CPUID

CPUID is how software learns what processor it runs on and what that processor can do. Put a leaf number in EAX, and for leaves with sub-leaves a sub-leaf number in ECX, execute CPUID, and read the answer from EAX, EBX, ECX and EDX. It works at every privilege level and in every mode; the ID flag, bit 21 of EFLAGS, says whether a processor has it at all, which every x86-64 processor does.

The main leaves#

• 00H returns the highest basic leaf in EAX and the vendor string, such as “GenuineIntel”, in EBX, EDX and ECX.
• 01H returns the family, model and stepping in EAX and the older feature bits in ECX and EDX, among them SSE2, SSE4.2, AVX and OSXSAVE.
• 07H holds the structured extended feature bits, spread over sub-leaves: sub-leaf 0 has AVX2, BMI1, BMI2 and AVX-512, sub-leaf 1 newer ones such as AVX-VNNI and APX.
• 0DH describes the state components that XSAVE manages: which ones the processor supports and the sizes and offsets of their areas.
• 80000000H returns the highest extended leaf, 80000001H the bits that came with the 64-bit extensions (64-bit mode itself, SYSCALL, LAHF and SAHF in 64-bit mode, LZCNT, PREFETCHW), and 80000002H to 80000004H the 48-byte brand string.
• 40000000H to 4FFFFFFFH return no processor information; they are left for software to emulate, which hypervisors do.

On Intel processors, a leaf above the highest supported one returns the data of the highest basic leaf instead of zeros; AMD’s manual does not say what such a leaf returns, and a Zen 5 running under KVM gives zeros. Either way software reads leaf 00H or 80000000H first.

Reading the bits#

The CPUID rows of this reference use the manuals’ notation: CPUID.(EAX=07H,ECX=0):EBX[5] is bit 5 of EBX from leaf 07H, sub-leaf 0, the AVX2 bit. Some features also need the operating system: AVX registers are usable only when leaf 01H reports OSXSAVE and XCR0, read with XGETBV, has the AVX state enabled. The x86-64 levels are defined as sets of these bits, and Check shows how to query them.

Other uses#

CPUID is a serializing instruction: everything before it completes before anything after it starts. Benchmarks long used it to fence timed code; on processors with SERIALIZE, Intel recommends that instruction instead. Under Intel VT-x, CPUID always causes a VM exit, so the hypervisor decides what a guest sees, which is why a virtual machine can report a lower x86-64 level than its host.

In the optimization guide

What the optimization guide says about CPUID, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Measuring

• Core cycles, reference cycles and the TSC: CPUID leaf 15H gives the TSC’s frequency on Intel’s processors as a ratio to the core crystal clock and that clock’s frequency.
• Reading the time-stamp counter: CPUID serializes but is slow and exits to the hypervisor in a VM; Intel prefers SERIALIZE where it exists.
• Performance counters: CPUID leaf 0AH says how many performance counters each Intel logical processor has and how wide they are.
• Performance counters: RDPMC is not ordered with its neighbours, and counts of very short sequences are unreliable.

Crestmont and Gracemont

• Hybrid processors: CPUID leaf 1Ah tells which kind of core a thread runs on; the model number does not.

Tremont

• Instruction set and Lakefield: Lakefield pairs one Sunny Cove core with Tremont cores under one model number, 8Ah, so the model cannot tell them apart.

Vulnerability mitigations

Mitigations of these processor vulnerabilities use CPUID:

• CVE-2025-62626: RDSEED Failure on Zen 5
• CVE-2021-0089: Speculative Code Store Bypass

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0 and cpuid_faulting:
    fault(GP, 0)                 # the OS made CPUID fault outside
                                 # CPL 0
r = cpuid_leaf(eax, ecx)         # the processor's own answer for the
                                 # leaf in EAX and sub-leaf in ECX;
                                 # under a hypervisor, the hypervisor's
eax = r[0]                       # bits 63:32 of each register cleared
ebx = r[1]
ecx = r[2]
edx = r[3]
# a leaf without sub-leaves ignores ECX; a leaf past the highest one
# gives the highest basic leaf's answer on Intel's processors and
# zeros on Zen 5 (under KVM)

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• BOUND
• BSF
• BSR
• BSWAP
• BT
• BTC
• BTR
• BTS
• CALL
• CBW
• CDQ
• CDQE
• CLC
• CLD
• CLI
• CMC
• CMP
• CMPS
• CMPXCHG
• CMPXCHG8B
• CQO
• CWD
• CWDE
• DAA
• DAS
• DEC
• DIV
• ENTER
• IDIV
• IMUL
• IN
• INC
• INS
• INT
• INT1
• INT3
• INTO
• IRET
• Jcc
• JCXZ

All 109 General-purpose instructions