sandpile.org -- IA-32 architecture -- CPUID

IA-32 architecture
CPUID

Before trying to rely upon CPUID, a program must properly detect and sometimes enable the instruction. In particular, the program must detect the presence of a 32bit IA-32 processor, which supports the EFLAGS register. Next, if it is a Cyrix or a NexGen processor, the CPUID instruction may have to be enabled. Then the program must try to toggle the ID bit in the EFLAGS register, to determine whether the instruction is supported or not. Note that the program may face one of the early Intel P5 processors: they do neither return a vendor ID string nor the maximum supported standard level, when level 0000_0000h is queried. Finally, notice that some chips support a partially programmable CPUID instruction -- thanks to those idiot programmers who hard-coded "GenuineIntel" all over the place...

standard level 0000_0000h
input	EAX=0000_0000h	get maximum supported standard level and vendor ID string
output	EAX=xxxx_xxxxh	maximum supported standard level ^#1
	EBX-EDX-ECX	vendor ID string ^#2
		`GenuineIntel`	Intel processor
		`UMC UMC UMC`	UMC processor
		`AuthenticAMD`	AMD processor
		`CyrixInstead`	Cyrix processor
		`NexGenDriven`	NexGen processor
		`CentaurHauls`	Centaur/IDT processor
		`RiseRiseRise`	Rise Technology processor
notes	description
#1	According to [1] and [2] the pre-B0 step Intel P5 processors return EAX=0000_05xxh.
#2	According to [1] and [2] the pre-B0 step Intel P5 processors don't return a vendor ID string.

standard level 0000_0001h
input	EAX=0000_0001h	get processor type/family/model/stepping and feature flags
output	EAX=0000_xxxxh	processor type/family/model/stepping
		type	The processor type is encoded in bit 13 and bit 12.
				11b	reserved
				10b	secondary processor (for MP)
				01b	Overdrive processor
				00b	primary processor
		family	The family is encoded in bits 11..8.
				4	most 80486s AMD 5x86 Cyrix 5x86
				5	Intel P5, P54C, P55C, P24T NexGen Nx586 Cyrix M1 AMD K5, K6 Centaur/IDT C6, C2 Rise mP6
				6	Intel P6, P2, P3 AMD K7 Cyrix M2
		model	The model is encoded in bits 7..4.
			Intel 80486	0	i80486DX-25/33
				1	i80486DX-50
				2	i80486SX
				3	i80486DX2
				4	i80486SL
				5	i80486SX2
				7	i80486DX2WB
				8	i80486DX4
				9	i80486DX4WB
			UMC 80486	1	U5D
			UMC 80486	2	U5S
			AMD 80486	3	80486DX2
				7	80486DX2WB
				8	80486DX4
				9	80486DX4WB
				E	5x86
				F	5x86WB
			Cyrix 5x86	9	5x86
			Cyrix MediaGX	4	GX, GXm
			Intel P5-core	0	P5 A-step
				1	P5
				2	P54C
				3	P24T Overdrive
				4	P55C
				7	P54C
				8	P55C (0.25µm)
			NexGen Nx586	0	Nx586 or Nx586FPU (only later ones)
			Cyrix M1	2	6x86
			Cyrix M2	0	6x86MX
			AMD K5	0	SSA5 (PR75, PR90, PR100)
				1	5k86 (PR120, PR133)
				2	5k86 (PR166)
				3	5k86 (PR200)
			AMD K6	6	K6 (0.30 µm)
				7	K6 (0.25 µm)
				8	K6-2
				9	K6-III
			Centaur/IDT	4	C6
			Centaur/IDT	8	C2
			Rise	0	mP6 (0.25 µm)
			Rise	2	mP6 (0.18 µm)
			Intel P6-core	0	P6 A-step
				1	P6
				3	P2 (0.28 µm)
				5	P2 (0.25 µm)
				6	P2 with on-die L2 cache
				7	P3
			AMD K7	1	0.25 µm
		stepping	The stepping is encoded in bits 3..0.
		stepping	The stepping values are processor-specific.
	EDX=xxxx_xxxxh	feature flags	description
		bits 31..26	reserved
		bit 25 (XMM)	SSE, MXCSR, CR4.OSXMMEXCPT, #XF
bit 24 (FXSR)		FXSAVE/FXRSTOR, CR4.OSFXSR
bit 23 (MMX)		MMX
bits 22..19		reserved
bit 18 (PSN)		PSN (see standard level 0000_0003h), PSN_DISABLE MSR ^#1
bit 17 (PSE36)		4MB PDE bits 16..13, CR4.PSE
bit 16 (PAT)		PAT MSR (implies MSR=1), PDE/PTE.PAT
bit 15 (CMOV)		CMOVcc, if FPU=1 then also FCMOVcc/F(U)COMI(P)
bit 14 (MCA)		MCG_/MCi_ MSRs (implies MSR=1), CR4.MCE, #MC
bit 13 (PGE)		PDE/PTE.G, CR4.PGE
bit 12 (MTRR)		MTRR* MSRs (implies MSR=1)
bit 11 (SEP)		SYSENTER/SYSEXIT, SYSENTER_* MSRs (implies MSR=1) ^#2
bit 10		reserved
bit 9 (APIC)		APIC ^{#3, #4}
bit 8 (CX8)		CMPXCHG8B ^#5
bit 7 (MCE)		MCAR/MCTR MSRs (implies MSR=1), CR4.MCE, #MC
bit 6 (PAE)		64bit PDPTE/PDE/PTEs, CR4.PAE
bit 5 (MSR)		MSRs, RDMSR/WRMSR
bit 4 (TSC)		TSC, RDTSC, CR4.TSD (doesn't imply MSR=1)
bit 3 (PSE)		PDE.PS, PDE/PTE.res, CR4.PSE, #PF(1xxxb)
bit 2 (DE)		CR4.DE, DR7.RW=10b, #UD on MOV from/to DR4/5
bit 1 (VME)		CR4.VME/PVI, EFLAGS.VIP/VIF, TSS32.IRB)
bit 0 (FPU)		FPU
notes	description
#1	If the PSN has been disabled, then the PSN feature flag will read as 0. In addition the value for the maximum supported standard level (reported by standard level 0000_0000h, register EAX) will be lower.
#2	The Intel P6 processor does not support SEP, but falsely reports it.
#3	If the APIC has been disabled, then the APIC feature flag will read as 0.
#4	Early AMD K5 processors (SSA5) falsely used this bit to report PGE support.
#5	Some processors do support CMPXCHG8B, but don't report it. This is due to a Windows NT bug.

standard level 0000_0002h
input	EAX=0000_0002h	get processor configuration descriptors
output	AL	number of times this level must be queried to obtain all configuration descriptors ^#1
	EAX.15..8 EAX.23..16 EAX.31..24 EBX.0..7 EBX.15..8 EBX.23..16 EBX.31..24 ECX.0..7 ECX.15..8 ECX.23..16 ECX.31..24 EDX.0..7 EDX.15..8 EDX.23..16 EDX.31..24	configuration descriptors ^#2
		value	description
		00h	null descriptor (=unused descriptor)
		01h	code TLB, 4K pages, 4 ways, 32 entries
		02h	code TLB, 4M pages, fully, 2 entries
		03h	data TLB, 4K pages, 4 ways, 64 entries
		04h	data TLB, 4M pages, 4 ways, 8 entries
		06h	code L1 cache, 8KB, 4 ways, 32 byte lines
		08h	code L1 cache, 16KB, 4 ways, 32 byte lines
		0Ah	data L1 cache, 8KB, 2 ways, 32 byte lines
		0Ch	data L1 cache, 16KB, 4 ways, 32 byte lines
		40h	no integrated L2 cache
		41h	code and data L2 cache, 128KB, 4 ways, 32 byte lines
		42h	code and data L2 cache, 256KB, 4 ways, 32 byte lines
		43h	code and data L2 cache, 512KB, 4 ways, 32 byte lines
		44h	code and data L2 cache, 1024KB, 4 ways, 32 byte lines
		45h	code and data L2 cache, 2048KB, 4 ways, 32 byte lines
		70h	Cyrix specific: code and data TLB, 4K pages, 4 ways, 32 entries
		80h	Cyrix specific: code and data L1 cache, 16KB, 4 ways, 16 byte lines
		others	reserved
example (here: P6)		EAX=0302_0101h EBX=0000_0000h ECX=0000_0000h EDX=0604_0A43h	Because AL is 01h, one invocation of the level is enough to obtain all the configuration descriptors. All of them are valid because their highest bits are 0. This P6 processor includes a 4K/M code/data TLB, an 8+8 KB code/data L1 cache and an integrated 512 KB code and data L2 cache.
notes	description
#1	In a MP system special precautions must be taken when executing standard level 0000_0002h more than once. In particular it must be ensured that the same CPU is used during that entire process.
#2	Programs must no expect any particular order for the reported configuration descriptors.

standard level 0000_0003h
input	EAX=0000_0003h	get processor serial number ^#1
output	ECX=xxxx_xxxxh	processor serial number
	EDX=xxxx_xxxxh	processor serial number
note	description
#1	This level is only supported and enabled if the PSN feature flag is set. The reported processor serial number should be combined with the vendor ID string and the processor type/family/model/stepping value, to distinguish cases in which two processors from different vendors happen to have the same serial number. Finally, it should be noted that most vendors can not guarantee that their serial numbers are truely unique.

extended level 8000_0000h
input	EAX=8000_0000h	get maximum supported extended level and vendor ID string
output	EAX=xxxx_xxxxh	maximum supported extended level
	EBX-EDX-ECX	vendor ID string
		`AuthenticAMD`	AMD processor
		reserved	Cyrix processor
		reserved	Centaur/IDT processor

extended level 8000_0001h
input	EAX=8000_0001h	get processor family/model/stepping and features flags
output	EAX=0000_0xxxh	processor family/model/stepping
		family	The family is encoded in bits 11..8.
				5	AMD K5 Centaur/IDT C2
				6	AMD K6
				7	AMD K7
		model	The model is encoded in bits 7..4.
			AMD K5	1	5k86 (PR120 or PR133)
				2	5k86 (PR166)
				3	5k86 (PR200)
			AMD K6	6	K6 (0.30 µm)
				7	K6 (0.25 µm)
				8	K6-2
				9	K6-III
			AMD K7	1	0.25 µm
			Centaur/IDT	8	C2
		stepping	The stepping is encoded in bits 3..0.
			The stepping values are processor-specific.
	EDX=xxxx_xxxxh	feature flags	description of indicated feature
		bit 31 (3DNow!)	3DNow!
		bit 30 (3DNow!+)	extended 3DNow!
		bits 29..25	reserved
		bit 24 (MMX+) bit 24 (FXSR)	Cyrix specific: extended MMX AMD K7: FXSAVE/FXRSTOR, CR4.OSFXSR
		bit 23 (MMX)	MMX
		bit 22 (MMX+)	AMD specific: SSE-MMX/MMX-MEM
		bits 21..18	reserved
		bit 17 (PSE36)	4MB PDE bits 16..13, CR4.PSE
		bit 16 (FCMOV) bit 16 (PAT)	FCMOVcc/F(U)COMI(P) (implies FPU=1) AMD K7: PAT MSR (implies MSR=1), PDE/PTE.PAT
		bit 15 (CMOV)	CMOVcc
		bit 14 (MCA)	MCG_/MCi_ MSRs (implies MSR=1), CR4.MCE, #MC
		bit 13 (PGE)	PDE/PTE.G, CR4.PGE
		bit 12 (MTRR)	MTRR* MSRs (implies MSR=1)
		bit 11 (SEP)	SYSCALL/SYSRET, EFER/STAR MSRs (implies MSR=1) ^#1
		bit 10	reserved ^#1
		bit 9 (APIC)	APIC ^#2
		bit 8 (CX8)	CMPXCHG8B
		bit 7 (MCE)	MCAR/MCTR MSRs (implies MSR=1), CR4.MCE, #MC
		bit 6 (PAE)	64bit PDPTE/PDE/PTEs, CR4.PAE
		bit 5 (MSR)	MSRs, RDMSR/WRMSR
		bit 4 (TSC)	TSC, RDTSC, CR4.TSD (doesn't imply MSR=1)
		bit 3 (PSE)	PDE.PS, PDE/PTE.res, CR4.PSE, #PF(1xxxb)
		bit 2 (DE)	CR4.DE, DR7.RW=10b, #UD on MOV from/to DR4/5
		bit 1 (VME)	CR4.VME/PVI, EFLAGS.VIP/VIF, TSS32.IRB)
		bit 0 (FPU)	FPU

note	description
#1	The AMD K6 processor, model 6, uses bit 10 to indicate SEP. Beginning with model 7, bit 11 is used instead.
#2	If the APIC has been disabled, then the APIC feature flag will read as 0.

extended levels 8000_0002h, 8000_0003h, and 8000_0004h
input	EAX=8000_0002h	get processor name string (part 1)
	EAX=8000_0003h	get processor name string (part 2)
	EAX=8000_0004h	get processor name string (part 3)
output	EAX EBX ECX EDX	processor name string ^#1
		AMD K5	`AMD-K5(tm) Processor`
		AMD K6	`AMD-K6tm w/ multimedia extensions`
		AMD K6-2	`AMD-K6(tm) 3D processor` `AMD-K6(tm)-2 Processor`
		AMD K6-III	`AMD-K6(tm) 3D+ Processor` `AMD-K6(tm)-III Processor`
		AMD K7	`AMD-K7(tm) Processor`
		Centaur/IDT C2 ^#2	`IDT WinChip 2` `IDT WinChip 2-3D`
notes	description
#1	Unused characters at the end of the string are filled with 00h.
#2	The string depends on whether 3DNow! is disabled or enabled.

extended level 8000_0005h
input	EAX=8000_0005h	get L1 cache and TLB configuration descriptors ^#1
output	EAX	4/2 MB L1 TLB configuration descriptor
		bits	description
		31..24	data TLB associativity (FFh=full)
		23..16	data TLB entries
		15..8	code TLB associativity (FFh=full)
		7..0	code TLB entries
	EBX	4 KB L1 TLB configuration descriptor
		bits	description
		31..24	data TLB associativity (FFh=full)
		23..16	data TLB entries
		15..8	code TLB associativity (FFh=full)
		7..0	code TLB entries
	ECX	data L1 cache configuration descriptor
		bits	description
		31..24	data L1 cache size in KBs
		23..16	data L1 cache associativity (FFh=full)
		15..8	data L1 cache lines per tag
		7..0	data L1 cache line size in bytes
	EDX	code L1 cache configuration descriptor
		bits	description
		31..24	code L1 cache size in KBs
		23..16	code L1 cache associativity (FFh=full)
		15..8	code L1 cache lines per tag
		7..0	code L1 cache line size in bytes
note	description
#1	Cyrix processors return CPUID level 0000_0002h-like descriptors instead.

extended level 8000_0006h
input	EAX=8000_0006h	get L2 cache configuration descriptors
output	EAX	4/2 MB L2 TLB configuration descriptor ^#1
		bits	description
		31..28	data TLB associativity ^#2
		27..16	data TLB entries
		15..12	code TLB associativity ^#2
		11..0	code TLB entries
	EBX	4 KB L2 TLB configuration descriptor
		bits	description
		31..28	data TLB associativity ^#2
		27..16	data TLB entries
		15..12	code TLB associativity ^#2
		11..0	code TLB entries
	ECX	unified L2 cache configuration descriptor ^#3
		bits	description
		31..16	unified L2 cache size in KBs
		15..12	unified L2 cache associativity ^#2
		11..8	unified L2 cache lines per tag
		7..0	unified L2 cache line size in bytes
note	description
#1	A unified L2 TLB is indicated by a value of 0000h in the upper 16 bits.
#2	0000b=L2 off, 0001b=direct mapped, 0010b=2-way, 0100b=4-way, 0110b=8-way, 1000b=16-way, 1111b=full
#3	The AMD K7 processor's L2 cache must be configured prior to relying upon this information.

mystery level 8FFF_FFFEh
input	EAX=8FFF_FFFEh	unknown ^#1
output	EAX	0049_4544h	unknown
	EBX	0000_0000h	unknown
	ECX	0000_0000h	unknown
	EDX	0000_0000h	unknown
note	description
#1	This level is only supported by the AMD K6 processor family.

mystery level 8FFF_FFFFh
input	EAX=8FFF_FFFFh	unknown ^#1
output	EAX EBX ECX EDX	string	`NexGenerationAMD`
note	description
#1	This level is only supported by the AMD K6 processor family.

all other levels
input	EAX=xxxx_xxxxh	desired CPUID level
output	EAX=xxxx_xxxxh EBX=xxxx_xxxxh ECX=xxxx_xxxxh EDX=xxxx_xxxxh	undefined