x86 Instruction Set Reference

The ID flag (bit 21) in the EFLAGS register indicates support for the CPUID instruction. If a software procedure can set and clear this flag, the processor executing the procedure supports the CPUID instruction.

CPUID returns processor identification and feature information in the EAX, EBX, ECX, and EDX registers. The instruction's output is dependent on the contents of the EAX register upon execution. For example, the following pseudocode loads EAX with 00H and causes CPUID to return a Maximum Return Value and the Vendor Identification String in the appropriate registers: MOV EAX, 00H CPUID. The following shows information returned, depending on the initial value loaded into the EAX register. The second table shows the maximum CPUID input value recognized for each family of IA- 32 processors on which CPUID is implemented.

Two types of information are returned: basic and extended function information. If a higher value entered than is valid for a particular processor, the information for the highest useful basic information value is returned. For example, if an input value of 5 is entered in EAX for a Pentium 4 processor, the information for an input value of 2 is returned. The exception to this rule is the input values that return extended function information. For a Pentium 4 processor, entering an input value of 80000005H or above returns the information for an input value of 2.

CPUID can be executed at any privilege level to serialize instruction execution. Serializing instruction execution guarantees that any modifications to flags, registers, and memory for previous instructions are completed before the next instruction is fetched and executed.

See also: "Serializing Instructions" in Chapter 7 of the IA-32 Intel Architecture Software Developer's Manual, Volume 3 AP-485, Intel Processor Identification and the CPUID Instruction (Order Number 241618)

INPUT EAX = 0: Returns CPUID's Highest Value for Basic Processor Information and the Vendor Identification String

When CPUID executes with EAX set to 0, the processor returns the highest value the CPUID recognizes for returning basic processor information. The value is returned in the EAX register (see second table) and is processor specific.

Information Returned by CPUID Instruction

A vendor identification string is also returned in EBX, EDX, and ECX. For Intel processors, the string is "GenuineIntel" and is expressed: EBX = 756e6547h (* "Genu", with G in the low nibble of BL *) EDX = 49656e69h (* "ineI", with i in the low nibble of DL *) ECX = 6c65746eh (* "ntel", with n in the low nibble of CL *)

INPUT EAX = 80000000H: Returns CPUID's Highest Value for Extended Processor Information

When CPUID executes with EAX set to 0, the processor returns the highest value the processor recognizes for returning extended processor information. The value is returned in the EAX register (see second table) and is processor specific.

Returns Microcode Update Signature For processors that support the microcode update facility, the IA32_BIOS_SIGN_ID MSR is loaded with the update signature whenever CPUID executes. The signature is returned in the upper DWORD. For details, see Chapter 9 in the IA-32 Intel Architecture Software Developer's Manual, Volume 3.

INPUT EAX = 1: Returns Model, Family, Stepping Information

When CPUID executes with EAX set to 1, version information is returned in EAX. For example: model, family, and processor type for the first processor in the Intel Pentium 4 family is returned as follows:

• Model - 0000B
• Family - 1111B
• Processor Type - 00B

See third table for available processor type values. Stepping IDs are provided as needed.

The Extended Family ID and Extended Model ID need be examined only if the Family ID reaches 0FH. Always display processor information as a combination of family, model, and stepping.

Integrate the ID fields into a display as: Displayed family = ((Extended Family ID(4-bits) << 4)) (8-bits) + Family ID (4-bits zero extended to 8-bits).

Compute the displayed model from the Model ID and the Extended Model ID as: Displayed Model = ((Extended Model ID (4-bits) << 4))(8-bits) + Model (4-bits zero extended to 8-bits)

INPUT EAX = 1: Returns Additional Information in EBX

When CPUID executes with EAX set to 1, additional information is returned to the EBX register: - Brand index (low byte of EBX) - this number provides an entry into a brand string table that contains brand strings for IA-32 processors. More information about this field is provided later in this section.

CLFLUSH instruction cache line size (second byte of EBX)

this number indicates the size of the cache line flushed with CLFLUSH instruction in 8-byte increments. This field was introduced in the Pentium 4 processor.

Local APIC ID (high byte of EBX)

this number is the 8-bit ID that is assigned to the local APIC on the processor during power up. This field was introduced in the Pentium 4 processor.

INPUT EAX = 1: Returns Feature Information in ECX and EDX

When CPUID executes with EAX set to 1, feature information is returned in ECX and EDX.

• Table four shows encodings for ECX.
• Table five shows encodings for EDX.

For all feature flags, a 1 indicates that the feature is supported. Use Intel to properly interpret feature flags.

NOTE Software must confirm that a processor feature is present using feature flags returned by CPUID prior to using the feature. Software should not depend on future offerings retaining all features.

INPUT EAX = 2: Cache and TLB Information Returned in EAX, EBX, ECX, EDX

When CPUID executes with EAX set to 2, the processor returns information about the processor's internal caches and TLBs in the EAX, EBX, ECX, and EDX registers.

The encoding is as follows: - The least-significant byte in register EAX (register AL) indicates the number of times the CPUID instruction must be executed with an input value of 2 to get a complete description of the processor's caches and TLBs. The first member of the family of Pentium 4 processors will return a 1.

• The most significant bit (bit 31) of each register indicates whether the register contains valid information (set to 0) or is reserved (set to 1).
• If a register contains valid information, the information is contained in 1 byte descriptors.

Table six shows the encoding of these descriptors. Note that the order of descriptors in the EAX, EBX, ECX, and EDX registers is not defined; that is, specific bytes are not designated to contain descriptors for specific cache or TLB types. The descriptors may appear in any order.

Example of Cache and TLB Interpretation The first member of the family of Pentium 4 processors returns the following information about caches and TLBs when the CPUID executes with an input value of 2: EAX 66 5B 50 01H EBX 0H ECX 0H EDX 00 7A 70 00H Which means: - The least-significant byte (byte 0) of register EAX is set to 01H. This indicates that CPUID needs to be executed once with an input value of 2 to retrieve complete information about caches and TLBs.

• The most-significant bit of all four registers (EAX, EBX, ECX, and EDX) is set to 0, indicating that each register contains valid 1-byte descriptors.
• Bytes 1, 2, and 3 of register EAX indicate that the processor has: 50H -> a 64-entry instruction TLB, for mapping 4-KByte and 2-MByte or 4-MByte pages; 5BH -> a 64-entry data TLB, for mapping 4-KByte and 4-MByte pages; 66H -> an 8-KByte 1st level data cache, 4-way set associative, with a 64-Byte cache line size.
• The descriptors in registers EBX and ECX are valid, but contain NULL descriptors.
• Bytes 0, 1, 2, and 3 of register EDX indicate that the processor has: 00H -> NULL descriptor; 70H -> a 12-KByte 1st level code cache, 4-way set associative, with a 64-byte cache line size; 7AH -> a 256-KByte 2nd level cache, 8-way set associative, with a sectored, 64-byte cache line size; 00H -> NULL descriptor.

Methods for returning branding information

Use the following techniques to access branding information: 1. Processor brand string method; this method also returns the processor's maximum operating frequency 2. Processor brand index; this method uses a software supplied brand string table.

These two methods are discussed in the following sections. For methods that are available in early processors, see Section: "Identification of Earlier IA-32 Processors" in Chapter 14 of the IA-32 Intel Architecture Software Developer's Manual, Volume 1.

The Processor Brand String Method describes the algorithm used for detection of the brand string. Processor brand identification software should execute this algorithm on all IA-32 architecture compatible processors.

This method (introduced with Pentium 4 processors) returns an ASCII brand identification string and the maximum operating frequency of the processor to the EAX, EBX, ECX, and EDX registers.

Determination of Support for the Processor Brand String

EAX = 1
CPUID
IF (EAX >= 080000004H)
THEN
	* Processor Brand String Supported *
ELSE
	* Processor Brand String Not Supported *
FI;

How Brand Strings Work To use the brand string method, execute CPUID with EAX input of 8000002H through 80000004H. For each input value, CPUID returns 16 ASCII characters using EAX, EBX, ECX, and EDX. The returned string will be NULL terminated.

Table seven shows the brand string that is returned by the first processor in the Pentium 4 processor family.

Extracting the Maximum Processor Frequency from Brand Strings provides an algorithm which software can use to extract the maximum processor operating frequency from the processor brand string.

NOTE When a frequency is given in a brand string, it is the maximum qualified frequency of the processor, not the frequency at which the processor is currently running.

Algorithm for Extracting Maximum Processor Frequency

Scan "Brand String" in Reverse Byte Order for ("zHM", "zHG", "zHT")
IF Substring Matched
	SWITCH Substring
		CASE "zHM": Multiplier = 10^6
		CASE "zHG": Multiplier = 10^9
		CASE "zHT": Multiplier = 10^12
	Scan Digits Until Blank In Reverse Order
	Freq = Reverse Digits To Decimal Value
	(* "Freq" = XY.Z if Digits = "Z.YX" *)
	Max. Qualifed Frequency = "Freq" x "Multiplier"
ELSE Report Error

The Processor Brand Index Method The brand index method (introduced with Pentium III Xeon processors) provides an entry point into a brand identification table that is maintained in memory by system software and is accessible from system- and user-level code. In this table, each brand index is associate with an ASCII brand identification string that identifies the official Intel family and model number of a processor.

When CPUID executes with EAX set to 1, the processor returns a brand index to the low byte in EBX. Software can then use this index to locate the brand identification string for the processor in the brand identification table. The first entry (brand index 0) in this table is reserved, allowing for backward compatibility with processors that do not support the brand identification feature.

Table eight shows brand indices that have identification strings associated with them.

switch(EAX) {
	case 0:
		EAX = HighestCPUIDInput(); //highest basic function input value understood by CPUID
		EBX = VendorIdentificationString[0..3];
		EDX = VendorIdentificationString[4..7];
		ECX = VendorIdentificationString[8..11];
		break;
	case 1:
		EAX[0..3] = SteppingID;
		EAX[4..7] = Model;
		EAX[8..11] = Family;
		EAX[12..13] = ProcessorType;
		EAX[14..15] = Reserved;
		EAX[16..19] = ExtendedModel;
		EAX[20..23] = ExtendedFamily;
		EAX[24..31] = Reserved;
		EBX[0..7] = BrandIndex;
		EBX[8..15] = CLFLUSHLineSize;
		EBX[16..23] = Reserved;
		EBX[24..31] = InitialAPICID;
		ECX = ExtendedFeatureFlags;
		EDX = FeatureFlags;
		break;
	case 2:
		EAX = CacheAndTLBInformation();
		EBX = CacheAndTLBInformation(); //0
		ECX = CacheAndTLBInformation(); //0
		EDX = CacheAndTLBInformation();
		break;
	case 3:
		EAX = Reserved;
		EBX = Reserved;
#ifdef PentiumIII
		ECX = ProcessorSerialNumber[0..31];
		EDX = ProcessorSerialNumber[32..63];
#else
		ECX = Reserved;
		EDX = Reserved;
#endif
		break;
	case 4:
		EAX = DeterministicCacheParametersLeaf();
		EBX = DeterministicCacheParametersLeaf();
		ECX = DeterministicCacheParametersLeaf();
		EDX = DeterministicCacheParametersLeaf();
		break;
	case 5:
		EAX = MONITORMWAITLeaf();
		EBX = MONITORMWAITLeaf();
		ECX = MONITORMWAITLeaf();
		EDX = MONITORMWAITLeaf();
		break;
	case 0x80000000:
		EAX = HighestExtendedCPUIDInput(); //highest extended function input value understood by CPUID
		EBX = Reserved;
		ECX = Reserved;
		EDX = Reserved;
		break;
	case 0x80000001:
		EAX = ExtendedProcessorFeatureSignature; //Currently Reserved
		EBX = Reserved;
		ECX = Reserved;
		EDX = Reserved;
		break;
	case 0x80000002:
		EAX = ProcessorBrandString[0..3];
		EBX = ProcessorBrandString[4..7];
		ECX = ProcessorBrandString[8..11];
		EDX = ProcessorBrandString[12..15];
		break;
	case 0x80000003:
		EAX = ProcessorBrandString[16..19];
		EBX = ProcessorBrandString[20..23];
		ECX = ProcessorBrandString[24..27];
		EDX = ProcessorBrandString[28..31];
		break;		
	case 0x80000004:
		EAX = Reserved;
		EBX = Reserved;
		ECX = Reserved;
		EDX = Reserved;
		break;
	case 0x80000006:
		EAX = Reserved;
		EBX = Reserved;
		ECX = CacheInformation;
		EDX = Reserved;
		break;
	case 0x80000007:
		EAX = Reserved;
		EBX = Reserved;
		ECX = Reserved;
		EDX = Reserved;
		break;
	case 0x80000008:
		EAX = Reserved;
		EBX = Reserved;
		ECX = Reserved;
		EDX = Reserved;
		break;
	default: //EAX > highest value recognized by CPUID
		//undefined
		EAX = Reserved;
		EBX = Reserved;
		ECX = Reserved;
		EDX = Reserved;
		break;
}

None.

CPUID is not supported in early models of the Intel486 processor or in any IA-32 processor earlier than the Intel486 processor.