is returned in EDX:ECX registers. For Transmeta Efficeon CPUs, it is returned in EBX:EAX registers. And for Transmeta Crusoe CPUs, it is returned in EBX register only.
Note that the processor serial number feature must be enabled in the BIOS setting in order to function.
EAX=4 and EAX=Bh: Intel thread/core and cache topology
These two leaves are used for processor topology (thread, core, package) and cache hierarchy enumeration in Intel multi-core (and hyperthreaded) processors. As of 2013AMD does not use these leaves but has alternate ways of doing the core enumeration.
Unlike most other CPUID leaves, leaf Bh will return different values in EDX depending on which logical processor the CPUID instruction runs; the value returned in EDX is actually the x2APIC id of the logical processor. The x2APIC id space is not continuously mapped to logical processors however; there can be gaps in the mapping, meaning that some intermediate x2APIC ids don't necessarily correspond to any logical processor. Additional information for mapping the x2APIC ids to cores is provided in the other registers. Although the leaf Bh has sub-leaves (selected by ECX as described further below), the value returned in EDX is only affected by the core on which the instruction is running but not by the subleaf.
The processor(s) topology exposed by leaf Bh is a hierarchical one, but with the strange caveat that the order of (logical) levels in this hierarchy doesn't necessarily correspond the order in the physical hierarchy (SMT/core/package). However, every logical level can be queried as an ECX subleaf (of the Bh leaf) for its correspondence to a "level type", which can be either SMT, core, or "invalid". The level id space starts at 0 and is continuous, meaning that if a level id is invalid, all higher level ids will also be invalid. The level type is returned in bits 15:08 of ECX, while the number of logical processors at the level queried is returned in EBX. Finally, the connection between these levels and x2APIC ids is returned in EAX[4:0] as the number of bits that the x2APIC id must be shifted in order to obtain a unique id at the next level.
As an example, a dual-core Westmere processor capable of hyperthreading (thus having two cores and four threads in total) could have x2APIC ids 0, 1, 4 and 5 for its four logical processors. Leaf Bh (=EAX), subleaf 0 (=ECX) of CPUID could for instance return 100h in ECX, meaning that level 0 describes the SMT (hyperthreading) layer, and return 2 in EBX because there are two logical processors (SMT units) per physical core. The value returned in EAX for this 0-subleaf should be 1 in this case, because shifting the aforementioned x2APIC ids to the right by one bit gives a unique core number (at the next level of the level id hierarchy) and erases the SMT id bit inside each core. A simpler way to interpret this information is that the last bit (bit number 0) of the x2APIC id identifies the SMT/hyperthreading unit inside each core in our example. Advancing to subleaf 1 (by making another call to CPUID with EAX=Bh and ECX=1) could for instance return 201h in ECX, meaning that this is a core-type level, and 4 in EBX because there are 4 logical processors in the package; EAX returned could be any value greater than 3, because it so happens that bit number 2 is used to identify the core in the x2APIC id. Note that bit number 1 of the x2APIC id is not used in this example. However EAX returned at this level could well be 4 (and it happens to be so on a Clarkdale Core i3 5x0) because that also gives a unique id at the package level (=0 obviusly) when shifting the x2APIC id by 4 bits. Finally, you may wonder what the EAX=4 leaf can tell us that we didn't find out already. In EAX[31:26] it returns the APIC mask bits reserved for a package; that would be 111b in our example because bits 0 to 2 are used for identifying logical processors inside this package, but bit 1 is also reserved although not used as part of the logical processor identification scheme. In other words, APIC ids 0 to 7 are reserved for the package, even though half of these values don't map to a logical processor.
The cache hierarchy of the processor is explored by looking at the sub-leaves of leaf 4. The APIC ids are also used in this hierarchy to convey information about how the different levels of cache are shared by the SMT units and cores. To continue our example, the L2 cache, which is shared by SMT units of the same core but not between physical cores on the Westmere is indicated by EAX[26:14] being set to 1, while the information that the L3 cache is shared by the whole package is indicated by setting those bits to (at least) 111b. The cache details, including cache type, size, and associativity are communicated via the other registers on leaf 4.
Beware that older versions of the Intel app note 485 contain some misleading information, particularly with respect to identifying and counting cores in a multi-core processor;errors from misinterpreting this information have even been incorporated in the Microsoft sample code for using cpuid, even for the 2013 edition of Visual Studio, and also in the sandpile.org page for CPUID, but the Intel code sample for identifying processor topology has the correct interpretation, and the current Intel Software Developer’s Manual has more clear language. The (open source) cross-platform production code from Wildfire Games also implements the correct interpretation of the Intel documentation.
Topology detection examples involving older (pre-2010) Intel processors that lack x2APIC (thus don't support the EAX=Bh leaf) are given in a 2010 Intel presentation. Beware that using that older detection method on 2010 and newer Intel processors may overestimate the number of cores and logical processors because the old detection method assumes there are no gaps in the APIC id space, and this assumption is violated by some newer processors (starting with the Core i3 5x0 series), but these newer processors also come with an x2APIC, so their topology can be correctly determined using the EAX=Bh leaf method.
EAX=7, ECX=0: Extended Features
This returns extended feature flags in EBX and ECX.
|0||fsgsbase||Access to base of %fs and %gs||prefetchwt1||PREFETCHWT1 instruction|
|1||(reserved)||avx512vbmi||AVX-512 Vector Bit Manipulation Instructions|
|3||bmi1||Bit Manipulation Instruction Set 1||(reserved)|
|4||hle||Transactional Synchronization Extensions||(reserved)|
|5||avx2||Advanced Vector Extensions 2||(reserved)|
|7||smep||Supervisor-Mode Execution Prevention||(reserved)|
|8||bmi2||Bit Manipulation Instruction Set 2||(reserved)|
|9||erms||Enhanced REP MOVSB/STOSB||(reserved)|
|11||rtm||Transactional Synchronization Extensions||(reserved)|
|14||mpx||Intel MPX (Memory Protection Extensions)||(reserved)|
|17||avx512dq||AVX-512 Doubleword and Quadword Instructions||(reserved)|
|19||adx||Intel ADX (Multi-Precision Add-Carry Instruction Extensions)||(reserved)|
|20||smap||Supervisor Mode Access Prevention||(reserved)|
|21||avx512ifma||AVX-512 Integer Fused Multiply-Add Instructions||(reserved)|
|25||Intel Processor Trace||(reserved)|
|26||avx512pf||AVX-512 Prefetch Instructions||(reserved)|
|27||avx512er||AVX-512 Exponential and Reciprocal Instructions||(reserved)|
|28||avx512cd||AVX-512 Conflict Detection Instructions||(reserved)|
|29||sha||Intel SHA extensions||(reserved)|
|30||avx512bw||AVX-512 Byte and Word Instructions||(reserved)|
|31||avx512vl||AVX-512 Vector Length Extensions||(reserved)|
EAX=80000000h: Get Highest Extended Function Supported
The highest calling parameter is returned in EAX.
EAX=80000001h: Extended Processor Info and Feature Bits
This returns extended feature flags in EDX and ECX.
|0||fpu||Onboard x87 FPU||lahf_lm||LAHF/SAHF in long mode|
|1||vme||Virtual mode extensions (VIF)||cmp_legacy||Hyperthreading not valid|
|2||de||Debugging extensions (CR4 bit 3)||svm||Secure Virtual Machine|
|3||pse||Page Size Extension||extapic||Extended APIC space|
|4||tsc||Time Stamp Counter||cr8_legacy||CR8 in 32-bit mode|
|5||msr||Model-specific registers||abm||Advanced bit manipulation (lzcnt and popcnt)|
|6||pae||Physical Address Extension||sse4a||SSE4a|
|7||mce||Machine Check Exception||misalignsse||Misaligned SSE mode|
|8||cx8||CMPXCHG8 (compare-and-swap) instruction||3dnowprefetch||PREFETCH and PREFETCHW instructions|
|9||apic||Onboard Advanced Programmable Interrupt Controller||osvw||OS Visible Workaround|
|10||(reserved)||ibs||Instruction Based Sampling|
|11||syscall||SYSCALL and SYSRET instructions||xop||XOP instruction set|
|12||mtrr||Memory Type Range Registers||skinit||SKINIT/STGI instructions|
|13||pge||Page Global Enable bit in CR4||wdt||Watchdog timer|
|14||mca||Machine check architecture||(reserved)|
|15||cmov||Conditional move and FCMOV instructions||lwp||Light Weight Profiling|
|16||pat||Page Attribute Table||fma4||4 operands fused multiply-add|
|17||pse36||36-bit page size extension||tce||Translation Cache Extension|
|19||mp||Multiprocessor Capable||nodeid_msr||NodeID MSR|
|21||(reserved)||tbm||Trailing Bit Manipulation|
|22||mmxext||Extended MMX||topoext||Topology Extensions|
|23||mmx||MMX instructions||perfctr_core||Core performance counter extensions|
|24||fxsr||FXSAVE, FXRSTOR instructions, CR4 bit 9||perfctr_nb||NB performance counter extensions|
|26||pdpe1gb||Gibibyte pages||dbx||Data breakpoint extensions|
|27||rdtscp||RDTSCP instruction||perftsc||Performance TSC|
|28||(reserved)||pcx_l2i||L2I perf counter extensions|
EAX=80000002h,80000003h,80000004h: Processor Brand String
These return the processor brand string in EAX, EBX, ECX and EDX.
CPUIDmust be issued with each parameter in sequence to get the entire 48-byte null-terminated ASCII processor brand string. It is necessary to check whether the feature is supported by the CPU by issuing
EAX = 80000000hfirst and checking if the returned value is greater or equal to 80000004h.
EAX=80000005h: L1 Cache and TLB Identifiers
This function contains the processor’s L1 cache and TLB characteristics.
EAX=80000006h: Extended L2 Cache Features
Returns details of the L2 cache in ECX, including the line size in bytes, type of associativity (encoded by a 4 bits) and the cache size.
EAX=80000007h: Advanced Power Management Information
This function provides advanced power management feature identifiers.
EAX=80000008h: Virtual and Physical address Sizes
Returns largest virtual and physical address sizes in EAX.
CPUID usage from high-level languages
This information is easy to access from other languages as well. For instance, the C++ code for gcc below prints the first five values, returned by the cpuid:
The equivalent code in C is:
Or, a generally useful C implementation that works on 32- and 64-bit systems:
Another version of that:
Microsoft Visual C compiler has builtin function __cpuid() so cpuid instruction may be embedded without using inline assembly. This is handy since x64 version of MSVC doesn't allow inline assembly at all. The same program for MSVC would be:
For Borland/Embarcadero C compilers (bcc32), native asm function calls are necessary, as there is no asm() implementation. The pseudo code:
Many interpreted or compiled scripting languages are capable of using CPUID via an FFI library. One such implementation shows usage of the Ruby FFI module to execute assembly language that includes the CPUID opcode.
CPU-specific information outside x86
Some of the non-x86 CPU architectures also provide certain forms of structured information about the processor's abilities, commonly as a set of special registers:
- ARM architectures have a
- The IBM System z mainframe processors support a Store CPU ID (
STIDP) instruction since the 1983 IBM 4381 for querying the processor ID.
- The MIPS32 architecture defines a mandatory Processor Identification (
PrId) and a series of daisy-chained Configuration Registers.
- The PowerPC processor has the 32-bit read-only
PVRregister identifying the processor modxel in use.