CPUID

From Wikipedia, the free encyclopedia
Jump to: navigation, search

The CPUID opcode is a processor supplementary instruction (its name derived from CPU IDentification) for the x86 architecture. It was introduced by Intel in 1993 when it introduced the Pentium and SL-Enhanced 486 processors.[1]

By using the CPUID opcode, software can determine processor type and the presence of features (like MMX/SSE). The CPUID opcode is 0Fh, 0A2h (as two bytes, or 0A20Fh as a single word) and the value in the EAX register, and in some cases the ECX register, specifies what information to return.

Prior to the general availability of the CPUID instruction, programmers would write esoteric machine code which exploited minor differences in CPU behavior in order to determine the processor make and model.[2][3] Outside the x86 family, developers are sometimes still required to use esoteric processes to determine the variations in CPU design that are present. While the CPUID instruction is specific to the x86 architecture, other architectures often provide on-chip registers which can be read to obtain the same sorts of information provided by this instruction.

Calling CPUID[edit]

In assembly language the CPUID instruction takes no parameters as CPUID implicitly uses the EAX register. The EAX register should be loaded with a value specifying what information to return. CPUID should be called with EAX = 0 first, as this will return in the EAX register the highest calling parameter that the CPU supports. To obtain extended function information CPUID should be called with the most significant bit of EAX set. To determine the highest extended function calling parameter, call CPUID with EAX = 80000000h.

EAX=0: Highest Function Parameter[edit]

Here is a list of processors and the highest function supported.

Highest Function Parameter
Processors Basic Extended
Earlier Intel 486 CPUID Not Implemented
Later Intel 486 and Pentium 0x01 Not Implemented
Pentium Pro, Pentium II and Celeron 0x02 Not Implemented
Pentium III 0x03 Not Implemented
Pentium 4 0x02 0x8000 0004
Xeon 0x02 0x8000 0004
Pentium M 0x02 0x8000 0004
Pentium 4 with Hyper-Threading 0x05 0x8000 0008
Pentium D (8xx) 0x05 0x8000 0008
Pentium D (9xx) 0x06 0x8000 0008
Core Duo 0x0A 0x8000 0008
Core 2 Duo 0x0A 0x8000 0008
Xeon 3000, 5100, 5200, 5300, 5400 series 0x0A 0x8000 0008
Core 2 Duo 8000 series 0x0D 0x8000 0008
Xeon 5200, 5400 series 0x0A 0x8000 0008
Atom 0x0A 0x8000 0008
Core i7 0x0B 0x8000 0008

EAX=0: Get vendor ID[edit]

This returns the CPU's manufacturer ID string – a twelve-character ASCII string stored in EBX, EDX, ECX (in that order). The highest basic calling parameter (largest value that EAX can be set to before calling CPUID) is returned in EAX.

The following are known processor manufacturer ID strings:

For instance, on a GenuineIntel processor values returned in EBX is 0x756e6547, EDX is 0x49656e69 and ECX is 0x6c65746e. The following code is written in GNU Assembler for the x86-64 architecture and displays the vendor ID string as well as the highest calling parameter that the CPU supports.

	.data
 
s0:
	.asciz	"Largest basic function number supported: %i\n"
s1:
	.asciz	"Vendor ID: %.12s\n"
 
	.text
 
	.align	32
	.globl	_start
_start:
	pushq	%rbp
        pushq   %rbx
	movq	%rsp,%rbp
	subq	$16,%rsp
 
	xorl	%eax,%eax
	cpuid
 
	movl	%ebx,0(%rsp)
	movl	%edx,4(%rsp)
	movl	%ecx,8(%rsp)
 
	movq	$s0,%rdi
	movl	%eax,%esi
	xorb	%al,%al
	call	printf
 
	movq	$s1,%rdi
	movq	%rsp,%rsi
	xorb	%al,%al
	call	printf
 
	movq	%rbp,%rsp
        popq    %rbx
	popq	%rbp
	movl    $1,%eax
        int     $0x80

EAX=1: Processor Info and Feature Bits[edit]

This returns the CPU's stepping, model, and family information in EAX (also called the signature of a CPU), feature flags in EDX and ECX, and additional feature info in EBX.

The format of the information in EAX is as follows:

  • 3:0 – Stepping
  • 7:4 – Model
  • 11:8 – Family
  • 13:12 – Processor Type
  • 19:16 – Extended Model
  • 27:20 – Extended Family

Intel has suggested applications to display the family of a CPU as the sum of the "Family" and the "Extended Family" fields shown above, and the model as the sum of the "Model" and the 4-bit left-shifted "Extended Model" fields.[4]

AMD recommends the same only if "Family" is equal to 15 (i.e. all bits set to 1). If "Family" is lower than 15, only the "Family" and "Model" fields should be used while the "Extended Family" and "Extended Model" bits are reserved. If "Family" is set to 15, then "Extended Family" and the 4-bit left-shifted "Extended Model" should be added to the respective base values.[5]

The processor info and feature flags are manufacturer specific but usually the Intel values are used by other manufacturers for the sake of compatibility.

The standard Intel feature flags are as follows[6][7]

EAX=1 CPUID feature bits
Bit EDX ECX
Short Feature Short Feature
0 fpu Onboard x87 FPU sse3 Prescott New Instructions-SSE3 (PNI)
1 vme Virtual 8086 mode extensions (such as VIF, VIP, PIV) pclmulqdq PCLMULQDQ support
2 de Debugging extensions (CR4 bit 3) dtes64 64-bit debug store (edx bit 21)
3 pse Page Size Extension monitor MONITOR and MWAIT instructions (SSE3)
4 tsc Time Stamp Counter ds-cpl CPL qualified debug store
5 msr Model-specific registers vmx Virtual Machine eXtensions
6 pae Physical Address Extension smx Safer Mode Extensions (LaGrande)
7 mce Machine Check Exception est Enhanced SpeedStep
8 cx8 CMPXCHG8 (compare-and-swap) instruction tm2 Thermal Monitor 2
9 apic Onboard Advanced Programmable Interrupt Controller ssse3 Supplemental SSE3 instructions
10 (reserved) cnxt-id L1 Context ID
11 sep SYSENTER and SYSEXIT instructions (reserved)
12 mtrr Memory Type Range Registers fma Fused multiply-add (FMA3)
13 pge Page Global Enable bit in CR4 cx16 CMPXCHG16B instruction
14 mca Machine check architecture xtpr Can disable sending task priority messages
15 cmov Conditional move and FCMOV instructions pdcm Perfmon & debug capability
16 pat Page Attribute Table (reserved)
17 pse-36 36-bit page size extension pcid Process context identifiers (CR4 bit 17)
18 psn Processor Serial Number dca Direct cache access for DMA writes[8][9]
19 clfsh CLFLUSH instruction (SSE2) sse4.1 SSE4.1 instructions
20 (reserved) sse4.2 SSE4.2 instructions
21 ds Debug store: save trace of executed jumps x2apic x2APIC support
22 acpi Onboard thermal control MSRs for ACPI movbe MOVBE instruction (big-endian)
23 mmx MMX instructions popcnt POPCNT instruction
24 fxsr FXSAVE, FXRESTOR instructions, CR4 bit 9 tsc-deadline APIC supports one-shot operation using a TSC deadline value
25 sse SSE instructions (a.k.a. Katmai New Instructions) aes AES instruction set
26 sse2 SSE2 instructions xsave XSAVE, XRESTOR, XSETBV, XGETBV
27 ss CPU cache supports self-snoop osxsave XSAVE enabled by OS
28 htt Hyper-threading avx Advanced Vector Extensions
29 tm Thermal monitor automatically limits temperature f16c F16C (half-precision) FP support
30 ia64 IA64 processor emulating x86 rdrnd RDRAND (on-chip random number generator) support
31 pbe Pending Break Enable (PBE# pin) wakeup support hypervisor Running on a hypervisor (always 0 on a real CPU, but also with some hypervisors)

EAX=2: Cache and TLB Descriptor information[edit]

This returns a list of descriptors indicating cache and TLB capabilities in EAX, EBX, ECX and EDX registers.

EAX=3: Processor Serial Number[edit]

This returns the processor's serial number. The processor serial number was introduced on Intel Pentium III, but due to privacy concerns, this feature is no longer implemented on later models (PSN feature bit is always cleared). Transmeta's Efficeon and Crusoe processors also provide this feature. AMD CPUs however, do not implement this feature in any CPU models.

For Intel Pentium III CPUs, the serial number is returned in EDX:ECX registers. For Transmeta Efficeon CPUs, it is returned in EBX:EAX registers. And for Transmeta Crusoe CPUs, it is returned in EBX register only.

Note that the processor serial number feature must be enabled in the BIOS setting in order to function.

EAX=7: Extended Features[edit]

This returns extended feature flags in EBX.

EAX=7 CPUID feature bits
Bit EBX
Short Feature
0 fsgsbase Access to base of %fs and %gs
1 (reserved)
2 (reserved)
3 bmi1 Bit Manipulation Instruction Sets
4 hle Transactional Synchronization Extensions
5 avx2 Advanced Vector Extensions 2
6 (reserved)
7 smep Supervisor-Mode Execution Prevention
8 bmi2 Bit Manipulation Instruction Sets
9 erms Enhanced REP MOVSB/STOSB
10 invpcid INVPCID instruction
11 rtm Transactional Synchronization Extensions
12 (reserved)
13 (reserved)
14 mpx Intel MPX (Memory Protection Extensions)
(reserved)
16 avx512f AVX-512 Foundation
17 (reserved)
18 rdseed RDSEED instruction
19 adx Intel ADX (Multi-Precision Add-Carry Instruction Extensions)
20 smap Supervisor Mode Access Prevention
21 (reserved)
22 (reserved)
23 (reserved)
24 (reserved)
25 Intel Processor Trace
26 avx512pf AVX-512 PFI (Prefetch Instructions)
27 avx512er AVX-512 ERI (Exponential and Reciprocal Instructions)
28 avx512cd AVX-512 CDI (Conflict Detection Instructions)
29 sha Intel SHA extensions
30 (reserved)
31 (reserved)
EAX=7 CPUID feature bits
Bit ECX
Short Feature
0 prefetchwt1 PREFETCHWT1
1-31 (reserved)

EAX=80000000h: Get Highest Extended Function Supported[edit]

The highest calling parameter is returned in EAX.

EAX=80000001h: Extended Processor Info and Feature Bits[edit]

This returns extended feature flags in EDX and ECX.

AMD feature flags are as follows[10][11]

EAX=80000001h CPUID feature bits
Bit EDX ECX
Short Feature Short Feature
0 fpu Onboard x87 FPU lahf_lm LAHF/SAHF in long mode
1 vme Virtual mode extensions (VIF) cmp_legacy Hyperthreading not valid
2 de Debugging extensions (CR4 bit 3) svm Secure Virtual Machine
3 pse Page Size Extension extapic Extended APIC space
4 tsc Time Stamp Counter cr8_legacy CR8 in 32-bit mode
5 msr Model-specific registers abm Advanced bit manipulation (lzcnt and popcnt)
6 pae Physical Address Extension sse4a SSE4a
7 mce Machine Check Exception misalignsse Misaligned SSE mode
8 cx8 CMPXCHG8 (compare-and-swap) instruction 3dnowprefetch PREFETCH and PREFETCHW instructions
9 apic Onboard Advanced Programmable Interrupt Controller osvw OS Visible Workaround
10 (reserved) ibs Instruction Based Sampling
11 syscall SYSCALL and SYSRET instructions xop XOP instruction set
12 mtrr Memory Type Range Registers skinit SKINIT/STGI instructions
13 pge Page Global Enable bit in CR4 wdt Watchdog timer
14 mca Machine check architecture (reserved)
15 cmov Conditional move and FCMOV instructions lwp Light Weight Profiling[12]
16 pat Page Attribute Table fma4 4 operands fused multiply-add
17 pse36 36-bit page size extension tce Translation Cache Extension
18 (reserved)
19 mp Multiprocessor Capable nodeid_msr NodeID MSR
20 nx NX bit (reserved)
21 (reserved) tbm Trailing Bit Manipulation
22 mmxext Extended MMX topoext Topology Extensions
23 mmx MMX instructions perfctr_core Core performance counter extensions
24 fxsr FXSAVE, FXRSTOR instructions, CR4 bit 9 perfctr_nb NB performance counter extensions
25 fxsr_opt FXSAVE/FXRSTOR optimizations (reserved)
26 pdpe1gb Gibibyte pages dbx Data breakpoint extensions
27 rdtscp RDTSCP instruction perftsc Performance TSC
28 (reserved) pcx_l2i L2I perf counter extensions
29 lm Long mode (reserved)
30 3dnowext Extended 3DNow! (reserved)
31 3dnow 3DNow! (reserved)

EAX=80000002h,80000003h,80000004h: Processor Brand String[edit]

These return the processor brand string in EAX, EBX, ECX and EDX. CPUID must be issued with each parameter in sequence to get the entire 48-byte null-terminated ASCII processor brand string.[4] It is necessary to check whether the feature is supported by the CPU by issuing CPUID with EAX = 80000000h first and checking if the returned value is greater or equal to 80000004h.

.section .data
 
s0 : .asciz "Processor Brand String: %.48s\n"
err : .asciz "Feature unsupported.\n"
 
.section .text
 
.global main
.type main,@function
.align 32
main:
	pushq	%rbp
	movq	%rsp,	%rbp
	subq	$48,	%rsp
	pushq	%rbx
 
	movl	$0x80000000,	%eax
	cpuid
 
	cmpl	$0x80000004,	%eax
	jl	error
 
	movl	$0x80000002,	%esi
	movq	%rsp,	%rdi
 
.align 16
get_brand:
	movl	%esi,	%eax
	cpuid
 
	movl	%eax,	(%rdi)
	movl	%ebx,	4(%rdi)
	movl	%ecx,	8(%rdi)
	movl	%edx,	12(%rdi)
 
	addl	$1,	%esi
	addq	$16,	%rdi
	cmpl	$0x80000004,	%esi
	jle	get_brand
 
print_brand:
	movq	$s0,	%rdi
	movq	%rsp,	%rsi
	xorb	%al,	%al
	call	printf
 
	jmp	end
 
.align 16
error:
	movq	$err,	%rdi
	xorb	%al,	%al
	call	printf
 
.align 16
end:
	popq	%rbx
	movq	%rbp,	%rsp
	popq	%rbp
	xorl	%eax,	%eax
	ret

EAX=80000005h: L1 Cache and TLB Identifiers[edit]

This function contains the processor’s L1 cache and TLB characteristics.

EAX=80000006h: Extended L2 Cache Features[edit]

Returns details of the L2 cache in ECX, including the line size in bytes, type of associativity (encoded by a 4 bits) and the cache size.

.section .data
 
info : .ascii "L2 Cache Size : %u KB\nLine size : %u bytes\n"
.asciz "Associativity : %02xh\n"
err : .asciz "Feature unsupported.\n"
 
.section .text
 
.global main
.type main,@function
.align 32
main:
	pushq	%rbp
	movq	%rsp,	%rbp
	pushq	%rbx
 
	movl	$0x80000000,	%eax
	cpuid
 
	cmpl	$0x80000006,	%eax
	jl	error
 
	movl	$0x80000006,	%eax
	cpuid
 
	movl	%ecx,	%eax
 
	movl	%eax,	%edx
	andl	$0xff,	%edx
 
	movl	%eax,	%ecx
	shrl	$12,	%ecx
	andl	$0xf,	%ecx
 
	movl	%eax,	%esi
	shrl	$16,	%esi
	andl	$0xffff,%esi
 
	movq	$info,	%rdi
	xorb	%al,	%al
	call	printf
 
	jmp end
 
.align 16
error:
	movq	$err,	%rdi
	xorb	%al,	%al
	call	printf
 
.align 16
end:
	popq	%rbx
	movq	%rbp,	%rsp
	popq	%rbp
	xorl	%eax,	%eax
	ret

EAX=80000007h: Advanced Power Management Information[edit]

This function provides advanced power management feature identifiers.

EAX=80000008h: Virtual and Physical address Sizes[edit]

Returns largest virtual and physical address sizes in EAX.

Accessing the id from other languages[edit]

This information is easy to access from other languages as well. For instance, the C++ code for gcc below prints the first five values, returned by the cpuid:

#include <iostream>
 
int main()
{
  int a, b;
 
  for (a = 0; a < 5; a++)
  {
    __asm__("cpuid;"
            :"=a"(b)                 // EAX into b (output)
            :"0"(a)                  // a into EAX (input)
            :"%ebx","%ecx","%edx");  // clobbered registers
 
    std::cout << "The code " << a << " gives " << b << std::endl;
  }
 
  return 0;
}

In C, the code may be shortened to:

#include <stdio.h>
 
int main()
{
  int a, b;
 
  for (a = 0; a < 5; a++)
  {
    __asm__("cpuid"
            :"=a"(b)                 // EAX into b (output)
            :"0"(a)                  // a into EAX (input)
            :"%ebx","%ecx","%edx");  // clobbered registers
 
    printf("The code %i gives %i\n", a, b);
  }
 
  return 0;
}

Or, a generally useful C implementation that works on 32 and 64 bit setups:

#include <stdio.h>
 
int main() {
    int i;
    unsigned int index = 0;
    unsigned int regs[4];
    int sum;
    __asm__ __volatile__(
#if defined(__x86_64__) || defined(_M_AMD64) || defined (_M_X64)
        "pushq %%rbx     \n\t" /* save %rbx */
#else
        "pushl %%ebx     \n\t" /* save %ebx */
#endif
        "cpuid            \n\t"
        "movl %%ebx ,%[ebx]  \n\t" /* write the result into output var */
#if defined(__x86_64__) || defined(_M_AMD64) || defined (_M_X64)
        "popq %%rbx \n\t"
#else
        "popl %%ebx \n\t"
#endif
        : "=a"(regs[0]), [ebx] "=r"(regs[1]), "=c"(regs[2]), "=d"(regs[3])
        : "a"(index));
    for (i=4; i<8; i++) {
        printf("%c" ,((char *)regs)[i]);
    }
    for (i=12; i<16; i++) {
        printf("%c" ,((char *)regs)[i]);
    }
    for (i=8; i<12; i++) {
        printf("%c" ,((char *)regs)[i]);
    }
    printf("\n");
}

Another version of that:

#include <stdio.h>
 
void cpuid(unsigned info, unsigned *eax, unsigned *ebx, unsigned *ecx, unsigned *edx)
{
    __asm__(
        "cpuid;"                                            /* assembly code */
        :"=a" (*eax), "=b" (*ebx), "=c" (*ecx), "=d" (*edx) /* outputs */
        :"a" (info)                                         /* input: info into eax */
                                                            /* clobbers: none */
    );
}
 
int main()
{
  unsigned int eax, ebx, ecx, edx;
  int i;
 
  for (i = 0; i < 6; ++i)
  {
    cpuid(i, &eax, &ebx, &ecx, &edx);
    printf("eax=%i: %#010x %#010x %#010x %#010x\n", i, eax, ebx, ecx, edx);
  }
 
  return 0;
}

Microsoft Visual C compiler has builtin function __cpuid() so cpuid instruction may be embedded without using inline assembly. This is handy since x64 version of MSVC doesn't allow inline assembly at all. The same program for MSVC would be:

#include <iostream>
#include <intrin.h>
 
int main()
{
  int b[4];
 
  for (int a = 0; a < 5; a++)
  {
    __cpuid(b, a);
    std::cout << "The code " << a << " gives " << b[0] << std::endl;
  }
 
  return 0;
}

For Borland/Embarcadero C compilers (bcc32), native asm function calls are necessary, as there is no asm() implementation. The pseudo code:

  unsigned int a, b, c, d;
  unsigned int InfoType = 0;
  __asm xor EBX, EBX;
  __asm xor ECX, ECX;
  __asm xor EDX, EDX;
  __asm mov EAX, InfoType;
  __asm cpuid;
  __asm mov a, EAX;
  __asm mov b, EBX;
  __asm mov c, ECX;
  __asm mov d, EDX;

Many interpreted or compiled scripting languages are capable of using CPUID via an FFI library. One such implementation shows usage of the Ruby FFI module to execute assembly language that includes the CPUID opcode.

Uptake of CPUID instructions outside x86[edit]

The Intel-AMD x86 family has so far been the only CPU family to have a CPUID instruction. RISC, DSP and transputer like chip families have not taken up the instruction in any noticeable way, in spite of having (in relative terms) as many variations in design. ARM architectures have a CPUID coprocessor register for the same purpose.[13] IBM mainframe processor z10 and predecessors have had the Store CPUID (STIDP) instruction for querying the processor ID.[14]

See also[edit]

  • CPU-Z, a Windows utility that uses CPUID to identify various system settings

References[edit]

  1. ^ "Intel 64 and IA-32 Architectures Software Developer’s Manual". Intel.com. Retrieved 2013-04-11. 
  2. ^ "Detecting Intel Processors - Knowing the generation of a system CPU". Rcollins.org. Retrieved 2013-04-11. 
  3. ^ "LXR linux-old/arch/i386/kernel/head.S". Lxr.linux.no. Retrieved 2013-04-11. 
  4. ^ a b "Intel® Processor Identification and the CPUID Instruction". Download.intel.com. 2012-03-06. Retrieved 2013-04-11. 
  5. ^ http://support.amd.com/us/Embedded_TechDocs/25481.pdf
  6. ^ Application Note 485: Intel Processor Identification and the CPUID Instruction, Intel, January 2011, retrieved 2011-05-29 
  7. ^ Linux kernel source code arch/x86/include/asm/cpufeatures.h
  8. ^ Huggahalli, Ram; Iyer, Ravi; Tetrick, Scott (2005). "Direct Cache Access for High Bandwidth Network I/O". ACM SIGARCH Computer Architecture News 33 (2): 50–59. doi:10.1145/1080695.1069976. CiteSeerX:10.1.1.91.957.  edit
  9. ^ Drepper, Ulrich (2007), What Every Programmer Should Know About Memory, CiteSeerX:10.1.1.91.957 
  10. ^ CPUID Specification, AMD, September 2010, retrieved 2013-04-02 
  11. ^ Linux kernel source code
  12. ^ Lightweight Profiling Specification, AMD, August 2010, retrieved 2013-04-03 
  13. ^ "ARM Information Center". Infocenter.arm.com. Retrieved 2013-04-11. 
  14. ^ "IBM System z10 Enterprise Class Technical Guide". 

External links[edit]