Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 20
INSTRUCTION SET REFERENCE, A-L
Operation
CASE (COMPARISON PREDICATE) OF
0: OP3 := EQ_OQ; OP5 := EQ_OQ;
1: OP3 := LT_OS; OP5 := LT_OS;
2: OP3 := LE_OS; OP5 := LE_OS;
3: OP3 := UNORD_Q; OP5 := UNORD_Q;
4: OP3 := NEQ_UQ; OP5 := NEQ_UQ;
5: OP3 := NLT_US; OP5 := NLT_US;
6: OP3 := NLE_US; OP5 := NLE_US;
7: OP3 := ORD_Q; OP5 := ORD_Q;
8: OP5 := EQ_UQ;
9: OP5 := NGE_US;
10: OP5 := NGT_US;
11: OP5 := FALSE_OQ;
12: OP5 := NEQ_OQ;
13: OP5 := GE_OS;
14: OP5 := GT_OS;
15: OP5 := TRUE_UQ;
16: OP5 := EQ_OS;
17: OP5 := LT_OQ;
18: OP5 := LE_OQ;
19: OP5 := UNORD_S;
20: OP5 := NEQ_US;
21: OP5 := NLT_UQ;
22: OP5 := NLE_UQ;
23: OP5 := ORD_S;
24: OP5 := EQ_US;
25: OP5 := NGE_UQ;
26: OP5 := NGT_UQ;
27: OP5 := FALSE_OS;
28: OP5 := NEQ_OS;
29: OP5 := GE_OQ;
30: OP5 := GT_OQ;
31: OP5 := TRUE_US;
DEFAULT: Reserved
ESAC;
CMPPS-Compare Packed Single Precision Floating-Point Values
Vol. 2A
3-191
INSTRUCTION SET REFERENCE, A-L
VCMPPS (EVEX Encoded Versions)
(KL, VL) = (4, 128), (8, 256), (16, 512)
FOR j := 0 TO KL-1
i := j * 32
IF k2[j] OR *no writemask*
THEN
IF (EVEX.b = 1) AND (SRC2 *is memory*)
THEN
CMP := SRC1[i+31:i] OP5 SRC2[31:0]
ELSE
CMP := SRC1[i+31:i] OP5 SRC2[i+31:i]
FI;
IF CMP = TRUE
THEN DEST[j] := 1;
ELSE DEST[j] := 0; FI;
ELSE
DEST[j] := 0
; zeroing-masking onlyFI;
FI;
ENDFOR
DEST[MAX_KL-1:KL] := 0
VCMPPS (VEX.256 Encoded Version)
CMP0 := SRC1[31:0] OP5 SRC2[31:0];
CMP1 := SRC1[63:32] OP5 SRC2[63:32];
CMP2 := SRC1[95:64] OP5 SRC2[95:64];
CMP3 := SRC1[127:96] OP5 SRC2[127:96];
CMP4 := SRC1[159:128] OP5 SRC2[159:128];
CMP5 := SRC1[191:160] OP5 SRC2[191:160];
CMP6 := SRC1[223:192] OP5 SRC2[223:192];
CMP7 := SRC1[255:224] OP5 SRC2[255:224];
IF CMP0 = TRUE
THEN DEST[31:0] :=FFFFFFFFH;
ELSE DEST[31:0] := 000000000H; FI;
IF CMP1 = TRUE
THEN DEST[63:32] := FFFFFFFFH;
ELSE DEST[63:32] :=000000000H; FI;
IF CMP2 = TRUE
THEN DEST[95:64] := FFFFFFFFH;
ELSE DEST[95:64] := 000000000H; FI;
IF CMP3 = TRUE
THEN DEST[127:96] := FFFFFFFFH;
ELSE DEST[127:96] := 000000000H; FI;
IF CMP4 = TRUE
THEN DEST[159:128] := FFFFFFFFH;
ELSE DEST[159:128] := 000000000H; FI;
IF CMP5 = TRUE
THEN DEST[191:160] := FFFFFFFFH;
ELSE DEST[191:160] := 000000000H; FI;
IF CMP6 = TRUE
THEN DEST[223:192] := FFFFFFFFH;
ELSE DEST[223:192] :=000000000H; FI;
IF CMP7 = TRUE
THEN DEST[255:224] := FFFFFFFFH;
ELSE DEST[255:224] := 000000000H; FI;
DEST[MAXVL-1:256] := 0
3-192
Vol. 2A
CMPPS-Compare Packed Single Precision Floating-Point Values
INSTRUCTION SET REFERENCE, A-L
VCMPPS (VEX.128 Encoded Version)
CMP0 := SRC1[31:0] OP5 SRC2[31:0];
CMP1 := SRC1[63:32] OP5 SRC2[63:32];
CMP2 := SRC1[95:64] OP5 SRC2[95:64];
CMP3 := SRC1[127:96] OP5 SRC2[127:96];
IF CMP0 = TRUE
THEN DEST[31:0] :=FFFFFFFFH;
ELSE DEST[31:0] := 000000000H; FI;
IF CMP1 = TRUE
THEN DEST[63:32] := FFFFFFFFH;
ELSE DEST[63:32] := 000000000H; FI;
IF CMP2 = TRUE
THEN DEST[95:64] := FFFFFFFFH;
ELSE DEST[95:64] := 000000000H; FI;
IF CMP3 = TRUE
THEN DEST[127:96] := FFFFFFFFH;
ELSE DEST[127:96] :=000000000H; FI;
DEST[MAXVL-1:128] := 0
CMPPS (128-bit Legacy SSE Version)
CMP0 := SRC1[31:0] OP3 SRC2[31:0];
CMP1 := SRC1[63:32] OP3 SRC2[63:32];
CMP2 := SRC1[95:64] OP3 SRC2[95:64];
CMP3 := SRC1[127:96] OP3 SRC2[127:96];
IF CMP0 = TRUE
THEN DEST[31:0] :=FFFFFFFFH;
ELSE DEST[31:0] := 000000000H; FI;
IF CMP1 = TRUE
THEN DEST[63:32] := FFFFFFFFH;
ELSE DEST[63:32] := 000000000H; FI;
IF CMP2 = TRUE
THEN DEST[95:64] := FFFFFFFFH;
ELSE DEST[95:64] := 000000000H; FI;
IF CMP3 = TRUE
THEN DEST[127:96] := FFFFFFFFH;
ELSE DEST[127:96] :=000000000H; FI;
DEST[MAXVL-1:128] (Unmodified)
Intel C/C++ Compiler Intrinsic Equivalent
VCMPPS __mmask16 _mm512_cmp_ps_mask( __m512 a, __m512 b, int imm);
VCMPPS __mmask16 _mm512_cmp_round_ps_mask( __m512 a, __m512 b, int imm, int sae);
VCMPPS __mmask16 _mm512_mask_cmp_ps_mask( __mmask16 k1, __m512 a, __m512 b, int imm);
VCMPPS __mmask16 _mm512_mask_cmp_round_ps_mask( __mmask16 k1, __m512 a, __m512 b, int imm, int sae);
VCMPPS __mmask8 _mm256_cmp_ps_mask( __m256 a, __m256 b, int imm);
VCMPPS __mmask8 _mm256_mask_cmp_ps_mask( __mmask8 k1, __m256 a, __m256 b, int imm);
VCMPPS __mmask8 _mm_cmp_ps_mask( __m128 a, __m128 b, int imm);
VCMPPS __mmask8 _mm_mask_cmp_ps_mask( __mmask8 k1, __m128 a, __m128 b, int imm);
VCMPPS __m256 _mm256_cmp_ps(__m256 a, __m256 b, int imm)
CMPPS __m128 _mm_cmp_ps(__m128 a, __m128 b, int imm)
SIMD Floating-Point Exceptions
Invalid if SNaN operand and invalid if QNaN and predicate as listed in Table 3-1, Denormal.
CMPPS-Compare Packed Single Precision Floating-Point Values
Vol. 2A
3-193
INSTRUCTION SET REFERENCE, A-L
Other Exceptions
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions.”
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions.”
3-194
Vol. 2A
CMPPS-Compare Packed Single Precision Floating-Point Values
INSTRUCTION SET REFERENCE, A-L
CMPS/CMPSB/CMPSW/CMPSD/CMPSQ-Compare String Operands
Opcode
Instruction
Op/
64-Bit
Compat/
Description
En
Mode
Leg Mode
A6
CMPS m8, m8
ZO
Valid
Valid
For legacy mode, compare byte at address DS:(E)SI with
byte at address ES:(E)DI; For 64-bit mode compare byte
at address (R|E)SI to byte at address (R|E)DI. The status
flags are set accordingly.
A7
CMPS m16, m16
ZO
Valid
Valid
For legacy mode, compare word at address DS:(E)SI
with word at address ES:(E)DI; For 64-bit mode
compare word at address (R|E)SI with word at address
(R|E)DI. The status flags are set accordingly.
A7
CMPS m32, m32
ZO
Valid
Valid
For legacy mode, compare dword at address DS:(E)SI at
dword at address ES:(E)DI; For 64-bit mode compare
dword at address (R|E)SI at dword at address (R|E)DI.
The status flags are set accordingly.
REX.W + A7
CMPS m64, m64
ZO
Valid
N.E.
Compares quadword at address (R|E)SI with quadword
at address (R|E)DI and sets the status flags accordingly.
A6
CMPSB
ZO
Valid
Valid
For legacy mode, compare byte at address DS:(E)SI with
byte at address ES:(E)DI; For 64-bit mode compare byte
at address (R|E)SI with byte at address (R|E)DI. The
status flags are set accordingly.
A7
CMPSW
ZO
Valid
Valid
For legacy mode, compare word at address DS:(E)SI
with word at address ES:(E)DI; For 64-bit mode
compare word at address (R|E)SI with word at address
(R|E)DI. The status flags are set accordingly.
A7
CMPSD
ZO
Valid
Valid
For legacy mode, compare dword at address DS:(E)SI
with dword at address ES:(E)DI; For 64-bit mode
compare dword at address (R|E)SI with dword at
address (R|E)DI. The status flags are set accordingly.
REX.W + A7
CMPSQ
ZO
Valid
N.E.
Compares quadword at address (R|E)SI with quadword
at address (R|E)DI and sets the status flags accordingly.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
ZO
N/A
N/A
N/A
N/A
Description
Compares the byte, word, doubleword, or quadword specified with the first source operand with the byte, word,
doubleword, or quadword specified with the second source operand and sets the status flags in the EFLAGS register
according to the results.
Both source operands are located in memory. The address of the first source operand is read from DS:SI, DS:ESI
or RSI (depending on the address-size attribute of the instruction is 16, 32, or 64, respectively). The address of the
second source operand is read from ES:DI, ES:EDI or RDI (again depending on the address-size attribute of the
instruction is 16, 32, or 64). The DS segment may be overridden with a segment override prefix, but the ES
segment cannot be overridden.
At the assembly-code level, two forms of this instruction are allowed: the “explicit-operands” form and the “no-
operands” form. The explicit-operands form (specified with the CMPS mnemonic) allows the two source operands
to be specified explicitly. Here, the source operands should be symbols that indicate the size and location of the
source values. This explicit-operand form is provided to allow documentation. However, note that the documenta-
tion provided by this form can be misleading. That is, the source operand symbols must specify the correct type
(size) of the operands (bytes, words, or doublewords, quadwords), but they do not have to specify the correct loca-
CMPS/CMPSB/CMPSW/CMPSD/CMPSQ-Compare String Operands
Vol. 2A
3-195
INSTRUCTION SET REFERENCE, A-L
tion. Locations of the source operands are always specified by the DS:(E)SI (or RSI) and ES:(E)DI (or RDI) regis-
ters, which must be loaded correctly before the compare string instruction is executed.
The no-operands form provides “short forms” of the byte, word, and doubleword versions of the CMPS instructions.
Here also the DS:(E)SI (or RSI) and ES:(E)DI (or RDI) registers are assumed by the processor to specify the loca-
tion of the source operands. The size of the source operands is selected with the mnemonic: CMPSB (byte compar-
ison), CMPSW (word comparison), CMPSD (doubleword comparison), or CMPSQ (quadword comparison using
REX.W).
After the comparison, the (E/R)SI and (E/R)DI registers increment or decrement automatically according to the
setting of the DF flag in the EFLAGS register. (If the DF flag is 0, the (E/R)SI and (E/R)DI register increment; if the
DF flag is 1, the registers decrement.) The registers increment or decrement by 1 for byte operations, by 2 for word
operations, 4 for doubleword operations. If operand size is 64, RSI and RDI registers increment by 8 for quadword
operations.
The CMPS, CMPSB, CMPSW, CMPSD, and CMPSQ instructions can be preceded by the REP prefix for block compar-
isons. More often, however, these instructions will be used in a LOOP construct that takes some action based on the
setting of the status flags before the next comparison is made. See “REP/REPE/REPZ /REPNE/REPNZ-Repeat
String Operation Prefix” in Chapter 4 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual,
Volume 2B, for a description of the REP prefix.
In 64-bit mode, the instruction’s default address size is 64 bits, 32 bit address size is supported using the prefix
67H. Use of the REX.W prefix promotes doubleword operation to 64 bits (see CMPSQ). See the summary chart at
the beginning of this section for encoding data and limits.
Operation
temp := SRC1 - SRC2;
SetStatusFlags(temp);
IF (64-Bit Mode)
THEN
IF (Byte comparison)
THEN IF DF = 0
THEN
(R|E)SI := (R|E)SI + 1;
(R|E)DI := (R|E)DI + 1;
ELSE
(R|E)SI := (R|E)SI - 1;
(R|E)DI := (R|E)DI - 1;
FI;
ELSE IF (Word comparison)
THEN IF DF = 0
THEN
(R|E)SI := (R|E)SI + 2;
(R|E)DI := (R|E)DI + 2;
ELSE
(R|E)SI := (R|E)SI - 2;
(R|E)DI := (R|E)DI - 2;
FI;
ELSE IF (Doubleword comparison)
THEN IF DF = 0
THEN
(R|E)SI := (R|E)SI + 4;
(R|E)DI := (R|E)DI + 4;
ELSE
(R|E)SI := (R|E)SI - 4;
(R|E)DI := (R|E)DI - 4;
FI;
3-196
Vol. 2A
CMPS/CMPSB/CMPSW/CMPSD/CMPSQ-Compare String Operands
INSTRUCTION SET REFERENCE, A-L
ELSE (* Quadword comparison *)
THEN IF DF = 0
(R|E)SI := (R|E)SI + 8;
(R|E)DI := (R|E)DI + 8;
ELSE
(R|E)SI := (R|E)SI - 8;
(R|E)DI := (R|E)DI - 8;
FI;
FI;
ELSE (* Non-64-bit Mode *)
IF (byte comparison)
THEN IF DF = 0
THEN
(E)SI := (E)SI + 1;
(E)DI := (E)DI + 1;
ELSE
(E)SI := (E)SI - 1;
(E)DI := (E)DI - 1;
FI;
ELSE IF (Word comparison)
THEN IF DF = 0
(E)SI := (E)SI + 2;
(E)DI := (E)DI + 2;
ELSE
(E)SI := (E)SI - 2;
(E)DI := (E)DI - 2;
FI;
ELSE (* Doubleword comparison *)
THEN IF DF = 0
(E)SI := (E)SI + 4;
(E)DI := (E)DI + 4;
ELSE
(E)SI := (E)SI - 4;
(E)DI := (E)DI - 4;
FI;
FI;
FI;
Flags Affected
The CF, OF, SF, ZF, AF, and PF flags are set according to the temporary result of the comparison.
Protected Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
CMPS/CMPSB/CMPSW/CMPSD/CMPSQ-Compare String Operands
Vol. 2A
3-197
INSTRUCTION SET REFERENCE, A-L
Real-Address Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
#UD
If the LOCK prefix is used.
Virtual-8086 Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
#UD
If the LOCK prefix is used.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
3-198
Vol. 2A
CMPS/CMPSB/CMPSW/CMPSD/CMPSQ-Compare String Operands
INSTRUCTION SET REFERENCE, A-L
CMPSD-Compare Scalar Double Precision Floating-Point Value
Opcode/
Op /
64/32 bit
CPUID
Description
Instruction
En
Mode
Feature
Support
Flag
F2 0F C2 /r ib
A
V/V
SSE2
Compare low double precision floating-point value in
CMPSD xmm1, xmm2/m64, imm8
xmm2/m64 and xmm1 using bits 2:0 of imm8 as comparison
predicate.
VEX.LIG.F2.0F.WIG C2 /r ib
B
V/V
AVX
Compare low double precision floating-point value in
VCMPSD xmm1, xmm2, xmm3/m64,
xmm3/m64 and xmm2 using bits 4:0 of imm8 as comparison
imm8
predicate.
EVEX.LLIG.F2.0F.W1 C2 /r ib
C
V/V
AVX512F
Compare low double precision floating-point value in
VCMPSD k1 {k2}, xmm2,
xmm3/m64 and xmm2 using bits 4:0 of imm8 as comparison
xmm3/m64{sae}, imm8
predicate with writemask k2 and leave the result in mask
register k1.
Instruction Operand Encoding
Op/En
Tuple Type
Operand 1
Operand 2
Operand 3
Operand 4
A
N/A
ModRM:reg (r, w)
ModRM:r/m (r)
imm8
N/A
B
N/A
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
imm8
C
Tuple1 Scalar
ModRM:reg (w)
EVEX.vvvv (r)
ModRM:r/m (r)
imm8
Description
Compares the low double precision floating-point values in the second source operand and the first source operand
and returns the result of the comparison to the destination operand. The comparison predicate operand (imme-
diate operand) specifies the type of comparison performed.
128-bit Legacy SSE version: The first source and destination operand (first operand) is an XMM register. The
second source operand (second operand) can be an XMM register or 64-bit memory location. Bits (MAXVL-1:64) of
the corresponding YMM destination register remain unchanged. The comparison result is a quadword mask of all 1s
(comparison true) or all 0s (comparison false).
VEX.128 encoded version: The first source operand (second operand) is an XMM register. The second source
operand (third operand) can be an XMM register or a 64-bit memory location. The result is stored in the low quad-
word of the destination operand; the high quadword is filled with the contents of the high quadword of the first
source operand. Bits (MAXVL-1:128) of the destination ZMM register are zeroed. The comparison result is a quad-
word mask of all 1s (comparison true) or all 0s (comparison false).
EVEX encoded version: The first source operand (second operand) is an XMM register. The second source operand
can be a XMM register or a 64-bit memory location. The destination operand (first operand) is an opmask register.
The comparison result is a single mask bit of 1 (comparison true) or 0 (comparison false), written to the destination
starting from the LSB according to the writemask k2. Bits (MAX_KL-1:128) of the destination register are cleared.
The comparison predicate operand is an 8-bit immediate:
• For instructions encoded using the VEX prefix, bits 4:0 define the type of comparison to be performed (see
Table 3-1). Bits 5 through 7 of the immediate are reserved.
• For instruction encodings that do not use VEX prefix, bits 2:0 define the type of comparison to be made (see
the first 8 rows of Table 3-1). Bits 3 through 7 of the immediate are reserved.
The unordered relationship is true when at least one of the two source operands being compared is a NaN; the
ordered relationship is true when neither source operand is a NaN.
A subsequent computational instruction that uses the mask result in the destination operand as an input operand
will not generate an exception, because a mask of all 0s corresponds to a floating-point value of +0.0 and a mask
of all 1s corresponds to a QNaN.
Note that processors with “CPUID.1H:ECX.AVX =0” do not implement the “greater-than”, “greater-than-or-equal”,
“not-greater than”, and “not-greater-than-or-equal relations” predicates. These comparisons can be made either
CMPSD-Compare Scalar Double Precision Floating-Point Value
Vol. 2A
3-199
INSTRUCTION SET REFERENCE, A-L
by using the inverse relationship (that is, use the “not-less-than-or-equal” to make a “greater-than” comparison)
or by using software emulation. When using software emulation, the program must swap the operands (copying
registers when necessary to protect the data that will now be in the destination), and then perform the compare
using a different predicate. The predicate to be used for these emulations is listed in the first 8 rows of Table 3-7
(Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A) under the heading Emulation.
Compilers and assemblers may implement the following two-operand pseudo-ops in addition to the three-operand
CMPSD instruction, for processors with “CPUID.1H:ECX.AVX =0”. See Table 3-6. The compiler should treat
reserved imm8 values as illegal syntax.
:
Table 3-6. Pseudo-Op and CMPSD Implementation
Pseudo-Op
CMPSD Implementation
CMPEQSD xmm1, xmm2
CMPSD xmm1, xmm2, 0
CMPLTSD xmm1, xmm2
CMPSD xmm1, xmm2, 1
CMPLESD xmm1, xmm2
CMPSD xmm1, xmm2, 2
CMPUNORDSD xmm1, xmm2
CMPSD xmm1, xmm2, 3
CMPNEQSD xmm1, xmm2
CMPSD xmm1, xmm2, 4
CMPNLTSD xmm1, xmm2
CMPSD xmm1, xmm2, 5
CMPNLESD xmm1, xmm2
CMPSD xmm1, xmm2, 6
CMPORDSD xmm1, xmm2
CMPSD xmm1, xmm2, 7
The greater-than relations that the processor does not implement require more than one instruction to emulate in
software and therefore should not be implemented as pseudo-ops. (For these, the programmer should reverse the
operands of the corresponding less than relations and use move instructions to ensure that the mask is moved to
the correct destination register and that the source operand is left intact.)
Processors with “CPUID.1H:ECX.AVX =1” implement the full complement of 32 predicates shown in Table 3-7, soft-
ware emulation is no longer needed. Compilers and assemblers may implement the following three-operand
pseudo-ops in addition to the four-operand VCMPSD instruction. See Table 3-7, where the notations of reg1 reg2,
and reg3 represent either XMM registers or YMM registers. The compiler should treat reserved imm8 values as
illegal syntax. Alternately, intrinsics can map the pseudo-ops to pre-defined constants to support a simpler intrinsic
interface. Compilers and assemblers may implement three-operand pseudo-ops for EVEX encoded VCMPSD
instructions in a similar fashion by extending the syntax listed in Table 3-7.
:
Table 3-7. Pseudo-Op and VCMPSD Implementation
Pseudo-Op
CMPSD Implementation
VCMPEQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 0
VCMPLTSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 1
VCMPLESD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 2
VCMPUNORDSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 3
VCMPNEQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 4
VCMPNLTSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 5
VCMPNLESD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 6
VCMPORDSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 7
VCMPEQ_UQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 8
VCMPNGESD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 9
VCMPNGTSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 0AH
VCMPFALSESD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 0BH
VCMPNEQ_OQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 0CH
VCMPGESD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 0DH
3-200
Vol. 2A
CMPSD-Compare Scalar Double Precision Floating-Point Value
INSTRUCTION SET REFERENCE, A-L
Table 3-7. Pseudo-Op and VCMPSD Implementation
Pseudo-Op
CMPSD Implementation
VCMPGTSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 0EH
VCMPTRUESD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 0FH
VCMPEQ_OSSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 10H
VCMPLT_OQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 11H
VCMPLE_OQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 12H
VCMPUNORD_SSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 13H
VCMPNEQ_USSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 14H
VCMPNLT_UQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 15H
VCMPNLE_UQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 16H
VCMPORD_SSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 17H
VCMPEQ_USSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 18H
VCMPNGE_UQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 19H
VCMPNGT_UQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 1AH
VCMPFALSE_OSSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 1BH
VCMPNEQ_OSSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 1CH
VCMPGE_OQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 1DH
VCMPGT_OQSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 1EH
VCMPTRUE_USSD reg1, reg2, reg3
VCMPSD reg1, reg2, reg3, 1FH
Software should ensure VCMPSD is encoded with VEX.L=0. Encoding VCMPSD with VEX.L=1 may encounter unpre-
dictable behavior across different processor generations.
Operation
CASE (COMPARISON PREDICATE) OF
0: OP3 := EQ_OQ; OP5 := EQ_OQ;
1: OP3 := LT_OS; OP5 := LT_OS;
2: OP3 := LE_OS; OP5 := LE_OS;
3: OP3 := UNORD_Q; OP5 := UNORD_Q;
4: OP3 := NEQ_UQ; OP5 := NEQ_UQ;
5: OP3 := NLT_US; OP5 := NLT_US;
6: OP3 := NLE_US; OP5 := NLE_US;
7: OP3 := ORD_Q; OP5 := ORD_Q;
8: OP5 := EQ_UQ;
9: OP5 := NGE_US;
10: OP5 := NGT_US;
11: OP5 := FALSE_OQ;
12: OP5 := NEQ_OQ;
13: OP5 := GE_OS;
14: OP5 := GT_OS;
15: OP5 := TRUE_UQ;
16: OP5 := EQ_OS;
17: OP5 := LT_OQ;
18: OP5 := LE_OQ;
19: OP5 := UNORD_S;
20: OP5 := NEQ_US;
21: OP5 := NLT_UQ;
CMPSD-Compare Scalar Double Precision Floating-Point Value
Vol. 2A
3-201
INSTRUCTION SET REFERENCE, A-L
22: OP5 := NLE_UQ;
23: OP5 := ORD_S;
24: OP5 := EQ_US;
25: OP5 := NGE_UQ;
26: OP5 := NGT_UQ;
27: OP5 := FALSE_OS;
28: OP5 := NEQ_OS;
29: OP5 := GE_OQ;
30: OP5 := GT_OQ;
31: OP5 := TRUE_US;
DEFAULT: Reserved
ESAC;
VCMPSD (EVEX Encoded Version)
CMP0 := SRC1[63:0] OP5 SRC2[63:0];
IF k2[0] or *no writemask*
THEN
IF CMP0 = TRUE
THEN DEST[0] := 1;
ELSE DEST[0] := 0; FI;
ELSE
DEST[0] := 0
; zeroing-masking only
FI;
DEST[MAX_KL-1:1] := 0
CMPSD (128-bit Legacy SSE Version)
CMP0 := DEST[63:0] OP3 SRC[63:0];
IF CMP0 = TRUE
THEN DEST[63:0] := FFFFFFFFFFFFFFFFH;
ELSE DEST[63:0] := 0000000000000000H; FI;
DEST[MAXVL-1:64] (Unmodified)
VCMPSD (VEX.128 Encoded Version)
CMP0 := SRC1[63:0] OP5 SRC2[63:0];
IF CMP0 = TRUE
THEN DEST[63:0] := FFFFFFFFFFFFFFFFH;
ELSE DEST[63:0] := 0000000000000000H; FI;
DEST[127:64] := SRC1[127:64]
DEST[MAXVL-1:128] := 0
Intel C/C++ Compiler Intrinsic Equivalent
VCMPSD __mmask8 _mm_cmp_sd_mask( __m128d a, __m128d b, int imm);
VCMPSD __mmask8 _mm_cmp_round_sd_mask( __m128d a, __m128d b, int imm, int sae);
VCMPSD __mmask8 _mm_mask_cmp_sd_mask( __mmask8 k1, __m128d a, __m128d b, int imm);
VCMPSD __mmask8 _mm_mask_cmp_round_sd_mask( __mmask8 k1, __m128d a, __m128d b, int imm, int sae);
(V)CMPSD __m128d _mm_cmp_sd(__m128d a, __m128d b, const int imm)
SIMD Floating-Point Exceptions
Invalid if SNaN operand, Invalid if QNaN and predicate as listed in Table 3-1, Denormal.
Other Exceptions
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions.”
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions.”
3-202
Vol. 2A
CMPSD-Compare Scalar Double Precision Floating-Point Value
INSTRUCTION SET REFERENCE, A-L
CMPSS-Compare Scalar Single Precision Floating-Point Value
Opcode/
Op /
64/32 bit
CPUID
Description
Instruction
En
Mode
Feature
Support
Flag
F3 0F C2 /r ib
A
V/V
SSE
Compare low single precision floating-point value in
CMPSS xmm1, xmm2/m32, imm8
xmm2/m32 and xmm1 using bits 2:0 of imm8 as
comparison predicate.
VEX.LIG.F3.0F.WIG C2 /r ib
B
V/V
AVX
Compare low single precision floating-point value in
VCMPSS xmm1, xmm2, xmm3/m32,
xmm3/m32 and xmm2 using bits 4:0 of imm8 as
imm8
comparison predicate.
EVEX.LLIG.F3.0F.W0 C2 /r ib
C
V/V
AVX512F
Compare low single precision floating-point value in
VCMPSS k1 {k2}, xmm2,
xmm3/m32 and xmm2 using bits 4:0 of imm8 as
xmm3/m32{sae}, imm8
comparison predicate with writemask k2 and leave the
result in mask register k1.
Instruction Operand Encoding
Op/En
Tuple Type
Operand 1
Operand 2
Operand 3
Operand 4
A
N/A
ModRM:reg (r, w)
ModRM:r/m (r)
imm8
N/A
B
N/A
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
imm8
C
Tuple1 Scalar
ModRM:reg (w)
EVEX.vvvv (r)
ModRM:r/m (r)
imm8
Description
Compares the low single precision floating-point values in the second source operand and the first source operand
and returns the result of the comparison to the destination operand. The comparison predicate operand (imme-
diate operand) specifies the type of comparison performed.
128-bit Legacy SSE version: The first source and destination operand (first operand) is an XMM register. The
second source operand (second operand) can be an XMM register or 32-bit memory location. Bits (MAXVL-1:32) of
the corresponding YMM destination register remain unchanged. The comparison result is a doubleword mask of all
1s (comparison true) or all 0s (comparison false).
VEX.128 encoded version: The first source operand (second operand) is an XMM register. The second source
operand (third operand) can be an XMM register or a 32-bit memory location. The result is stored in the low 32 bits
of the destination operand; bits 127:32 of the destination operand are copied from the first source operand. Bits
(MAXVL-1:128) of the destination ZMM register are zeroed. The comparison result is a doubleword mask of all 1s
(comparison true) or all 0s (comparison false).
EVEX encoded version: The first source operand (second operand) is an XMM register. The second source operand
can be a XMM register or a 32-bit memory location. The destination operand (first operand) is an opmask register.
The comparison result is a single mask bit of 1 (comparison true) or 0 (comparison false), written to the destination
starting from the LSB according to the writemask k2. Bits (MAX_KL-1:128) of the destination register are cleared.
The comparison predicate operand is an 8-bit immediate:
• For instructions encoded using the VEX prefix, bits 4:0 define the type of comparison to be performed (see
Table 3-1). Bits 5 through 7 of the immediate are reserved.
• For instruction encodings that do not use VEX prefix, bits 2:0 define the type of comparison to be made (see
the first 8 rows of Table 3-1). Bits 3 through 7 of the immediate are reserved.
The unordered relationship is true when at least one of the two source operands being compared is a NaN; the
ordered relationship is true when neither source operand is a NaN.
A subsequent computational instruction that uses the mask result in the destination operand as an input operand
will not generate an exception, because a mask of all 0s corresponds to a floating-point value of +0.0 and a mask
of all 1s corresponds to a QNaN.
CMPSS-Compare Scalar Single Precision Floating-Point Value
Vol. 2A
3-203
INSTRUCTION SET REFERENCE, A-L
Note that processors with “CPUID.1H:ECX.AVX =0” do not implement the “greater-than”, “greater-than-or-equal”,
“not-greater than”, and “not-greater-than-or-equal relations” predicates. These comparisons can be made either
by using the inverse relationship (that is, use the “not-less-than-or-equal” to make a “greater-than” comparison)
or by using software emulation. When using software emulation, the program must swap the operands (copying
registers when necessary to protect the data that will now be in the destination), and then perform the compare
using a different predicate. The predicate to be used for these emulations is listed in the first 8 rows of Table 3-7
(Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A) under the heading Emulation.
Compilers and assemblers may implement the following two-operand pseudo-ops in addition to the three-operand
CMPSS instruction, for processors with “CPUID.1H:ECX.AVX =0”. See Table 3-8. The compiler should treat reserved
imm8 values as illegal syntax.
:
Table 3-8. Pseudo-Op and CMPSS Implementation
Pseudo-Op
CMPSS Implementation
CMPEQSS xmm1, xmm2
CMPSS xmm1, xmm2, 0
CMPLTSS xmm1, xmm2
CMPSS xmm1, xmm2, 1
CMPLESS xmm1, xmm2
CMPSS xmm1, xmm2, 2
CMPUNORDSS xmm1, xmm2
CMPSS xmm1, xmm2, 3
CMPNEQSS xmm1, xmm2
CMPSS xmm1, xmm2, 4
CMPNLTSS xmm1, xmm2
CMPSS xmm1, xmm2, 5
CMPNLESS xmm1, xmm2
CMPSS xmm1, xmm2, 6
CMPORDSS xmm1, xmm2
CMPSS xmm1, xmm2, 7
The greater-than relations that the processor does not implement require more than one instruction to emulate in
software and therefore should not be implemented as pseudo-ops. (For these, the programmer should reverse the
operands of the corresponding less than relations and use move instructions to ensure that the mask is moved to
the correct destination register and that the source operand is left intact.)
Processors with “CPUID.1H:ECX.AVX =1” implement the full complement of 32 predicates shown in Table 3-7, soft-
ware emulation is no longer needed. Compilers and assemblers may implement the following three-operand
pseudo-ops in addition to the four-operand VCMPSS instruction. See Table 3-9, where the notations of reg1 reg2,
and reg3 represent either XMM registers or YMM registers. The compiler should treat reserved imm8 values as
illegal syntax. Alternately, intrinsics can map the pseudo-ops to pre-defined constants to support a simpler intrinsic
interface. Compilers and assemblers may implement three-operand pseudo-ops for EVEX encoded VCMPSS
instructions in a similar fashion by extending the syntax listed in Table 3-9.
:
Table 3-9. Pseudo-Op and VCMPSS Implementation
Pseudo-Op
CMPSS Implementation
VCMPEQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 0
VCMPLTSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 1
VCMPLESS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 2
VCMPUNORDSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 3
VCMPNEQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 4
VCMPNLTSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 5
VCMPNLESS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 6
VCMPORDSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 7
VCMPEQ_UQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 8
VCMPNGESS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 9
VCMPNGTSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 0AH
VCMPFALSESS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 0BH
3-204
Vol. 2A
CMPSS-Compare Scalar Single Precision Floating-Point Value
INSTRUCTION SET REFERENCE, A-L
Table 3-9. Pseudo-Op and VCMPSS Implementation
Pseudo-Op
CMPSS Implementation
VCMPNEQ_OQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 0CH
VCMPGESS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 0DH
VCMPGTSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 0EH
VCMPTRUESS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 0FH
VCMPEQ_OSSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 10H
VCMPLT_OQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 11H
VCMPLE_OQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 12H
VCMPUNORD_SSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 13H
VCMPNEQ_USSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 14H
VCMPNLT_UQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 15H
VCMPNLE_UQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 16H
VCMPORD_SSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 17H
VCMPEQ_USSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 18H
VCMPNGE_UQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 19H
VCMPNGT_UQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 1AH
VCMPFALSE_OSSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 1BH
VCMPNEQ_OSSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 1CH
VCMPGE_OQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 1DH
VCMPGT_OQSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 1EH
VCMPTRUE_USSS reg1, reg2, reg3
VCMPSS reg1, reg2, reg3, 1FH
Software should ensure VCMPSS is encoded with VEX.L=0. Encoding VCMPSS with VEX.L=1 may encounter unpre-
dictable behavior across different processor generations.
Operation
CASE (COMPARISON PREDICATE) OF
0: OP3 := EQ_OQ; OP5 := EQ_OQ;
1: OP3 := LT_OS; OP5 := LT_OS;
2: OP3 := LE_OS; OP5 := LE_OS;
3: OP3 := UNORD_Q; OP5 := UNORD_Q;
4: OP3 := NEQ_UQ; OP5 := NEQ_UQ;
5: OP3 := NLT_US; OP5 := NLT_US;
6: OP3 := NLE_US; OP5 := NLE_US;
7: OP3 := ORD_Q; OP5 := ORD_Q;
8: OP5 := EQ_UQ;
9: OP5 := NGE_US;
10: OP5 := NGT_US;
11: OP5 := FALSE_OQ;
12: OP5 := NEQ_OQ;
13: OP5 := GE_OS;
14: OP5 := GT_OS;
15: OP5 := TRUE_UQ;
16: OP5 := EQ_OS;
17: OP5 := LT_OQ;
18: OP5 := LE_OQ;
CMPSS-Compare Scalar Single Precision Floating-Point Value
Vol. 2A
3-205
INSTRUCTION SET REFERENCE, A-L
19: OP5 := UNORD_S;
20: OP5 := NEQ_US;
21: OP5 := NLT_UQ;
22: OP5 := NLE_UQ;
23: OP5 := ORD_S;
24: OP5 := EQ_US;
25: OP5 := NGE_UQ;
26: OP5 := NGT_UQ;
27: OP5 := FALSE_OS;
28: OP5 := NEQ_OS;
29: OP5 := GE_OQ;
30: OP5 := GT_OQ;
31: OP5 := TRUE_US;
DEFAULT: Reserved
ESAC;
VCMPSS (EVEX Encoded Version)
CMP0 := SRC1[31:0] OP5 SRC2[31:0];
IF k2[0] or *no writemask*
THEN
IF CMP0 = TRUE
THEN DEST[0] := 1;
ELSE DEST[0] := 0; FI;
ELSE
DEST[0] := 0
; zeroing-masking only
FI;
DEST[MAX_KL-1:1] := 0
CMPSS (128-bit Legacy SSE Version)
CMP0 := DEST[31:0] OP3 SRC[31:0];
IF CMP0 = TRUE
THEN DEST[31:0] := FFFFFFFFH;
ELSE DEST[31:0] := 00000000H; FI;
DEST[MAXVL-1:32] (Unmodified)
VCMPSS (VEX.128 Encoded Version)
CMP0 := SRC1[31:0] OP5 SRC2[31:0];
IF CMP0 = TRUE
THEN DEST[31:0] := FFFFFFFFH;
ELSE DEST[31:0] := 00000000H; FI;
DEST[127:32] := SRC1[127:32]
DEST[MAXVL-1:128] := 0
Intel C/C++ Compiler Intrinsic Equivalent
VCMPSS __mmask8 _mm_cmp_ss_mask( __m128 a, __m128 b, int imm);
VCMPSS __mmask8 _mm_cmp_round_ss_mask( __m128 a, __m128 b, int imm, int sae);
VCMPSS __mmask8 _mm_mask_cmp_ss_mask( __mmask8 k1, __m128 a, __m128 b, int imm);
VCMPSS __mmask8 _mm_mask_cmp_round_ss_mask( __mmask8 k1, __m128 a, __m128 b, int imm, int sae);
(V)CMPSS __m128 _mm_cmp_ss(__m128 a, __m128 b, const int imm)
SIMD Floating-Point Exceptions
Invalid if SNaN operand, Invalid if QNaN and predicate as listed in Table 3-1, Denormal.
3-206
Vol. 2A
CMPSS-Compare Scalar Single Precision Floating-Point Value
INSTRUCTION SET REFERENCE, A-L
Other Exceptions
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions.”
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions.”
CMPSS-Compare Scalar Single Precision Floating-Point Value
Vol. 2A
3-207
INSTRUCTION SET REFERENCE, A-L
CMPXCHG-Compare and Exchange
Opcode/
Op/
64-Bit
Compat/
Description
Instruction
En
Mode
Leg Mode
0F B0/r
MR
Valid
Valid*
Compare AL with r/m8. If equal, ZF is set and r8 is loaded into
r/m8. Else, clear ZF and load r/m8 into AL.
CMPXCHG r/m8, r8
REX + 0F B0/r
MR
Valid
N.E.
Compare AL with r/m8. If equal, ZF is set and r8 is loaded into
r/m8. Else, clear ZF and load r/m8 into AL.
CMPXCHG r/m8**,r8
0F B1/r
MR
Valid
Valid*
Compare AX with r/m16. If equal, ZF is set and r16 is loaded
into r/m16. Else, clear ZF and load r/m16 into AX.
CMPXCHG r/m16, r16
0F B1/r
MR
Valid
Valid*
Compare EAX with r/m32. If equal, ZF is set and r32 is loaded
into r/m32. Else, clear ZF and load r/m32 into EAX.
CMPXCHG r/m32, r32
REX.W + 0F B1/r
MR
Valid
N.E.
Compare RAX with r/m64. If equal, ZF is set and r64 is loaded
into r/m64. Else, clear ZF and load r/m64 into RAX.
CMPXCHG r/m64, r64
NOTES:
* See the IA-32 Architecture Compatibility section below.
** In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
MR
ModRM:r/m (r, w)
ModRM:reg (r)
N/A
N/A
Description
Compares the value in the AL, AX, EAX, or RAX register with the first operand (destination operand). If the two
values are equal, the second operand (source operand) is loaded into the destination operand. Otherwise, the
destination operand is loaded into the AL, AX, EAX or RAX register. RAX register is available only in 64-bit mode.
This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. To simplify the
interface to the processor’s bus, the destination operand receives a write cycle without regard to the result of the
comparison. The destination operand is written back if the comparison fails; otherwise, the source operand is
written into the destination. (The processor never produces a locked read without also producing a locked write.)
In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi-
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the
beginning of this section for encoding data and limits.
IA-32 Architecture Compatibility
This instruction is not supported on Intel processors earlier than the Intel486 processors.
Operation
(* Accumulator = AL, AX, EAX, or RAX depending on whether a byte, word, doubleword, or quadword comparison is being performed *)
TEMP := DEST
IF accumulator = TEMP
THEN
ZF := 1;
DEST := SRC;
ELSE
ZF := 0;
accumulator := TEMP;
DEST := TEMP;
FI;
3-208
Vol. 2A
CMPXCHG-Compare and Exchange
INSTRUCTION SET REFERENCE, A-L
Flags Affected
The ZF flag is set if the values in the destination operand and register AL, AX, or EAX are equal; otherwise it is
cleared. The CF, PF, AF, SF, and OF flags are set according to the results of the comparison operation.
Protected Mode Exceptions
#GP(0)
If the destination is located in a non-writable segment.
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Real-Address Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Virtual-8086 Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
CMPXCHG-Compare and Exchange
Vol. 2A
3-209
INSTRUCTION SET REFERENCE, A-L
CMPXCHG8B/CMPXCHG16B-Compare and Exchange Bytes
Opcode/
Op/
64-Bit
Compat/
Description
Instruction
En
Mode
Leg Mode
0F C7 /1
M
Valid
Valid*
Compare EDX:EAX with m64. If equal, set ZF and load
ECX:EBX into m64. Else, clear ZF and load m64 into EDX:EAX.
CMPXCHG8B m64
REX.W + 0F C7 /1
M
Valid
N.E.
Compare RDX:RAX with m128. If equal, set ZF and load
RCX:RBX into m128. Else, clear ZF and load m128 into
CMPXCHG16B m128
RDX:RAX.
NOTES:
*See IA-32 Architecture Compatibility section below.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
M
ModRM:r/m (r, w)
N/A
N/A
N/A
Description
Compares the 64-bit value in EDX:EAX (or 128-bit value in RDX:RAX if operand size is 128 bits) with the operand
(destination operand). If the values are equal, the 64-bit value in ECX:EBX (or 128-bit value in RCX:RBX) is stored
in the destination operand. Otherwise, the value in the destination operand is loaded into EDX:EAX (or RDX:RAX).
The destination operand is an 8-byte memory location (or 16-byte memory location if operand size is 128 bits). For
the EDX:EAX and ECX:EBX register pairs, EDX and ECX contain the high-order 32 bits and EAX and EBX contain the
low-order 32 bits of a 64-bit value. For the RDX:RAX and RCX:RBX register pairs, RDX and RCX contain the high-
order 64 bits and RAX and RBX contain the low-order 64bits of a 128-bit value.
This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. To simplify the
interface to the processor’s bus, the destination operand receives a write cycle without regard to the result of the
comparison. The destination operand is written back if the comparison fails; otherwise, the source operand is
written into the destination. (The processor never produces a locked read without also producing a locked write.)
In 64-bit mode, default operation size is 64 bits. Use of the REX.W prefix promotes operation to 128 bits. Note that
CMPXCHG16B requires that the destination (memory) operand be 16-byte aligned. See the summary chart at the
beginning of this section for encoding data and limits. For information on the CPUID flag that indicates CMPX-
CHG16B, see page 3-242.
IA-32 Architecture Compatibility
This instruction encoding is not supported on Intel processors earlier than the Pentium processors.
3-210
Vol. 2A
CMPXCHG8B/CMPXCHG16B-Compare and Exchange Bytes
INSTRUCTION SET REFERENCE, A-L
Operation
IF (64-Bit Mode and OperandSize = 64)
THEN
TEMP128 := DEST
IF (RDX:RAX = TEMP128)
THEN
ZF := 1;
DEST := RCX:RBX;
ELSE
ZF := 0;
RDX:RAX := TEMP128;
DEST := TEMP128;
FI;
FI
ELSE
TEMP64 := DEST;
IF (EDX:EAX = TEMP64)
THEN
ZF := 1;
DEST := ECX:EBX;
ELSE
ZF := 0;
EDX:EAX := TEMP64;
DEST := TEMP64;
FI;
FI;
FI;
Flags Affected
The ZF flag is set if the destination operand and EDX:EAX are equal; otherwise it is cleared. The CF, PF, AF, SF, and
OF flags are unaffected.
Protected Mode Exceptions
#UD
If the destination is not a memory operand.
#GP(0)
If the destination is located in a non-writable segment.
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
Real-Address Mode Exceptions
#UD
If the destination operand is not a memory location.
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
CMPXCHG8B/CMPXCHG16B-Compare and Exchange Bytes
Vol. 2A
3-211
INSTRUCTION SET REFERENCE, A-L
Virtual-8086 Mode Exceptions
#UD
If the destination operand is not a memory location.
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
If memory operand for CMPXCHG16B is not aligned on a 16-byte boundary.
If CPUID.01H:ECX.CMPXCHG16B[bit 13] = 0.
#UD
If the destination operand is not a memory location.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
3-212
Vol. 2A
CMPXCHG8B/CMPXCHG16B-Compare and Exchange Bytes
INSTRUCTION SET REFERENCE, A-L
COMISD-Compare Scalar Ordered Double Precision Floating-Point Values and Set EFLAGS
Opcode/
Op /
64/32 bit
CPUID
Description
Instruction
En
Mode
Feature
Support
Flag
66 0F 2F /r
A
V/V
SSE2
Compare low double precision floating-point values in
COMISD xmm1, xmm2/m64
xmm1 and xmm2/mem64 and set the EFLAGS flags
accordingly.
VEX.LIG.66.0F.WIG 2F /r
A
V/V
AVX
Compare low double precision floating-point values in
VCOMISD xmm1, xmm2/m64
xmm1 and xmm2/mem64 and set the EFLAGS flags
accordingly.
EVEX.LLIG.66.0F.W1 2F /r
B
V/V
AVX512F
Compare low double precision floating-point values in
VCOMISD xmm1, xmm2/m64{sae}
xmm1 and xmm2/mem64 and set the EFLAGS flags
accordingly.
Instruction Operand Encoding
Op/En
Tuple Type
Operand 1
Operand 2
Operand 3
Operand 4
A
N/A
ModRM:reg (w)
ModRM:r/m (r)
N/A
N/A
B
Tuple1 Scalar
ModRM:reg (w)
ModRM:r/m (r)
N/A
N/A
Description
Compares the double precision floating-point values in the low quadwords of operand 1 (first operand) and operand
2 (second operand), and sets the ZF, PF, and CF flags in the EFLAGS register according to the result (unordered,
greater than, less than, or equal). The OF, SF, and AF flags in the EFLAGS register are set to 0. The unordered result
is returned if either source operand is a NaN (QNaN or SNaN).
Operand 1 is an XMM register; operand 2 can be an XMM register or a 64 bit memory location. The COMISD instruc-
tion differs from the UCOMISD instruction in that it signals a SIMD floating-point invalid operation exception (#I)
when a source operand is either a QNaN or SNaN. The UCOMISD instruction signals an invalid operation exception
only if a source operand is an SNaN.
The EFLAGS register is not updated if an unmasked SIMD floating-point exception is generated.
VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD.
Software should ensure VCOMISD is encoded with VEX.L=0. Encoding VCOMISD with VEX.L=1 may encounter
unpredictable behavior across different processor generations.
Operation
COMISD (All Versions)
RESULT :=OrderedCompare(DEST[63:0] <> SRC[63:0]) {
(* Set EFLAGS *) CASE (RESULT) OF
UNORDERED: ZF,PF,CF := 111;
GREATER_THAN: ZF,PF,CF := 000;
LESS_THAN: ZF,PF,CF := 001;
EQUAL: ZF,PF,CF := 100;
ESAC;
OF, AF, SF := 0; }
COMISD-Compare Scalar Ordered Double Precision Floating-Point Values and Set EFLAGS
Vol. 2A
3-213
INSTRUCTION SET REFERENCE, A-L
Intel C/C++ Compiler Intrinsic Equivalent
VCOMISD int _mm_comi_round_sd(__m128d a, __m128d b, int imm, int sae);
VCOMISD int _mm_comieq_sd (__m128d a, __m128d b)
VCOMISD int _mm_comilt_sd (__m128d a, __m128d b)
VCOMISD int _mm_comile_sd (__m128d a, __m128d b)
VCOMISD int _mm_comigt_sd (__m128d a, __m128d b)
VCOMISD int _mm_comige_sd (__m128d a, __m128d b)
VCOMISD int _mm_comineq_sd (__m128d a, __m128d b)
SIMD Floating-Point Exceptions
Invalid (if SNaN or QNaN operands), Denormal.
Other Exceptions
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions.”
EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions.”
Additionally:
#UD
If VEX.vvvv != 1111B or EVEX.vvvv != 1111B.
3-214
Vol. 2A
COMISD-Compare Scalar Ordered Double Precision Floating-Point Values and Set EFLAGS
INSTRUCTION SET REFERENCE, A-L
COMISS-Compare Scalar Ordered Single Precision Floating-Point Values and Set EFLAGS
Opcode/
Op /
64/32 bit
CPUID
Description
Instruction
En
Mode
Feature
Support
Flag
NP 0F 2F /r
A
V/V
SSE
Compare low single precision floating-point values in
COMISS xmm1, xmm2/m32
xmm1 and xmm2/mem32 and set the EFLAGS flags
accordingly.
VEX.LIG.0F.WIG 2F /r
A
V/V
AVX
Compare low single precision floating-point values in
VCOMISS xmm1, xmm2/m32
xmm1 and xmm2/mem32 and set the EFLAGS flags
accordingly.
EVEX.LLIG.0F.W0 2F /r
B
V/V
AVX512F
Compare low single precision floating-point values in
VCOMISS xmm1, xmm2/m32{sae}
xmm1 and xmm2/mem32 and set the EFLAGS flags
accordingly.
Instruction Operand Encoding
Op/En
Tuple Type
Operand 1
Operand 2
Operand 3
Operand 4
A
N/A
ModRM:reg (w)
ModRM:r/m (r)
N/A
N/A
B
Tuple1 Scalar
ModRM:reg (w)
ModRM:r/m (r)
N/A
N/A
Description
Compares the single precision floating-point values in the low quadwords of operand 1 (first operand) and operand
2 (second operand), and sets the ZF, PF, and CF flags in the EFLAGS register according to the result (unordered,
greater than, less than, or equal). The OF, SF, and AF flags in the EFLAGS register are set to 0. The unordered result
is returned if either source operand is a NaN (QNaN or SNaN).
Operand 1 is an XMM register; operand 2 can be an XMM register or a 32 bit memory location.
The COMISS instruction differs from the UCOMISS instruction in that it signals a SIMD floating-point invalid opera-
tion exception (#I) when a source operand is either a QNaN or SNaN. The UCOMISS instruction signals an invalid
operation exception only if a source operand is an SNaN.
The EFLAGS register is not updated if an unmasked SIMD floating-point exception is generated.
VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD.
Software should ensure VCOMISS is encoded with VEX.L=0. Encoding VCOMISS with VEX.L=1 may encounter
unpredictable behavior across different processor generations.
Operation
COMISS (All Versions)
RESULT :=OrderedCompare(DEST[31:0] <> SRC[31:0]) {
(* Set EFLAGS *) CASE (RESULT) OF
UNORDERED: ZF,PF,CF := 111;
GREATER_THAN: ZF,PF,CF := 000;
LESS_THAN: ZF,PF,CF := 001;
EQUAL: ZF,PF,CF := 100;
ESAC;
OF, AF, SF := 0; }
COMISS-Compare Scalar Ordered Single Precision Floating-Point Values and Set EFLAGS
Vol. 2A
3-215
INSTRUCTION SET REFERENCE, A-L
Intel C/C++ Compiler Intrinsic Equivalent
VCOMISS int _mm_comi_round_ss(__m128 a, __m128 b, int imm, int sae);
VCOMISS int _mm_comieq_ss (__m128 a, __m128 b)
VCOMISS int _mm_comilt_ss (__m128 a, __m128 b)
VCOMISS int _mm_comile_ss (__m128 a, __m128 b)
VCOMISS int _mm_comigt_ss (__m128 a, __m128 b)
VCOMISS int _mm_comige_ss (__m128 a, __m128 b)
VCOMISS int _mm_comineq_ss (__m128 a, __m128 b)
SIMD Floating-Point Exceptions
Invalid (if SNaN or QNaN operands), Denormal.
Other Exceptions
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions.”
EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions.”
Additionally:
#UD
If VEX.vvvv != 1111B or EVEX.vvvv != 1111B.
3-216
Vol. 2A
COMISS-Compare Scalar Ordered Single Precision Floating-Point Values and Set EFLAGS
INSTRUCTION SET REFERENCE, A-L
CPUID-CPU Identification
Opcode
Instruction
Op/
64-Bit
Compat/
Description
En
Mode
Leg Mode
0F A2
CPUID
ZO
Valid
Valid
Returns processor identification and feature
information to the EAX, EBX, ECX, and EDX
registers, as determined by input entered in
EAX (in some cases, ECX as well).
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
ZO
N/A
N/A
N/A
N/A
Description
The ID flag (bit 21) in the EFLAGS register indicates support for the CPUID instruction. If a software procedure can
set and clear this flag, the processor executing the procedure supports the CPUID instruction. This instruction
operates the same in non-64-bit modes and 64-bit mode.
CPUID returns processor identification and feature information in the EAX, EBX, ECX, and EDX registers.1 The
instruction’s output is dependent on the contents of the EAX register upon execution (in some cases, ECX as well).
For example, the following pseudocode loads EAX with 00H and causes CPUID to return a Maximum Return Value
and the Vendor Identification String in the appropriate registers:
MOV EAX, 00H
CPUID
Table 3-8 shows information returned, depending on the initial value loaded into the EAX register.
Two types of information are returned: basic and extended function information. If a value entered for CPUID.EAX
is higher than the maximum input value for basic or extended function for that processor then the data for the
highest basic information leaf is returned. For example, using some Intel processors, the following is true:
CPUID.EAX = 05H (* Returns MONITOR/MWAIT leaf. *)
CPUID.EAX = 0AH (* Returns Architectural Performance Monitoring leaf. *)
CPUID.EAX = 0BH (* Returns Extended Topology Enumeration leaf. *)2
CPUID.EAX =1FH (* Returns V2 Extended Topology Enumeration leaf. *)2
CPUID.EAX = 80000008H (* Returns linear/physical address size data. *)
CPUID.EAX = 8000000AH (* INVALID: Returns same information as CPUID.EAX = 0BH. *)
If a value entered for CPUID.EAX is less than or equal to the maximum input value and the leaf is not supported on
that processor then 0 is returned in all the registers.
When CPUID returns the highest basic leaf information as a result of an invalid input EAX value, any dependence
on input ECX value in the basic leaf is honored.
CPUID can be executed at any privilege level to serialize instruction execution. Serializing instruction execution
guarantees that any modifications to flags, registers, and memory for previous instructions are completed before
the next instruction is fetched and executed.
See also:
“Serializing Instructions” in Chapter 9, “Multiple-Processor Management,” in the Intel® 64 and IA-32 Architectures
Software Developer’s Manual, Volume 3A.
“Caching Translation Information” in Chapter 4, “Paging,” in the Intel® 64 and IA-32 Architectures Software Devel-
oper’s Manual, Volume 3A.
1. On Intel 64 processors, CPUID clears the high 32 bits of the RAX/RBX/RCX/RDX registers in all modes.
2. CPUID leaf 1FH is a preferred superset to leaf 0BH. Intel recommends first checking for the existence of CPUID leaf 1FH before
using leaf 0BH.
CPUID-CPU Identification
Vol. 2A
3-217
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction
Initial EAX
Value
Information Provided about the Processor
Basic CPUID Information
0H
EAX
Maximum Input Value for Basic CPUID Information.
EBX
“Genu”
ECX
“ntel”
EDX
“ineI”
01H
EAX
Version Information: Type, Family, Model, and Stepping ID (see Figure 3-6).
EBX
Bits 07-00: Brand Index.
Bits 15-08: CLFLUSH line size (Value ∗ 8 = cache line size in bytes; used also by CLFLUSHOPT).
Bits 23-16: Maximum number of addressable IDs for logical processors in this physical package*.
Bits 31-24: Initial APIC ID**.
ECX
Feature Information (see Figure 3-7 and Table 3-10).
EDX
Feature Information (see Figure 3-8 and Table 3-11).
NOTES:
* The nearest power-of-2 integer that is not smaller than EBX[23:16] is the number of unique initial APIC
IDs reserved for addressing different logical processors in a physical package. This field is only valid if
CPUID.1.EDX.HTT[bit 28]= 1.
** The 8-bit initial APIC ID in EBX[31:24] is replaced by the 32-bit x2APIC ID, available in Leaf 0BH and
Leaf 1FH.
02H
EAX
Cache and TLB Information (see Table 3-12).
EBX
Cache and TLB Information.
ECX
Cache and TLB Information.
EDX
Cache and TLB Information.
03H
EAX
Reserved.
EBX
Reserved.
ECX
Bits 00-31 of 96-bit processor serial number. (Available in Pentium III processor only; otherwise, the
value in this register is reserved.)
EDX
Bits 32-63 of 96-bit processor serial number. (Available in Pentium III processor only; otherwise, the
value in this register is reserved.)
NOTES:
Processor serial number (PSN) is not supported in the Pentium 4 processor or later. On all models, use
the PSN flag (returned using CPUID) to check for PSN support before accessing the feature.
CPUID leaves above 2 and below 80000000H are visible only when IA32_MISC_ENABLE[bit 22] has its default value of 0.
Deterministic Cache Parameters Leaf (Initial EAX Value = 04H)
04H
NOTES:
Leaf 04H output depends on the initial value in ECX.*
See also: “INPUT EAX = 04H: Returns Deterministic Cache Parameters for Each Level” on page 250.
EAX
Bits 04-00: Cache Type Field.
0 = Null - No more caches.
1 = Data Cache.
2 = Instruction Cache.
3 = Unified Cache.
4-31 = Reserved.
3-218
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
Bits 07-05: Cache Level (starts at 1).
Bit 08: Self Initializing cache level (does not need SW initialization).
Bit 09: Fully Associative cache.
Bits 13-10: Reserved.
Bits 25-14: Maximum number of addressable IDs for logical processors sharing this cache**, ***.
Bits 31-26: Maximum number of addressable IDs for processor cores in the physical
package**, ****, *****.
EBX
Bits 11-00: L = System Coherency Line Size**.
Bits 21-12: P = Physical Line partitions**.
Bits 31-22: W = Ways of associativity**.
ECX
Bits 31-00: S = Number of Sets**.
EDX
Bit 00: Write-Back Invalidate/Invalidate.
0 = WBINVD/INVD from threads sharing this cache acts upon lower level caches for threads sharing this
cache.
1 = WBINVD/INVD is not guaranteed to act upon lower level caches of non-originating threads sharing
this cache.
Bit 01: Cache Inclusiveness.
0 = Cache is not inclusive of lower cache levels.
1 = Cache is inclusive of lower cache levels.
Bit 02: Complex Cache Indexing.
0 = Direct mapped cache.
1 = A complex function is used to index the cache, potentially using all address bits.
Bits 31-03: Reserved = 0.
NOTES:
* If ECX contains an invalid sub leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf index n+1 is invalid if sub-
leaf n returns EAX[4:0] as 0.
** Add one to the return value to get the result.
***The nearest power-of-2 integer that is not smaller than (1 + EAX[25:14]) is the number of unique ini-
tial APIC IDs reserved for addressing different logical processors sharing this cache.
**** The nearest power-of-2 integer that is not smaller than (1 + EAX[31:26]) is the number of unique
Core_IDs reserved for addressing different processor cores in a physical package. Core ID is a subset of
bits of the initial APIC ID.
***** The returned value is constant for valid initial values in ECX. Valid ECX values start from 0.
MONITOR/MWAIT Leaf (Initial EAX Value = 05H)
05H
EAX
Bits 15-00: Smallest monitor-line size in bytes (default is processor's monitor granularity).
Bits 31-16: Reserved = 0.
EBX
Bits 15-00: Largest monitor-line size in bytes (default is processor's monitor granularity).
Bits 31-16: Reserved = 0.
ECX
Bit 00: Enumeration of Monitor-Mwait extensions (beyond EAX and EBX registers) supported.
Bit 01: Supports treating interrupts as break-event for MWAIT, even when interrupts disabled.
Bits 31-02: Reserved.
EDX
Bits 03-00: Number of C0* sub C-states supported using MWAIT.
Bits 07-04: Number of C1* sub C-states supported using MWAIT.
Bits 11-08: Number of C2* sub C-states supported using MWAIT.
Bits 15-12: Number of C3* sub C-states supported using MWAIT.
Bits 19-16: Number of C4* sub C-states supported using MWAIT.
Bits 23-20: Number of C5* sub C-states supported using MWAIT.
Bits 27-24: Number of C6* sub C-states supported using MWAIT.
Bits 31-28: Number of C7* sub C-states supported using MWAIT.
CPUID-CPU Identification
Vol. 2A
3-219
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
NOTE:
* The definition of C0 through C7 states for MWAIT extension are processor-specific C-states, not ACPI C-
states.
Thermal and Power Management Leaf (Initial EAX Value = 06H)
06H
EAX
Bit 00: Digital temperature sensor is supported if set.
Bit 01: Intel Turbo Boost Technology available (see description of IA32_MISC_ENABLE[38]).
Bit 02: ARAT. APIC-Timer-always-running feature is supported if set.
Bit 03: Reserved.
Bit 04: PLN. Power limit notification controls are supported if set.
Bit 05: ECMD. Clock modulation duty cycle extension is supported if set.
Bit 06: PTM. Package thermal management is supported if set.
Bit 07: HWP. HWP base registers (IA32_PM_ENABLE[bit 0], IA32_HWP_CAPABILITIES,
IA32_HWP_REQUEST, IA32_HWP_STATUS) are supported if set.
Bit 08: HWP_Notification. IA32_HWP_INTERRUPT MSR is supported if set.
Bit 09: HWP_Activity_Window. IA32_HWP_REQUEST[bits 41:32] is supported if set.
Bit 10: HWP_Energy_Performance_Preference. IA32_HWP_REQUEST[bits 31:24] is supported if set.
Bit 11: HWP_Package_Level_Request. IA32_HWP_REQUEST_PKG MSR is supported if set.
Bit 12: Reserved.
Bit 13: HDC. HDC base registers IA32_PKG_HDC_CTL, IA32_PM_CTL1, IA32_THREAD_STALL MSRs are
supported if set.
Bit 14: Intel® Turbo Boost Max Technology 3.0 available.
Bit 15: HWP Capabilities. Highest Performance change is supported if set.
Bit 16: HWP PECI override is supported if set.
Bit 17: Flexible HWP is supported if set.
Bit 18: Fast access mode for the IA32_HWP_REQUEST MSR is supported if set.
Bit 19: HW_FEEDBACK. IA32_HW_FEEDBACK_PTR MSR, IA32_HW_FEEDBACK_CONFIG MSR,
IA32_PACKAGE_THERM_STATUS MSR bit 26, and IA32_PACKAGE_THERM_INTERRUPT MSR bit 25 are
supported if set.
Bit 20: Ignoring Idle Logical Processor HWP request is supported if set.
Bits 22-21: Reserved.
Bit 23: Intel® Thread Director supported if set. IA32_HW_FEEDBACK_CHAR and
IA32_HW_FEEDBACK_THREAD_CONFIG MSRs are supported if set.
Bit 24: IA32_THERM_INTERRUPT MSR bit 25 is supported if set.
Bits 31-25: Reserved.
EBX
Bits 03-00: Number of Interrupt Thresholds in Digital Thermal Sensor.
Bits 31-04: Reserved.
ECX
Bit 00: Hardware Coordination Feedback Capability (Presence of IA32_MPERF and IA32_APERF). The
capability to provide a measure of delivered processor performance (since last reset of the counters), as
a percentage of the expected processor performance when running at the TSC frequency.
Bits 02-01: Reserved = 0.
Bit 03: The processor supports performance-energy bias preference if CPUID.06H:ECX.SETBH[bit 3] is set
and it also implies the presence of a new architectural MSR called IA32_ENERGY_PERF_BIAS (1B0H).
Bits 07-04: Reserved = 0.
Bits 15-08: Number of Intel® Thread Director classes supported by the processor. Information for that
many classes is written into the Intel Thread Director Table by the hardware.
Bits 31-16: Reserved = 0.
3-220
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
EDX
Bits 07-00: Bitmap of supported hardware feedback interface capabilities.
0 = When set to 1, indicates support for performance capability reporting.
1 = When set to 1, indicates support for energy efficiency capability reporting.
2-7 = Reserved
Bits 11-08: Enumerates the size of the hardware feedback interface structure in number of 4 KB pages;
add one to the return value to get the result.
Bits 31-16: Index (starting at 0) of this logical processor's row in the hardware feedback interface struc-
ture. Note that on some parts the index may be same for multiple logical processors. On some parts the
indices may not be contiguous, i.e., there may be unused rows in the hardware feedback interface struc-
ture.
NOTE:
Bits 0 and 1 will always be set together.
Structured Extended Feature Flags Enumeration Leaf (Initial EAX Value = 07H, ECX = 0)
07H
EAX
Bits 31-00: Reports the maximum input value for supported leaf 7 sub-leaves.
EBX
Bit 00: FSGSBASE. Supports RDFSBASE/RDGSBASE/WRFSBASE/WRGSBASE if 1.
Bit 01: IA32_TSC_ADJUST MSR is supported if 1.
Bit 02: SGX. Supports Intel® Software Guard Extensions (Intel® SGX Extensions) if 1.
Bit 03: BMI1.
Bit 04: HLE.
Bit 05: AVX2. Supports Intel® Advanced Vector Extensions 2 (Intel® AVX2) if 1.
Bit 06: FDP_EXCPTN_ONLY. x87 FPU Data Pointer updated only on x87 exceptions if 1.
Bit 07: SMEP. Supports Supervisor-Mode Execution Prevention if 1.
Bit 08: BMI2.
Bit 09: Supports Enhanced REP MOVSB/STOSB if 1.
Bit 10: INVPCID. If 1, supports INVPCID instruction for system software that manages process-context
identifiers.
Bit 11: RTM.
Bit 12: RDT-M. Supports Intel® Resource Director Technology (Intel® RDT) Monitoring capability if 1.
Bit 13: Deprecates FPU CS and FPU DS values if 1.
Bit 14: MPX. Supports Intel® Memory Protection Extensions if 1.
Bit 15: RDT-A. Supports Intel® Resource Director Technology (Intel® RDT) Allocation capability if 1.
Bit 16: AVX512F.
Bit 17: AVX512DQ.
Bit 18: RDSEED.
Bit 19: ADX.
Bit 20: SMAP. Supports Supervisor-Mode Access Prevention (and the CLAC/STAC instructions) if 1.
Bit 21: AVX512_IFMA.
Bit 22: Reserved.
Bit 23: CLFLUSHOPT.
Bit 24: CLWB.
Bit 25: Intel Processor Trace.
Bit 26: AVX512PF. (Intel® Xeon Phi™ only.)
Bit 27: AVX512ER. (Intel® Xeon Phi™ only.)
Bit 28: AVX512CD.
Bit 29: SHA. supports Intel® Secure Hash Algorithm Extensions (Intel® SHA Extensions) if 1.
Bit 30: AVX512BW.
Bit 31: AVX512VL.
CPUID-CPU Identification
Vol. 2A
3-221
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
ECX
Bit 00: PREFETCHWT1. (Intel® Xeon Phi™ only.)
Bit 01: AVX512_VBMI.
Bit 02: UMIP. Supports user-mode instruction prevention if 1.
Bit 03: PKU. Supports protection keys for user-mode pages if 1.
Bit 04: OSPKE. If 1, OS has set CR4.PKE to enable protection keys (and the RDPKRU/WRPKRU instruc-
tions).
Bit 05: WAITPKG.
Bit 06: AVX512_VBMI2.
Bit 07: CET_SS. Supports CET shadow stack features if 1. Processors that set this bit define bits 1:0 of the
IA32_U_CET and IA32_S_CET MSRs. Enumerates support for the following MSRs:
IA32_INTERRUPT_SPP_TABLE_ADDR, IA32_PL3_SSP, IA32_PL2_SSP, IA32_PL1_SSP, and
IA32_PL0_SSP.
Bit 08: GFNI.
Bit 09: VAES.
Bit 10: VPCLMULQDQ.
Bit 11: AVX512_VNNI.
Bit 12: AVX512_BITALG.
Bits 13: TME_EN. If 1, the following MSRs are supported: IA32_TME_CAPABILITY, IA32_TME_ACTIVATE,
IA32_TME_EXCLUDE_MASK, and IA32_TME_EXCLUDE_BASE.
Bit 14: AVX512_VPOPCNTDQ.
Bit 15: Reserved.
Bit 16: LA57. Supports 57-bit linear addresses and five-level paging if 1.
Bits 21-17: The value of MAWAU used by the BNDLDX and BNDSTX instructions in 64-bit mode.
Bit 22: RDPID and IA32_TSC_AUX are available if 1.
Bit 23: KL. Supports Key Locker if 1.
Bit 24: BUS_LOCK_DETECT. If 1, indicates support for OS bus-lock detection.
Bit 25: CLDEMOTE. Supports cache line demote if 1.
Bit 26: Reserved.
Bit 27: MOVDIRI. Supports MOVDIRI if 1.
Bit 28: MOVDIR64B. Supports MOVDIR64B if 1.
Bit 29: ENQCMD. Supports Enqueue Stores if 1.
Bit 30: SGX_LC. Supports SGX Launch Configuration if 1.
Bit 31: PKS. Supports protection keys for supervisor-mode pages if 1.
EDX
Bit 00: Reserved.
Bit 01: SGX-KEYS. If 1, Attestation Services for Intel® SGX is supported.
Bit 02: AVX512_4VNNIW. (Intel® Xeon Phi™ only.)
Bit 03: AVX512_4FMAPS. (Intel® Xeon Phi™ only.)
Bit 04: Fast Short REP MOV.
Bit 05: UINTR. If 1, the processor supports user interrupts.
Bits 07-06: Reserved.
Bit 08: AVX512_VP2INTERSECT.
Bit 09: SRBDS_CTRL. If 1, enumerates support for the IA32_MCU_OPT_CTRL MSR and indicates its bit 0
(RNGDS_MITG_DIS) is also supported.
Bit 10: MD_CLEAR supported.
Bit 11: RTM_ALWAYS_ABORT. If set, any execution of XBEGIN immediately aborts and transitions to the
specified fallback address.
Bit 12: Reserved.
Bit 13: If 1, RTM_FORCE_ABORT supported. Processors that set this bit support the
IA32_TSX_FORCE_ABORT MSR. They allow software to set IA32_TSX_FORCE_ABORT[0]
(RTM_FORCE_ABORT).
Bit 14: SERIALIZE.
Bit 15: Hybrid. If 1, the processor is identified as a hybrid part. If CPUID.0.MAXLEAF ≥ 1AH and
CPUID.1A.EAX ≠ 0, then the Native Model ID Enumeration Leaf 1AH exists.
Bit 16: TSXLDTRK. If 1, the processor supports Intel TSX suspend/resume of load address tracking.
3-222
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
Bit 17: Reserved.
Bit 18: PCONFIG. Supports PCONFIG if 1.
Bit 19: Architectural LBRs. If 1, indicates support for architectural LBRs.
Bit 20: CET_IBT. Supports CET indirect branch tracking features if 1. Processors that set this bit define
bits 5:2 and bits 63:10 of the IA32_U_CET and IA32_S_CET MSRs.
Bit 21: Reserved.
Bit 22: AMX-BF16. If 1, the processor supports tile computational operations on bfloat16 numbers.
Bit 23: AVX512_FP16.
Bit 24: AMX-TILE. If 1, the processor supports tile architecture.
Bits 25: AMX-INT8. If 1, the processor supports tile computational operations on 8-bit integers.
Bit 26: Enumerates support for indirect branch restricted speculation (IBRS) and the indirect branch pre-
dictor barrier (IBPB). Processors that set this bit support the IA32_SPEC_CTRL MSR and the
IA32_PRED_CMD MSR. They allow software to set IA32_SPEC_CTRL[0] (IBRS) and IA32_PRED_CMD[0]
(IBPB).
Bit 27: Enumerates support for single thread indirect branch predictors (STIBP). Processors that set this
bit support the IA32_SPEC_CTRL MSR. They allow software to set IA32_SPEC_CTRL[1] (STIBP).
Bit 28: Enumerates support for L1D_FLUSH. Processors that set this bit support the IA32_FLUSH_CMD
MSR. They allow software to set IA32_FLUSH_CMD[0] (L1D_FLUSH).
Bit 29: Enumerates support for the IA32_ARCH_CAPABILITIES MSR.
Bit 30: Enumerates support for the IA32_CORE_CAPABILITIES MSR.
IA32_CORE_CAPABILITIES is an architectural MSR that enumerates model-specific features. A bit being
set in this MSR indicates that a model specific feature is supported; software must still consult CPUID
family/model/stepping to determine the behavior of the enumerated feature as features enumerated in
IA32_CORE_CAPABILITIES may have different behavior on different processor models. Some of these
features may have behavior that is consistent across processor models (and for which consultation of
CPUID family/model/stepping is not necessary); such features are identified explicitly where they are
documented in this manual.
Bit 31: Enumerates support for Speculative Store Bypass Disable (SSBD). Processors that set this bit sup-
port the IA32_SPEC_CTRL MSR. They allow software to set IA32_SPEC_CTRL[2] (SSBD).
NOTE:
* If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf index n is invalid if n
exceeds the value that sub-leaf 0 returns in EAX.
Structured Extended Feature Enumeration Sub-leaf (Initial EAX Value = 07H, ECX = 1)
07H
NOTES:
Leaf 07H output depends on the initial value in ECX.
If ECX contains an invalid sub leaf index, EAX/EBX/ECX/EDX return 0.
EAX
This field reports 0 if the sub-leaf index, 1, is invalid.
Bits 03-00: Reserved.
Bit 04: AVX-VNNI. AVX (VEX-encoded) versions of the Vector Neural Network Instructions.
Bit 05: AVX512_BF16. Vector Neural Network Instructions supporting BFLOAT16 inputs and conversion
instructions from IEEE single precision.
Bits 09-06: Reserved.
Bit 10: If 1, supports fast zero-length REP MOVSB.
Bit 11: If 1, supports fast short REP STOSB.
Bit 12: If 1, supports fast short REP CMPSB, REP SCASB.
Bits 21-13: Reserved.
Bit 22: HRESET. If 1, supports history reset via the HRESET instruction and the IA32_HRESET_ENABLE
MSR. When set, indicates that the Processor History Reset Leaf (EAX = 20H) is valid.
Bits 31-23: Reserved.
CPUID-CPU Identification
Vol. 2A
3-223
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
EBX
This field reports 0 if the sub-leaf index, 1, is invalid.
Bit 00: Enumerates the presence of the IA32_PPIN and IA32_PPIN_CTL MSRs. If 1, these MSRs are sup-
ported.
Bits 31-01: Reserved.
ECX
This field reports 0 if the sub-leaf index, 1, is invalid; otherwise it is reserved.
EDX
This field reports 0 if the sub-leaf index, 1, is invalid.
Bits 17-00: Reserved.
Bit 18: CET_SSS. If 1, indicates that an operating system can enable supervisor shadow stacks as long as
it ensures that a supervisor shadow stack cannot become prematurely busy due to page faults (see Sec-
tion 17.2.3 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1). When
emulating the CPUID instruction, a virtual-machine monitor (VMM) should return this bit as 1 only if it
ensures that VM exits cannot cause a guest supervisor shadow stack to appear to be prematurely busy.
Such a VMM could set the “prematurely busy shadow stack” VM-exit control and use the additional infor-
mation that it provides.
Bits 31-19: Reserved.
Structured Extended Feature Enumeration Sub-leaf (Initial EAX Value = 07H, ECX = 2)
07H
NOTES:
Leaf 07H output depends on the initial value in ECX.
If ECX contains an invalid sub leaf index, EAX/EBX/ECX/EDX return 0.
EAX
This field reports 0 if the sub-leaf index, 2, is invalid; otherwise it is reserved.
EBX
This field reports 0 if the sub-leaf index, 2, is invalid; otherwise it is reserved.
ECX
This field reports 0 if the sub-leaf index, 2, is invalid; otherwise it is reserved.
EDX
This field reports 0 if the sub-leaf index, 2, is invalid.
Bit 00: PSFD. If 1, indicates bit 7 of the IA32_SPEC_CTRL MSR is supported. Bit 7 of this MSR disables
Fast Store Forwarding Predictor without disabling Speculative Store Bypass.
Bit 01: IPRED_CTRL. If 1, indicates bits 3 and 4 of the IA32_SPEC_CTRL MSR are supported. Bit 3 of this
MSR enables IPRED_DIS control for CPL3. Bit 4 of this MSR enables IPRED_DIS control for CPL0/1/2.
Bit 02: RRSBA_CTRL. If 1, indicates bits 5 and 6 of the IA32_SPEC_CTRL MSR are supported. Bit 5 of this
MSR disables RRSBA behavior for CPL3. Bit 6 of this MSR disables RRSBA behavior for CPL0/1/2.
Bit 03: DDPD_U. If 1, indicates bit 8 of the IA32_SPEC_CTRL MSR is supported. Bit 8 of this MSR disables
Data Dependent Prefetcher.
Bit 04: BHI_CTRL. If 1, indicates bit 10 of the IA32_SPEC_CTRL MSR is supported. Bit 10 of this MSR
enables BHI_DIS_S behavior.
Bit 05: MCDT_NO. Processors that enumerate this bit as 1 do not exhibit MXCSR Configuration Depen-
dent Timing (MCDT) behavior and do not need to be mitigated to avoid data-dependent behavior for cer-
tain instructions.
Bits 31-06: Reserved.
Direct Cache Access Information Leaf (Initial EAX Value = 09H)
09H
EAX
Value of bits [31:0] of IA32_PLATFORM_DCA_CAP MSR (address 1F8H).
EBX
Reserved.
ECX
Reserved.
EDX
Reserved.
3-224
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
Architectural Performance Monitoring Leaf (Initial EAX Value = 0AH)
0AH
EAX
Bits 07-00: Version ID of architectural performance monitoring.
Bits 15-08: Number of general-purpose performance monitoring counter per logical processor.
Bits 23-16: Bit width of general-purpose, performance monitoring counter.
Bits 31-24: Length of EBX bit vector to enumerate architectural performance monitoring events. Archi-
tectural event x is supported if EBX[x]=0 && EAX[31:24]>x.
EBX
Bit 00: Core cycle event not available if 1 or if EAX[31:24]<1.
Bit 01: Instruction retired event not available if 1 or if EAX[31:24]<2.
Bit 02: Reference cycles event not available if 1 or if EAX[31:24]<3.
Bit 03: Last-level cache reference event not available if 1 or if EAX[31:24]<4.
Bit 04: Last-level cache misses event not available if 1 or if EAX[31:24]<5.
Bit 05: Branch instruction retired event not available if 1 or if EAX[31:24]<6.
Bit 06: Branch mispredict retired event not available if 1 or if EAX[31:24]<7.
Bit 07: Top-down slots event not available if 1 or if EAX[31:24]<8.
Bits 31-08: Reserved = 0.
ECX
Bits 31-00: Supported fixed counters bit mask. Fixed-function performance counter 'i' is supported if bit ‘i’
is 1 (first counter index starts at zero). It is recommended to use the following logic to determine if a
Fixed Counter is supported: FxCtr[i]_is_supported := ECX[i] || (EDX[4:0] > i);
EDX
Bits 04-00: Number of contiguous fixed-function performance counters starting from 0 (if Version ID >
1).
Bits 12-05: Bit width of fixed-function performance counters (if Version ID > 1).
Bits 14-13: Reserved = 0.
Bit 15: AnyThread deprecation.
Bits 31-16: Reserved = 0.
Extended Topology Enumeration Leaf (Initial EAX Value = 0BH)
0BH
NOTES:
CPUID leaf 1FH is a preferred superset to leaf 0BH. Intel recommends first checking for the existence
of Leaf 1FH before using leaf 0BH.
The sub-leaves of CPUID leaf 0BH describe an ordered hierarchy of logical processors starting from the
smallest-scoped domain of a Logical Processor (sub-leaf index 0) to the Core domain (sub-leaf index 1)
to the largest-scoped domain (the last valid sub-leaf index) that is implicitly subordinate to the
unenumerated highest-scoped domain of the processor package (socket).
The details of each valid domain is enumerated by a corresponding sub-leaf. Details for a domain
include its type and how all instances of that domain determine the number of logical processors and
x2 APIC ID partitioning at the next higher-scoped domain. The ordering of domains within the hierarchy
is fixed architecturally as shown below. For a given processor, not all domains may be relevant or
enumerated; however, the logical processor and core domains are always enumerated.
For two valid sub-leaves N and N+1, sub-leaf N+1 represents the next immediate higher-scoped
domain with respect to the domain of sub-leaf N for the given processor.
If sub-leaf index “N” returns an invalid domain type in ECX[15:08] (00H), then all sub-leaves with an
index greater than “N” shall also return an invalid domain type. A sub-leaf returning an invalid domain
always returns 0 in EAX and EBX.
EAX
Bits 04-00: The number of bits that the x2APIC ID must be shifted to the right to address instances of
the next higher-scoped domain. When logical processor is not supported by the processor, the value of
this field at the Logical Processor domain sub-leaf may be returned as either 0 (no allocated bits in the
x2APIC ID) or 1 (one allocated bit in the x2APIC ID); software should plan accordingly.
Bits 31-05: Reserved.
CPUID-CPU Identification
Vol. 2A
3-225
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
EBX
Bits 15-00: The number of logical processors across all instances of this domain within the next higher-
scoped domain. (For example, in a processor socket/package comprising “M” dies of “N” cores each, where
each core has “L” logical processors, the “die” domain sub-leaf value of this field would be M*N*L.) This
number reflects configuration as shipped by Intel. Note, software must not use this field to enumerate
processor topology*.
Bits 31-16: Reserved.
ECX
Bits 07-00: The input ECX sub-leaf index.
Bits 15-08: Domain Type. This field provides an identification value which indicates the domain as shown
below. Although domains are ordered, their assigned identification values are not and software should
not depend on it.
Hierarchy
Domain
Domain Type Identification Value
Lowest
Logical Processor
1
Highest
Core
2
(Note that enumeration values of 0 and 3-255 are reserved.)
Bits 31-16: Reserved.
EDX
Bits 31-00: x2APIC ID of the current logical processor.
NOTES:
* Software must not use the value of EBX[15:0] to enumerate processor topology of the system. The
value is only intended for display and diagnostic purposes. The actual number of logical processors avail-
able to BIOS/OS/Applications may be different from the value of EBX[15:0], depending on software and
platform hardware configurations.
Processor Extended State Enumeration Main Leaf (Initial EAX Value = 0DH, ECX = 0)
0DH
NOTES:
Leaf 0DH main leaf (ECX = 0).
EAX
Bits 31-00: Reports the supported bits of the lower 32 bits of XCR0. XCR0[n] can be set to 1 only if
EAX[n] is 1.
Bit 00: x87 state.
Bit 01: SSE state.
Bit 02: AVX state.
Bits 04-03: MPX state.
Bits 07-05: AVX-512 state.
Bit 08: Used for IA32_XSS.
Bit 09: PKRU state.
Bits 16-10: Used for IA32_XSS.
Bit 17: TILECFG state.
Bit 18: TILEDATA state.
Bits 31-19: Reserved.
EBX
Bits 31-00: Maximum size (bytes, from the beginning of the XSAVE/XRSTOR save area) required by
enabled features in XCR0. May be different than ECX if some features at the end of the XSAVE save area
are not enabled.
ECX
Bit 31-00: Maximum size (bytes, from the beginning of the XSAVE/XRSTOR save area) of the
XSAVE/XRSTOR save area required by all supported features in the processor, i.e., all the valid bit fields in
XCR0.
EDX
Bit 31-00: Reports the supported bits of the upper 32 bits of XCR0. XCR0[n+32] can be set to 1 only if
EDX[n] is 1.
Bits 31-00: Reserved.
3-226
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
Processor Extended State Enumeration Sub-leaf (Initial EAX Value = 0DH, ECX = 1)
0DH
EAX
Bit 00: XSAVEOPT is available.
Bit 01: Supports XSAVEC and the compacted form of XRSTOR if set.
Bit 02: Supports XGETBV with ECX = 1 if set.
Bit 03: Supports XSAVES/XRSTORS and IA32_XSS if set.
Bit 04: Supports extended feature disable (XFD) if set.
Bits 31-05: Reserved.
EBX
Bits 31-00: The size in bytes of the XSAVE area containing all states enabled by XCRO | IA32_XSS.
NOTES:
If EAX[3] is enumerated as 0 and EAX[1] is enumerated as 1, EBX enumerates the size of the XSAVE area
containing all states enabled by XCRO. If EAX[1] and EAX[3] are both enumerated as 0, EBX enumerates
zero.
ECX
Bits 31-00: Reports the supported bits of the lower 32 bits of the IA32_XSS MSR. IA32_XSS[n] can be
set to 1 only if ECX[n] is 1.
Bits 07-00: Used for XCR0.
Bit 08: PT state.
Bit 09: Used for XCR0.
Bit 10: PASID state.
Bit 11: CET user state.
Bit 12: CET supervisor state.
Bit 13: HDC state.
Bit 14: UINTR state.
Bit 15: LBR state (only for the architectural LBR feature).
Bit 16: HWP state.
Bits 18-17: Used for XCR0.
Bits 31-19: Reserved.
EDX
Bits 31-00: Reports the supported bits of the upper 32 bits of the IA32_XSS MSR. IA32_XSS[n+32] can
be set to 1 only if EDX[n] is 1.
Bits 31-00: Reserved.
Processor Extended State Enumeration Sub-leaves (Initial EAX Value = 0DH, ECX = n, n > 1)
0DH
NOTES:
Leaf 0DH output depends on the initial value in ECX.
Each sub-leaf index (starting at position 2) is supported if it corresponds to a supported bit in either the
XCR0 register or the IA32_XSS MSR.
* If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf n (0 ≤ n ≤ 31) is invalid
if sub-leaf 0 returns 0 in EAX[n] and sub-leaf 1 returns 0 in ECX[n]. Sub-leaf n (32 ≤ n ≤ 63) is invalid if
sub-leaf 0 returns 0 in EDX[n-32] and sub-leaf 1 returns 0 in EDX[n-32].
EAX
Bits 31-00: The size in bytes (from the offset specified in EBX) of the save area for an extended state
feature associated with a valid sub-leaf index, n.
EBX
Bits 31-00: The offset in bytes of this extended state component’s save area from the beginning of the
XSAVE/XRSTOR area.
This field reports 0 if the sub-leaf index, n, does not map to a valid bit in the XCR0 register*.
ECX
Bit 00 is set if the bit n (corresponding to the sub-leaf index) is supported in the IA32_XSS MSR; it is clear
if bit n is instead supported in XCR0.
Bit 01 is set if, when the compacted format of an XSAVE area is used, this extended state component
located on the next 64-byte boundary following the preceding state component (otherwise, it is located
immediately following the preceding state component).
Bits 31-02 are reserved.
This field reports 0 if the sub-leaf index, n, is invalid*.
CPUID-CPU Identification
Vol. 2A
3-227
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
EDX
This field reports 0 if the sub-leaf index, n, is invalid*; otherwise it is reserved.
Intel® Resource Director Technology (Intel® RDT) Monitoring Enumeration Sub-leaf (Initial EAX Value = 0FH, ECX = 0)
0FH
NOTES:
Leaf 0FH output depends on the initial value in ECX.
Sub-leaf index 0 reports valid resource type starting at bit position 1 of EDX.
EAX
Reserved.
EBX
Bits 31-00: Maximum range (zero-based) of RMID within this physical processor of all types.
ECX
Reserved.
EDX
Bit 00: Reserved.
Bit 01: Supports L3 Cache Intel RDT Monitoring if 1.
Bits 31-02: Reserved.
L3 Cache Intel® RDT Monitoring Capability Enumeration Sub-leaf (Initial EAX Value = 0FH, ECX = 1)
0FH
NOTES:
Leaf 0FH output depends on the initial value in ECX.
EAX
Reserved.
EBX
Bits 31-00: Conversion factor from reported IA32_QM_CTR value to occupancy metric (bytes) and Mem-
ory Bandwidth Monitoring (MBM) metrics.
ECX
Maximum range (zero-based) of RMID of this resource type.
EDX
Bit 00: Supports L3 occupancy monitoring if 1.
Bit 01: Supports L3 Total Bandwidth monitoring if 1.
Bit 02: Supports L3 Local Bandwidth monitoring if 1.
Bits 31-03: Reserved.
Intel® Resource Director Technology (Intel® RDT) Allocation Enumeration Sub-leaf (Initial EAX Value = 10H, ECX = 0)
10H
NOTES:
Leaf 10H output depends on the initial value in ECX.
Sub-leaf index 0 reports valid resource identification (ResID) starting at bit position 1 of EBX.
EAX
Reserved.
EBX
Bit 00: Reserved.
Bit 01: Supports L3 Cache Allocation Technology if 1.
Bit 02: Supports L2 Cache Allocation Technology if 1.
Bit 03: Supports Memory Bandwidth Allocation if 1.
Bits 31-04: Reserved.
ECX
Reserved.
EDX
Reserved.
L3 Cache Allocation Technology Enumeration Sub-leaf (Initial EAX Value = 10H, ECX = ResID =1)
10H
NOTES:
Leaf 10H output depends on the initial value in ECX.
EAX
Bits 04-00: Length of the capacity bit mask for the corresponding ResID. Add one to the return value to
get the result.
Bits 31-05: Reserved.
EBX
Bits 31-00: Bit-granular map of isolation/contention of allocation units.
3-228
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
ECX
Bits 01-00: Reserved.
Bit 02: Code and Data Prioritization Technology supported if 1.
Bits 31-03: Reserved.
EDX
Bits 15-00: Highest COS number supported for this ResID.
Bits 31-16: Reserved.
L2 Cache Allocation Technology Enumeration Sub-leaf (Initial EAX Value = 10H, ECX = ResID =2)
10H
NOTES:
Leaf 10H output depends on the initial value in ECX.
EAX
Bits 04-00: Length of the capacity bit mask for the corresponding ResID. Add one to the return value to
get the result.
Bits 31-05: Reserved.
EBX
Bits 31-00: Bit-granular map of isolation/contention of allocation units.
ECX
Bits 31-00: Reserved.
EDX
Bits 15-00: Highest COS number supported for this ResID.
Bits 31-16: Reserved.
Memory Bandwidth Allocation Enumeration Sub-leaf (Initial EAX Value = 10H, ECX = ResID =3)
10H
NOTES:
Leaf 10H output depends on the initial value in ECX.
EAX
Bits 11-00: Reports the maximum MBA throttling value supported for the corresponding ResID. Add one
to the return value to get the result.
Bits 31-12: Reserved.
EBX
Bits 31-00: Reserved.
ECX
Bits 01-00: Reserved.
Bit 02: Reports whether the response of the delay values is linear.
Bits 31-03: Reserved.
EDX
Bits 15-00: Highest COS number supported for this ResID.
Bits 31-16: Reserved.
Intel® SGX Capability Enumeration Leaf, Sub-leaf 0 (Initial EAX Value = 12H, ECX = 0)
12H
NOTES:
Leaf 12H sub-leaf 0 (ECX = 0) is supported if CPUID.(EAX=07H, ECX=0H):EBX[SGX] = 1.
EAX
Bit 00: SGX1. If 1, Indicates Intel SGX supports the collection of SGX1 leaf functions.
Bit 01: SGX2. If 1, Indicates Intel SGX supports the collection of SGX2 leaf functions.
Bits 04-02: Reserved.
Bit 05: If 1, indicates Intel SGX supports ENCLV instruction leaves EINCVIRTCHILD, EDECVIRTCHILD, and
ESETCONTEXT.
Bit 06: If 1, indicates Intel SGX supports ENCLS instruction leaves ETRACKC, ERDINFO, ELDBC, and ELDUC.
Bit 07: If 1, indicates Intel SGX supports ENCLU instruction leaf EVERIFYREPORT2.
Bits 09-08: Reserved.
Bit 10: If 1, indicates Intel SGX supports ENCLS instruction leaf EUPDATESVN.
Bit 11: If 1, indicates Intel SGX supports ENCLU instruction leaf EDECCSSA.
Bits 31-12: Reserved.
EBX
Bits 31-00: MISCSELECT. Bit vector of supported extended SGX features.
ECX
Bits 31-00: Reserved.
CPUID-CPU Identification
Vol. 2A
3-229
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
EDX
Bits 07-00: MaxEnclaveSize_Not64. The maximum supported enclave size in non-64-bit mode is
2^(EDX[7:0]).
Bits 15-08: MaxEnclaveSize_64. The maximum supported enclave size in 64-bit mode is 2^(EDX[15:8]).
Bits 31-16: Reserved.
Intel SGX Attributes Enumeration Leaf, Sub-leaf 1 (Initial EAX Value = 12H, ECX = 1)
12H
NOTES:
Leaf 12H sub-leaf 1 (ECX = 1) is supported if CPUID.(EAX=07H, ECX=0H):EBX[SGX] = 1.
EAX
Bit 31-00: Reports the valid bits of SECS.ATTRIBUTES[31:0] that software can set with ECREATE.
EBX
Bit 31-00: Reports the valid bits of SECS.ATTRIBUTES[63:32] that software can set with ECREATE.
ECX
Bit 31-00: Reports the valid bits of SECS.ATTRIBUTES[95:64] that software can set with ECREATE.
EDX
Bit 31-00: Reports the valid bits of SECS.ATTRIBUTES[127:96] that software can set with ECREATE.
Intel® SGX EPC Enumeration Leaf, Sub-leaves (Initial EAX Value = 12H, ECX = 2 or higher)
12H
NOTES:
Leaf 12H sub-leaf 2 or higher (ECX >= 2) is supported if CPUID.(EAX=07H, ECX=0H):EBX[SGX] = 1.
For sub-leaves (ECX = 2 or higher), definition of EDX,ECX,EBX,EAX[31:4] depends on the sub-leaf type
listed below.
EAX
Bit 03-00: Sub-leaf Type
0000b: Indicates this sub-leaf is invalid.
0001b: This sub-leaf enumerates an EPC section. EBX:EAX and EDX:ECX provide information on the
Enclave Page Cache (EPC) section.
All other type encodings are reserved.
Type
0000b. This sub-leaf is invalid.
EDX:ECX:EBX:EAX return 0.
Type
0001b. This sub-leaf enumerates an EPC sections with EDX:ECX, EBX:EAX defined as follows.
EAX[11:04]: Reserved (enumerate 0).
EAX[31:12]: Bits 31:12 of the physical address of the base of the EPC section.
EBX[19:00]: Bits 51:32 of the physical address of the base of the EPC section.
EBX[31:20]: Reserved.
ECX[03:00]: EPC section property encoding defined as follows:
If ECX[3:0] = 0000b, then all bits of the EDX:ECX pair are enumerated as 0.
If ECX[3:0] = 0001b, then this section has confidentiality and integrity protection.
If ECX[3:0] = 0010b, then this section has confidentiality protection only.
All other encodings are reserved.
ECX[11:04]: Reserved (enumerate 0).
ECX[31:12]: Bits 31:12 of the size of the corresponding EPC section within the Processor Reserved
Memory.
EDX[19:00]: Bits 51:32 of the size of the corresponding EPC section within the Processor Reserved
Memory.
EDX[31:20]: Reserved.
Intel® Processor Trace Enumeration Main Leaf (Initial EAX Value = 14H, ECX = 0)
14H
NOTES:
Leaf 14H main leaf (ECX = 0).
EAX
Bits 31-00: Reports the maximum sub-leaf supported in leaf 14H.
3-230
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
EBX
Bit 00: If 1, indicates that IA32_RTIT_CTL.CR3Filter can be set to 1, and that IA32_RTIT_CR3_MATCH
MSR can be accessed.
Bit 01: If 1, indicates support of Configurable PSB and Cycle-Accurate Mode.
Bit 02: If 1, indicates support of IP Filtering, TraceStop filtering, and preservation of Intel PT MSRs across
warm reset.
Bit 03: If 1, indicates support of MTC timing packet and suppression of COFI-based packets.
Bit 04: If 1, indicates support of PTWRITE. Writes can set IA32_RTIT_CTL[12] (PTWEn) and
IA32_RTIT_CTL[5] (FUPonPTW), and PTWRITE can generate packets.
Bit 05: If 1, indicates support of Power Event Trace. Writes can set IA32_RTIT_CTL[4] (PwrEvtEn),
enabling Power Event Trace packet generation.
Bit 06: If 1, indicates support for PSB and PMI preservation. Writes can set IA32_RTIT_CTL[56] (InjectPsb-
PmiOnEnable), enabling the processor to set IA32_RTIT_STATUS[7] (PendTopaPMI) and/or IA32_R-
TIT_STATUS[6] (PendPSB) in order to preserve ToPA PMIs and/or PSBs otherwise lost due to Intel PT
disable. Writes can also set PendToPAPMI and PendPSB.
Bit 07: If 1, writes can set IA32_RTIT_CTL[31] (EventEn), enabling Event Trace packet generation.
Bit 08: If 1, writes can set IA32_RTIT_CTL[55] (DisTNT), disabling TNT packet generation.
Bit 31-09: Reserved.
ECX
Bit 00: If 1, Tracing can be enabled with IA32_RTIT_CTL.ToPA = 1, hence utilizing the ToPA output
scheme; IA32_RTIT_OUTPUT_BASE and IA32_RTIT_OUTPUT_MASK_PTRS MSRs can be accessed.
Bit 01: If 1, ToPA tables can hold any number of output entries, up to the maximum allowed by the
MaskOrTableOffset field of IA32_RTIT_OUTPUT_MASK_PTRS.
Bit 02: If 1, indicates support of Single-Range Output scheme.
Bit 03: If 1, indicates support of output to Trace Transport subsystem.
Bit 30-04: Reserved.
Bit 31: If 1, generated packets which contain IP payloads have LIP values, which include the CS base com-
ponent.
EDX
Bits 31-00: Reserved.
Intel® Processor Trace Enumeration Sub-leaf (Initial EAX Value = 14H, ECX = 1)
14H
EAX
Bits 02-00: Number of configurable Address Ranges for filtering.
Bits 15-03: Reserved.
Bits 31-16: Bitmap of supported MTC period encodings.
EBX
Bits 15-00: Bitmap of supported Cycle Threshold value encodings.
Bit 31-16: Bitmap of supported Configurable PSB frequency encodings.
ECX
Bits 31-00: Reserved.
EDX
Bits 31-00: Reserved.
Time Stamp Counter and Nominal Core Crystal Clock Information Leaf (Initial EAX Value = 15H)
15H
NOTES:
If EBX[31:0] is 0, the TSC/”core crystal clock” ratio is not enumerated.
EBX[31:0]/EAX[31:0] indicates the ratio of the TSC frequency and the core crystal clock frequency.
If ECX is 0, the nominal core crystal clock frequency is not enumerated.
“TSC frequency” = “core crystal clock frequency” * EBX/EAX.
The core crystal clock may differ from the reference clock, bus clock, or core clock frequencies.
EAX
Bits 31-00: An unsigned integer which is the denominator of the TSC/”core crystal clock” ratio.
EBX
Bits 31-00: An unsigned integer which is the numerator of the TSC/”core crystal clock” ratio.
ECX
Bits 31-00: An unsigned integer which is the nominal frequency of the core crystal clock in Hz.
EDX
Bits 31-00: Reserved = 0.
CPUID-CPU Identification
Vol. 2A
3-231
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
Processor Frequency Information Leaf (Initial EAX Value = 16H)
16H
EAX
Bits 15-00: Processor Base Frequency (in MHz).
Bits 31-16: Reserved =0.
EBX
Bits 15-00: Maximum Frequency (in MHz).
Bits 31-16: Reserved = 0.
ECX
Bits 15-00: Bus (Reference) Frequency (in MHz).
Bits 31-16: Reserved = 0.
EDX
Reserved.
NOTES:
* Data is returned from this interface in accordance with the processor's specification and does not reflect
actual values. Suitable use of this data includes the display of processor information in like manner to the
processor brand string and for determining the appropriate range to use when displaying processor
information e.g. frequency history graphs. The returned information should not be used for any other
purpose as the returned information does not accurately correlate to information / counters returned by
other processor interfaces.
While a processor may support the Processor Frequency Information leaf, fields that return a value of
zero are not supported.
System-On-Chip Vendor Attribute Enumeration Main Leaf (Initial EAX Value = 17H, ECX = 0)
17H
NOTES:
Leaf 17H main leaf (ECX = 0).
Leaf 17H output depends on the initial value in ECX.
Leaf 17H sub-leaves 1 through 3 reports SOC Vendor Brand String.
Leaf 17H is valid if MaxSOCID_Index >= 3.
Leaf 17H sub-leaves 4 and above are reserved.
EAX
Bits 31-00: MaxSOCID_Index. Reports the maximum input value of supported sub-leaf in leaf 17H.
EBX
Bits 15-00: SOC Vendor ID.
Bit 16: IsVendorScheme. If 1, the SOC Vendor ID field is assigned via an industry standard enumeration
scheme. Otherwise, the SOC Vendor ID field is assigned by Intel.
Bits 31-17: Reserved = 0.
ECX
Bits 31-00: Project ID. A unique number an SOC vendor assigns to its SOC projects.
EDX
Bits 31-00: Stepping ID. A unique number within an SOC project that an SOC vendor assigns.
System-On-Chip Vendor Attribute Enumeration Sub-leaf (Initial EAX Value = 17H, ECX = 1..3)
17H
EAX
Bit 31-00: SOC Vendor Brand String. UTF-8 encoded string.
EBX
Bit 31-00: SOC Vendor Brand String. UTF-8 encoded string.
ECX
Bit 31-00: SOC Vendor Brand String. UTF-8 encoded string.
EDX
Bit 31-00: SOC Vendor Brand String. UTF-8 encoded string.
NOTES:
Leaf 17H output depends on the initial value in ECX.
SOC Vendor Brand String is a UTF-8 encoded string padded with trailing bytes of 00H.
The complete SOC Vendor Brand String is constructed by concatenating in ascending order of
EAX:EBX:ECX:EDX and from the sub-leaf 1 fragment towards sub-leaf 3.
3-232
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
System-On-Chip Vendor Attribute Enumeration Sub-leaves (Initial EAX Value = 17H, ECX > MaxSOCID_Index)
17H
NOTES:
Leaf 17H output depends on the initial value in ECX.
EAX
Bits 31-00: Reserved = 0.
EBX
Bits 31-00: Reserved = 0.
ECX
Bits 31-00: Reserved = 0.
EDX
Bits 31-00: Reserved = 0.
Deterministic Address Translation Parameters Main Leaf (Initial EAX Value = 18H, ECX = 0)
18H
NOTES:
Each sub-leaf enumerates a different address translation structure.
If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf index n is invalid if n
exceeds the value that sub-leaf 0 returns in EAX. A sub-leaf index is also invalid if EDX[4:0] returns 0.
Valid sub-leaves do not need to be contiguous or in any particular order. A valid sub-leaf may be in a
higher input ECX value than an invalid sub-leaf or than a valid sub-leaf of a higher or lower-level struc-
ture.
* Some unified TLBs will allow a single TLB entry to satisfy data read/write and instruction fetches.
Others will require separate entries (e.g., one loaded on data read/write and another loaded on an
instruction fetch). See the Intel® 64 and IA-32 Architectures Optimization Reference Manual for details
of a particular product.
** Add one to the return value to get the result.
EAX
Bits 31-00: Reports the maximum input value of supported sub-leaf in leaf 18H.
EBX
Bit 00: 4K page size entries supported by this structure.
Bit 01: 2MB page size entries supported by this structure.
Bit 02: 4MB page size entries supported by this structure.
Bit 03: 1 GB page size entries supported by this structure.
Bits 07-04: Reserved.
Bits 10-08: Partitioning (0: Soft partitioning between the logical processors sharing this structure).
Bits 15-11: Reserved.
Bits 31-16: W = Ways of associativity.
ECX
Bits 31-00: S = Number of Sets.
EDX
Bits 04-00: Translation cache type field.
00000b: Null (indicates this sub-leaf is not valid).
00001b: Data TLB.
00010b: Instruction TLB.
00011b: Unified TLB*.
00100b: Load Only TLB. Hit on loads; fills on both loads and stores.
00101b: Store Only TLB. Hit on stores; fill on stores.
All other encodings are reserved.
Bits 07-05: Translation cache level (starts at 1).
Bit 08: Fully associative structure.
Bits 13-09: Reserved.
Bits 25-14: Maximum number of addressable IDs for logical processors sharing this translation cache.**
Bits 31-26: Reserved.
CPUID-CPU Identification
Vol. 2A
3-233
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
Deterministic Address Translation Parameters Sub-leaf (Initial EAX Value = 18H, ECX ≥ 1)
18H
NOTES:
Each sub-leaf enumerates a different address translation structure.
If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf index n is invalid if n
exceeds the value that sub-leaf 0 returns in EAX. A sub-leaf index is also invalid if EDX[4:0] returns 0.
Valid sub-leaves do not need to be contiguous or in any particular order. A valid sub-leaf may be in a
higher input ECX value than an invalid sub-leaf or than a valid sub-leaf of a higher or lower-level struc-
ture.
* Some unified TLBs will allow a single TLB entry to satisfy data read/write and instruction fetches.
Others will require separate entries (e.g., one loaded on data read/write and another loaded on an
instruction fetch. See the Intel® 64 and IA-32 Architectures Optimization Reference Manual for details
of a particular product.
** Add one to the return value to get the result.
EAX
Bits 31-00: Reserved.
EBX
Bit 00: 4K page size entries supported by this structure.
Bit 01: 2MB page size entries supported by this structure.
Bit 02: 4MB page size entries supported by this structure.
Bit 03: 1 GB page size entries supported by this structure.
Bits 07-04: Reserved.
Bits 10-08: Partitioning (0: Soft partitioning between the logical processors sharing this structure).
Bits 15-11: Reserved.
Bits 31-16: W = Ways of associativity.
ECX
Bits 31-00: S = Number of Sets.
EDX
Bits 04-00: Translation cache type field.
0000b: Null (indicates this sub-leaf is not valid).
0001b: Data TLB.
0010b: Instruction TLB.
0011b: Unified TLB*.
All other encodings are reserved.
Bits 07-05: Translation cache level (starts at 1).
Bit 08: Fully associative structure.
Bits 13-09: Reserved.
Bits 25-14: Maximum number of addressable IDs for logical processors sharing this translation cache**
Bits 31-26: Reserved.
Key Locker Leaf (Initial EAX Value = 19H)
19H
EAX
Bit 00: Key Locker restriction of CPL0-only supported.
Bit 01: Key Locker restriction of no-encrypt supported.
Bit 02: Key Locker restriction of no-decrypt supported.
Bits 31-03: Reserved.
EBX
Bit 00: AESKLE. If 1, the AES Key Locker instructions are fully enabled.
Bit 01: Reserved.
Bit 02: If 1, the AES wide Key Locker instructions are supported.
Bit 03: Reserved.
Bit 04: If 1, the platform supports the Key Locker MSRs (IA32_COPY_LOCAL_TO_PLATFORM,
IA23_COPY_PLATFORM_TO_LOCAL, IA32_COPY_STATUS, and IA32_IWKEYBACKUP_STATUS) and backing
up the internal wrapping key.
Bits 31-05: Reserved.
ECX
Bit 00: If 1, the NoBackup parameter to LOADIWKEY is supported.
Bit 01: If 1, KeySource encoding of 1 (randomization of the internal wrapping key) is supported.
Bits 31-02: Reserved.
3-234
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
EDX
Reserved.
Native Model ID Enumeration Leaf (Initial EAX Value = 1AH, ECX = 0)
1AH
NOTES:
This leaf exists on all hybrid parts, however this leaf is not only available on hybrid parts. The following
algorithm is used for detection of this leaf:
If CPUID.0.MAXLEAF ≥ 1AH and CPUID.1A.EAX ≠ 0, then the leaf exists.
EAX
Enumerates the native model ID and core type.
Bits 31-24: Core type*
10H: Reserved
20H: Intel Atom®
30H: Reserved
40H: Intel® Core™
Bits 23-00: Native model ID of the core. The core-type and native model ID can be used to uniquely
identify the microarchitecture of the core. This native model ID is not unique across core types, and not
related to the model ID reported in CPUID leaf 01H, and does not identify the SOC.
* The core type may only be used as an identification of the microarchitecture for this logical processor
and its numeric value has no significance, neither large nor small. This field neither implies nor expresses
any other attribute to this logical processor and software should not assume any.
EBX
Reserved.
ECX
Reserved.
EDX
Reserved.
PCONFIG Information Sub-leaf (Initial EAX Value = 1BH, ECX ≥ 0)
1BH
For details on this sub-leaf, see “INPUT EAX = 1BH: Returns PCONFIG Information” on page 3-252.
NOTE:
Leaf 1BH is supported if CPUID.(EAX=07H, ECX=0H):EDX[18] = 1.
Last Branch Records Information Leaf (Initial EAX Value = 1CH, ECX = 0)
1CH
NOTE:
This leaf pertains to the architectural feature.
EAX
Bits 07-00: Supported LBR Depth Values. For each bit n set in this field, the IA32_LBR_DEPTH.DEPTH
value 8*(n+1) is supported.
Bits 29-08: Reserved.
Bit 30: Deep C-state Reset. If set, indicates that LBRs may be cleared on an MWAIT that requests a C-state
numerically greater than C1.
Bit 31: IP Values Contain LIP. If set, LBR IP values contain LIP. If clear, IP values contain Effective IP.
EBX
Bit 00: CPL Filtering Supported. If set, the processor supports setting IA32_LBR_CTL[2:1] to non-zero
value.
Bit 01: Branch Filtering Supported. If set, the processor supports setting IA32_LBR_CTL[22:16] to non-
zero value.
Bit 02: Call-stack Mode Supported. If set, the processor supports setting IA32_LBR_CTL[3] to 1.
Bits 31-03: Reserved.
ECX
Bit 00: Mispredict Bit Supported. IA32_LBR_x_INFO[63] holds indication of branch misprediction
(MISPRED).
Bit 01: Timed LBRs Supported. IA32_LBR_x_INFO[15:0] holds CPU cycles since last LBR entry (CYC_CNT),
and IA32_LBR_x_INFO[60] holds an indication of whether the value held there is valid (CYC_CNT_VALID).
Bit 02: Branch Type Field Supported. IA32_LBR_INFO_x[59:56] holds indication of the recorded
operation's branch type (BR_TYPE).
Bits 31-03: Reserved.
CPUID-CPU Identification
Vol. 2A
3-235
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
EDX
Bits 31-00: Reserved.
Tile Information Main Leaf (Initial EAX Value = 1DH, ECX = 0)
1DH
NOTES:
For sub-leaves of 1DH, they are indexed by the palette id.
Leaf 1DH sub-leaves 2 and above are reserved.
EAX
Bits 31-00: max_palette. Highest numbered palette sub-leaf. Value = 1.
EBX
Bits 31-00: Reserved = 0.
ECX
Bits 31-00: Reserved = 0.
EDX
Bits 31-00: Reserved = 0.
Tile Palette 1 Sub-leaf (Initial EAX Value = 1DH, ECX = 1)
1DH
EAX
Bits 15-00: Palette 1 total_tile_bytes. Value = 8192.
Bits 31-16: Palette 1 bytes_per_tile. Value = 1024.
EBX
Bits 15-00: Palette 1 bytes_per_row. Value = 64.
Bits 31-16: Palette 1 max_names (number of tile registers). Value = 8.
ECX
Bits 15-00: Palette 1 max_rows. Value = 16.
Bits 31-16: Reserved = 0.
EDX
Bits 31-00: Reserved = 0.
TMUL Information Main Leaf (Initial EAX Value = 1EH, ECX = 0)
1EH
NOTE:
Leaf 1EH sub-leaves 1 and above are reserved.
EAX
Bits 31-00: Reserved = 0.
EBX
Bits 07-00: tmul_maxk (rows or columns). Value = 16.
Bits 23-08: tmul_maxn (column bytes). Value = 64.
Bits 31-24: Reserved = 0.
ECX
Bits 31-00: Reserved = 0.
EDX
Bits 31-00: Reserved = 0.
V2 Extended Topology Enumeration Leaf (Initial EAX Value = 1FH)
1FH
NOTES:
CPUID leaf 1FH is a preferred superset to leaf 0BH. Intel recommends using leaf 1FH when available
rather than leaf 0BH and ensuring that any leaf 0BH algorithms are updated to support leaf 1FH.
The sub-leaves of CPUID leaf 1FH describe an ordered hierarchy of logical processors starting from the
smallest-scoped domain of a Logical Processor (sub-leaf index 0) to the Core domain (sub-leaf index 1)
to the largest-scoped domain (the last valid sub-leaf index) that is implicitly subordinate to the
unenumerated highest-scoped domain of the processor package (socket).
The details of each valid domain is enumerated by a corresponding sub-leaf. Details for a domain
include its type and how all instances of that domain determine the number of logical processors and
x2 APIC ID partitioning at the next higher-scoped domain. The ordering of domains within the hierarchy
is fixed architecturally as shown below. For a given processor, not all domains may be relevant or
enumerated; however, the logical processor and core domains are always enumerated. As an example,
a processor may report an ordered hierarchy consisting only of “Logical Processor,” “Core,” and “Die.”
For two valid sub-leaves N and N+1, sub-leaf N+1 represents the next immediate higher-scoped
domain with respect to the domain of sub-leaf N for the given processor.
If sub-leaf index “N” returns an invalid domain type in ECX[15:08] (00H), then all sub-leaves with an
index greater than “N” shall also return an invalid domain type. A sub-leaf returning an invalid domain
always returns 0 in EAX and EBX.
3-236
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
EAX
Bits 04-00: The number of bits that the x2APIC ID must be shifted to the right to address instances of
the next higher-scoped domain. When logical processor is not supported by the processor, the value of
this field at the Logical Processor domain sub-leaf may be returned as either 0 (no allocated bits in the
x2APIC ID) or 1 (one allocated bit in the x2APIC ID); software should plan accordingly.
Bits 31-05: Reserved.
EBX
Bits 15-00: The number of logical processors across all instances of this domain within the next higher-
scoped domain relative to this current logical processor. (For example, in a processor socket/package
comprising “M” dies of “N” cores each, where each core has “L” logical processors, the “die” domain sub-
leaf value of this field would be M*N*L. In an asymmetric topology this would be the summation of the
value across the lower domain level instances to create each upper domain level instance.) This number
reflects configuration as shipped by Intel. Note, software must not use this field to enumerate processor
topology*.
Bits 31-16: Reserved.
ECX
Bits 07-00: The input ECX sub-leaf index.
Bits 15-08: Domain Type. This field provides an identification value which indicates the domain as shown
below. Although domains are ordered, as also shown below, their assigned identification values are not
and software should not depend on it. (For example, if a new domain between core and module is speci-
fied, it will have an identification value higher than 5.)
Hierarchy
Domain
Domain Type Identification Value
Lowest
Logical Processor
1
Core
2
Module
3
Tile
4
Die
5
DieGrp
6
Highest
Package/Socket
(implied)
(Note that enumeration values of 0 and 7-255 are reserved.)
Bits 31-16: Reserved.
EDX
Bits 31-00: x2APIC ID of the current logical processor. It is always valid and does not vary with the sub-
leaf index in ECX.
NOTES:
* Software must not use the value of EBX[15:0] to enumerate processor topology of the system. The
value is only intended for display and diagnostic purposes. The actual number of logical processors avail-
able to BIOS/OS/Applications may be different from the value of EBX[15:0], depending on software and
platform hardware configurations.
Processor History Reset Sub-leaf (Initial EAX Value = 20H, ECX = 0)
20H
EAX
Reports the maximum number of sub-leaves that are supported in leaf 20H.
EBX
Indicates which bits may be set in the IA32_HRESET_ENABLE MSR to enable reset of different compo-
nents of hardware-maintained history.
Bit 00: Indicates support for both HRESET’s EAX[0] parameter, and IA32_HRESET_ENABLE[0] set by the
OS to enable reset of Intel® Thread Director history.
Bits 31-01: Reserved = 0.
ECX
Reserved.
EDX
Reserved.
CPUID-CPU Identification
Vol. 2A
3-237
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
Unimplemented CPUID Leaf Functions
21H
Invalid. No existing or future CPU will return processor identification or feature information if the initial
EAX value is 21H. If the value returned by CPUID.0:EAX (the maximum input value for basic CPUID
information) is at least 21H, 0 is returned in the registers EAX, EBX, ECX, and EDX. Otherwise, the data
for the highest basic information leaf is returned.
40000000H
Invalid. No existing or future CPU will return processor identification or feature information if the initial
-
EAX value is in the range 40000000H to 4FFFFFFFH.
4FFFFFFFH
Extended Function CPUID Information
80000000H
EAX
Maximum Input Value for Extended Function CPUID Information.
EBX
Reserved.
ECX
Reserved.
EDX
Reserved.
80000001H
EAX
Extended Processor Signature and Feature Bits.
EBX
Reserved.
ECX
Bit 00: LAHF/SAHF available in 64-bit mode.*
Bits 04-01: Reserved.
Bit 05: LZCNT.
Bits 07-06: Reserved.
Bit 08: PREFETCHW.
Bits 31-09: Reserved.
EDX
Bits 10-00: Reserved.
Bit 11: SYSCALL/SYSRET.**
Bits 19-12: Reserved = 0.
Bit 20: Execute Disable Bit available.
Bits 25-21: Reserved = 0.
Bit 26: 1-GByte pages are available if 1.
Bit 27: RDTSCP and IA32_TSC_AUX are available if 1.
Bit 28: Reserved = 0.
Bit 29: Intel® 64 Architecture available if 1.
Bits 31-30: Reserved = 0.
NOTES:
* LAHF and SAHF are always available in other modes, regardless of the enumeration of this feature flag.
** Intel processors support SYSCALL and SYSRET only in 64-bit mode. This feature flag is always enumer-
ated as 0 outside 64-bit mode.
80000002H
EAX
Processor Brand String.
EBX
Processor Brand String Continued.
ECX
Processor Brand String Continued.
EDX
Processor Brand String Continued.
80000003H
EAX
Processor Brand String Continued.
EBX
Processor Brand String Continued.
ECX
Processor Brand String Continued.
EDX
Processor Brand String Continued.
3-238
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
80000004H
EAX
Processor Brand String Continued.
EBX
Processor Brand String Continued.
ECX
Processor Brand String Continued.
EDX
Processor Brand String Continued.
80000005H
EAX
Reserved = 0.
EBX
Reserved = 0.
ECX
Reserved = 0.
EDX
Reserved = 0.
80000006H
EAX
Reserved = 0.
EBX
Reserved = 0.
ECX
Bits 07-00: Cache Line size in bytes.
Bits 11-08: Reserved.
Bits 15-12: L2 Associativity field *.
Bits 31-16: Cache size in 1K units.
EDX
Reserved = 0.
NOTES:
* L2 associativity field encodings:
00H - Disabled
08H - 16 ways
01H - 1 way (direct mapped)
09H - Reserved
02H - 2 ways
0AH - 32 ways
03H - Reserved
0BH - 48 ways
04H - 4 ways
0CH - 64 ways
05H - Reserved
0DH - 96 ways
06H - 8 ways
0EH - 128 ways
07H - See CPUID leaf 04H, sub-leaf 2**
0FH - Fully associative
** CPUID leaf 04H provides details of deterministic cache parameters, including the L2 cache in sub-leaf 2
80000007H
EAX
Reserved = 0.
EBX
Reserved = 0.
ECX
Reserved = 0.
EDX
Bits 07-00: Reserved = 0.
Bit 08: Invariant TSC available if 1.
Bits 31-09: Reserved = 0.
80000008H
EAX
Linear/Physical Address size.
Bits 07-00: #Physical Address Bits*.
Bits 15-08: #Linear Address Bits.
Bits 31-16: Reserved = 0.
EBX
Bits 08-00: Reserved = 0.
Bit 09: WBNOINVD is available if 1.
Bits 31-10: Reserved = 0.
ECX
Reserved = 0.
EDX
Reserved = 0.
NOTES:
* If CPUID.80000008H:EAX[7:0] is supported, the maximum physical address number supported should
come from this field.
INPUT EAX = 0: Returns CPUID’s Highest Value for Basic Processor Information and the Vendor Identification String
When CPUID executes with EAX set to 0, the processor returns the highest value the CPUID recognizes for
returning basic processor information. The value is returned in the EAX register and is processor specific.
CPUID-CPU Identification
Vol. 2A
3-239
INSTRUCTION SET REFERENCE, A-L
A vendor identification string is also returned in EBX, EDX, and ECX. For Intel processors, the string is “Genu-
ineIntel” and is expressed:
EBX := 756e6547h (* “Genu”, with G in the low eight bits of BL *)
EDX := 49656e69h (* “ineI”, with i in the low eight bits of DL *)
ECX := 6c65746eh (* “ntel”, with n in the low eight bits of CL *)
INPUT EAX = 80000000H: Returns CPUID’s Highest Value for Extended Processor Information
When CPUID executes with EAX set to 80000000H, the processor returns the highest value the processor recog-
nizes for returning extended processor information. The value is returned in the EAX register and is processor
specific.
IA32_BIOS_SIGN_ID Returns Microcode Update Signature
For processors that support the microcode update facility, the IA32_BIOS_SIGN_ID MSR is loaded with the update
signature whenever CPUID executes. The signature is returned in the upper DWORD. For details, see Chapter 10 in
the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A.
INPUT EAX = 01H: Returns Model, Family, Stepping Information
When CPUID executes with EAX set to 01H, version information is returned in EAX (see Figure 3-6). For example:
model, family, and processor type for the Intel Xeon processor 5100 series is as follows:
• Model - 1111B
• Family - 0101B
• Processor Type - 00B
See Table 3-9 for available processor type values. Stepping IDs are provided as needed.
31
28 27
20 19
16 15 14 13 12 11
8
7
4
3
0
Extended
Extended
Family
Stepping
EAX
Model
Family ID
Model ID
ID
ID
Extended Family ID (0)
Extended Model ID (0)
Processor Type
Family (0FH for the Pentium 4 Processor Family)
Model
Reserved
OM16525
Figure 3-6. Version Information Returned by CPUID in EAX
Table 3-9. Processor Type Field
Type
Encoding
Original OEM Processor
00B
Intel OverDrive® Processor
01B
3-240
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-9. Processor Type Field (Contd.)
Type
Encoding
Dual processor (not applicable to Intel486 processors)
10B
Intel reserved
11B
NOTE
See Chapter 20 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1,
for information on identifying earlier IA-32 processors.
The Extended Family ID needs to be examined only when the Family ID is 0FH. Integrate the fields into a display
using the following rule:
IF Family_ID ≠ 0FH
THEN DisplayFamily = Family_ID;
ELSE DisplayFamily = Extended_Family_ID + Family_ID;
FI;
(* Show DisplayFamily as HEX field. *)
The Extended Model ID needs to be examined only when the Family ID is 06H or 0FH. Integrate the field into a
display using the following rule:
IF (Family_ID = 06H or Family_ID = 0FH)
THEN DisplayModel = (Extended_Model_ID « 4) + Model_ID;
(* Right justify and zero-extend 4-bit field; display Model_ID as HEX field.*)
ELSE DisplayModel = Model_ID;
FI;
(* Show DisplayModel as HEX field. *)
INPUT EAX = 01H: Returns Additional Information in EBX
When CPUID executes with EAX set to 01H, additional information is returned to the EBX register:
• Brand index (low byte of EBX) - this number provides an entry into a brand string table that contains brand
strings for IA-32 processors. More information about this field is provided later in this section.
• CLFLUSH instruction cache line size (second byte of EBX) - this number indicates the size of the cache line
flushed by the CLFLUSH and CLFLUSHOPT instructions in 8-byte increments. This field was introduced in the
Pentium 4 processor.
• Local APIC ID (high byte of EBX) - this number is the 8-bit ID that is assigned to the local APIC on the
processor during power up. This field was introduced in the Pentium 4 processor.
INPUT EAX = 01H: Returns Feature Information in ECX and EDX
When CPUID executes with EAX set to 01H, feature information is returned in ECX and EDX.
• Figure 3-7 and Table 3-10 show encodings for ECX.
• Figure 3-8 and Table 3-11 show encodings for EDX.
For all feature flags, a 1 indicates that the feature is supported. Use Intel to properly interpret feature flags.
NOTE
Software must confirm that a processor feature is present using feature flags returned by CPUID
prior to using the feature. Software should not depend on future offerings retaining all features.
CPUID-CPU Identification
Vol. 2A
3-241
INSTRUCTION SET REFERENCE, A-L
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10
9
8
7
6
5
4
3
2
1
0
ECX
0
RDRAND
F16C
AVX
OSXSAVE
XSAVE
AES
TSC-Deadline
POPCNT
MOVBE
x2APIC
SSE4_2 - SSE4.2
SSE4_1 - SSE4.1
DCA - Direct Cache Access
PCID - Process-context Identifiers
PDCM - Perf/Debug Capability MSR
xTPR Update Control
CMPXCHG16B
FMA - Fused Multiply Add
SDBG
CNXT-ID - L1 Context ID
SSSE3 - SSSE3 Extensions
TM2 - Thermal Monitor 2
EIST - Enhanced Intel SpeedStep® Technology
SMX - Safer Mode Extensions
VMX - Virtual Machine Extensions
DS-CPL - CPL Qualified Debug Store
MONITOR - MONITOR/MWAIT
DTES64 - 64-bit DS Area
PCLMULQDQ - Carryless Multiplication
SSE3 - SSE3 Extensions
OM16524b
Reserved
Figure 3-7. Feature Information Returned in the ECX Register
Table 3-10. Feature Information Returned in the ECX Register
Bit #
Mnemonic
Description
0
SSE3
Streaming SIMD Extensions 3 (SSE3). A value of 1 indicates the processor supports this
technology.
1
PCLMULQDQ
PCLMULQDQ. A value of 1 indicates the processor supports the PCLMULQDQ instruction.
2
DTES64
64-bit DS Area. A value of 1 indicates the processor supports DS area using 64-bit layout.
3
MONITOR
MONITOR/MWAIT. A value of 1 indicates the processor supports this feature.
4
DS-CPL
CPL Qualified Debug Store. A value of 1 indicates the processor supports the extensions to the
Debug Store feature to allow for branch message storage qualified by CPL.
5
VMX
Virtual Machine Extensions. A value of 1 indicates that the processor supports this technology.
6
SMX
Safer Mode Extensions. A value of 1 indicates that the processor supports this technology. See
Chapter 7, “Safer Mode Extensions Reference.”
7
EIST
Enhanced Intel SpeedStep® technology. A value of 1 indicates that the processor supports this
technology.
8
TM2
Thermal Monitor 2. A value of 1 indicates whether the processor supports this technology.
9
SSSE3
A value of 1 indicates the presence of the Supplemental Streaming SIMD Extensions 3 (SSSE3). A
value of 0 indicates the instruction extensions are not present in the processor.
3-242
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-10. Feature Information Returned in the ECX Register (Contd.)
Bit #
Mnemonic
Description
10
CNXT-ID
L1 Context ID. A value of 1 indicates the L1 data cache mode can be set to either adaptive mode
or shared mode. A value of 0 indicates this feature is not supported. See definition of the
IA32_MISC_ENABLE MSR Bit 24 (L1 Data Cache Context Mode) for details.
11
SDBG
A value of 1 indicates the processor supports IA32_DEBUG_INTERFACE MSR for silicon debug.
12
FMA
A value of 1 indicates the processor supports FMA extensions using YMM state.
13
CMPXCHG16B
CMPXCHG16B Available. A value of 1 indicates that the feature is available. See the
“CMPXCHG8B/CMPXCHG16B-Compare and Exchange Bytes” section in this chapter for a
description.
14
xTPR Update
xTPR Update Control. A value of 1 indicates that the processor supports changing
Control
IA32_MISC_ENABLE[bit 23].
15
PDCM
Perfmon and Debug Capability: A value of 1 indicates the processor supports the performance
and debug feature indication MSR IA32_PERF_CAPABILITIES.
16
Reserved
Reserved
17
PCID
Process-context identifiers. A value of 1 indicates that the processor supports PCIDs and that
software may set CR4.PCIDE to 1.
18
DCA
A value of 1 indicates the processor supports the ability to prefetch data from a memory mapped
device.
19
SSE4_1
A value of 1 indicates that the processor supports SSE4.1.
20
SSE4_2
A value of 1 indicates that the processor supports SSE4.2.
21
x2APIC
A value of 1 indicates that the processor supports x2APIC feature.
22
MOVBE
A value of 1 indicates that the processor supports MOVBE instruction.
23
POPCNT
A value of 1 indicates that the processor supports the POPCNT instruction.
24
TSC-Deadline
A value of 1 indicates that the processor’s local APIC timer supports one-shot operation using a
TSC deadline value.
25
AESNI
A value of 1 indicates that the processor supports the AESNI instruction extensions.
26
XSAVE
A value of 1 indicates that the processor supports the XSAVE/XRSTOR processor extended states
feature, the XSETBV/XGETBV instructions, and XCR0.
27
OSXSAVE
A value of 1 indicates that the OS has set CR4.OSXSAVE[bit 18] to enable XSETBV/XGETBV
instructions to access XCR0 and to support processor extended state management using
XSAVE/XRSTOR.
28
AVX
A value of 1 indicates the processor supports the AVX instruction extensions.
29
F16C
A value of 1 indicates that processor supports 16-bit floating-point conversion instructions.
30
RDRAND
A value of 1 indicates that processor supports RDRAND instruction.
31
Not Used
Always returns 0.
CPUID-CPU Identification
Vol. 2A
3-243
INSTRUCTION SET REFERENCE, A-L
3130292827262524 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9
8
7
6
5 4
3
2
1
0
EDX
PBE-Pend. Brk. EN.
TM-Therm. Monitor
HTT-Multi-threading
SS-Self Snoop
SSE2-SSE2 Extensions
SSE-SSE Extensions
FXSR-FXSAVE/FXRSTOR
MMX-MMX Technology
ACPI-Thermal Monitor and Clock Ctrl
DS-Debug Store
CLFSH-CLFLUSH instruction
PSN-Processor Serial Number
PSE-36 - Page Size Extension
PAT-Page Attribute Table
CMOV-Conditional Move/Compare Instruction
MCA-Machine Check Architecture
PGE-PTE Global Bit
MTRR-Memory Type Range Registers
SEP-SYSENTER and SYSEXIT
APIC-APIC on Chip
CX8-CMPXCHG8B Inst.
MCE-Machine Check Exception
PAE-Physical Address Extensions
MSR-RDMSR and WRMSR Support
TSC-Time Stamp Counter
PSE-Page Size Extensions
DE-Debugging Extensions
VME-Virtual-8086 Mode Enhancement
FPU-x87 FPU on Chip
Reserved
OM16523
Figure 3-8. Feature Information Returned in the EDX Register
3-244
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-11. More on Feature Information Returned in the EDX Register
Bit #
Mnemonic
Description
0
FPU
Floating-Point Unit On-Chip. The processor contains an x87 FPU.
1
VME
Virtual 8086 Mode Enhancements. Virtual 8086 mode enhancements, including CR4.VME for controlling the
feature, CR4.PVI for protected mode virtual interrupts, software interrupt indirection, expansion of the TSS
with the software indirection bitmap, and EFLAGS.VIF and EFLAGS.VIP flags.
2
DE
Debugging Extensions. Support for I/O breakpoints, including CR4.DE for controlling the feature, and optional
trapping of accesses to DR4 and DR5.
3
PSE
Page Size Extension. Large pages of size 4 MByte are supported, including CR4.PSE for controlling the
feature, the defined dirty bit in PDE (Page Directory Entries), optional reserved bit trapping in CR3, PDEs, and
PTEs.
4
TSC
Time Stamp Counter. The RDTSC instruction is supported, including CR4.TSD for controlling privilege.
5
MSR
Model Specific Registers RDMSR and WRMSR Instructions. The RDMSR and WRMSR instructions are
supported. Some of the MSRs are implementation dependent.
6
PAE
Physical Address Extension. Physical addresses greater than 32 bits are supported: extended page table
entry formats, an extra level in the page translation tables is defined, 2-MByte pages are supported instead of
4 Mbyte pages if PAE bit is 1.
7
MCE
Machine Check Exception. Exception 18 is defined for Machine Checks, including CR4.MCE for controlling the
feature. This feature does not define the model-specific implementations of machine-check error logging,
reporting, and processor shutdowns. Machine Check exception handlers may have to depend on processor
version to do model specific processing of the exception, or test for the presence of the Machine Check feature.
8
CX8
CMPXCHG8B Instruction. The compare-and-exchange 8 bytes (64 bits) instruction is supported (implicitly
locked and atomic).
9
APIC
APIC On-Chip. The processor contains an Advanced Programmable Interrupt Controller (APIC), responding to
memory mapped commands in the physical address range FFFE0000H to FFFE0FFFH (by default - some
processors permit the APIC to be relocated).
10
Reserved
Reserved
11
SEP
SYSENTER and SYSEXIT Instructions. The SYSENTER and SYSEXIT and associated MSRs are supported.
12
MTRR
Memory Type Range Registers. MTRRs are supported. The MTRRcap MSR contains feature bits that describe
what memory types are supported, how many variable MTRRs are supported, and whether fixed MTRRs are
supported.
13
PGE
Page Global Bit. The global bit is supported in paging-structure entries that map a page, indicating TLB entries
that are common to different processes and need not be flushed. The CR4.PGE bit controls this feature.
14
MCA
Machine Check Architecture. A value of 1 indicates the Machine Check Architecture of reporting machine
errors is supported. The MCG_CAP MSR contains feature bits describing how many banks of error reporting
MSRs are supported.
15
CMOV
Conditional Move Instructions. The conditional move instruction CMOV is supported. In addition, if x87 FPU is
present as indicated by the CPUID.FPU feature bit, then the FCOMI and FCMOV instructions are supported
16
PAT
Page Attribute Table. Page Attribute Table is supported. This feature augments the Memory Type Range
Registers (MTRRs), allowing an operating system to specify attributes of memory accessed through a linear
address on a 4KB granularity.
17
PSE-36
36-Bit Page Size Extension. 4-MByte pages addressing physical memory beyond 4 GBytes are supported with
32-bit paging. This feature indicates that upper bits of the physical address of a 4-MByte page are encoded in
bits 20:13 of the page-directory entry. Such physical addresses are limited by MAXPHYADDR and may be up to
40 bits in size.
18
PSN
Processor Serial Number. The processor supports the 96-bit processor identification number feature and the
feature is enabled.
19
CLFSH
CLFLUSH Instruction. CLFLUSH Instruction is supported.
20
Reserved
Reserved
CPUID-CPU Identification
Vol. 2A
3-245
INSTRUCTION SET REFERENCE, A-L
Table 3-11. More on Feature Information Returned in the EDX Register (Contd.)
Bit #
Mnemonic
Description
21
DS
Debug Store. The processor supports the ability to write debug information into a memory resident buffer.
This feature is used by the branch trace store (BTS) and processor event-based sampling (PEBS) facilities (see
Chapter 24, “Introduction to Virtual Machine Extensions,” in the Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volume 3C).
22
ACPI
Thermal Monitor and Software Controlled Clock Facilities. The processor implements internal MSRs that
allow processor temperature to be monitored and processor performance to be modulated in predefined duty
cycles under software control.
23
MMX
Intel MMX Technology. The processor supports the Intel MMX technology.
24
FXSR
FXSAVE and FXRSTOR Instructions. The FXSAVE and FXRSTOR instructions are supported for fast save and
restore of the floating-point context. Presence of this bit also indicates that CR4.OSFXSR is available for an
operating system to indicate that it supports the FXSAVE and FXRSTOR instructions.
25
SSE
SSE. The processor supports the SSE extensions.
26
SSE2
SSE2. The processor supports the SSE2 extensions.
27
SS
Self Snoop. The processor supports the management of conflicting memory types by performing a snoop of its
own cache structure for transactions issued to the bus.
28
HTT
Max APIC IDs reserved field is Valid. A value of 0 for HTT indicates there is only a single logical processor in
the package and software should assume only a single APIC ID is reserved. A value of 1 for HTT indicates the
value in CPUID.1.EBX[23:16] (the Maximum number of addressable IDs for logical processors in this package) is
valid for the package.
29
TM
Thermal Monitor. The processor implements the thermal monitor automatic thermal control circuitry (TCC).
30
Reserved
Reserved
31
PBE
Pending Break Enable. The processor supports the use of the FERR#/PBE# pin when the processor is in the
stop-clock state (STPCLK# is asserted) to signal the processor that an interrupt is pending and that the
processor should return to normal operation to handle the interrupt.
INPUT EAX = 02H: TLB/Cache/Prefetch Information Returned in EAX, EBX, ECX, EDX
When CPUID executes with EAX set to 02H, the processor returns information about the processor’s internal TLBs,
cache, and prefetch hardware in the EAX, EBX, ECX, and EDX registers. The information is reported in encoded
form and fall into the following categories:
• The least-significant byte in register EAX (register AL) will always return 01H. Software should ignore this value
and not interpret it as an informational descriptor.
• The most significant bit (bit 31) of each register indicates whether the register contains valid information (set
to 0) or is reserved (set to 1).
• If a register contains valid information, the information is contained in 1 byte descriptors. There are four types
of encoding values for the byte descriptor, the encoding type is noted in the second column of Table 3-12. Table
3-12 lists the encoding of these descriptors. Note that the order of descriptors in the EAX, EBX, ECX, and EDX
registers is not defined; that is, specific bytes are not designated to contain descriptors for specific cache,
prefetch, or TLB types. The descriptors may appear in any order. Note also a processor may report a general
descriptor type (FFH) and not report any byte descriptor of “cache type” via CPUID leaf 2.
3-246
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-12. Encoding of CPUID Leaf 2 Descriptors
Value
Type
Description
00H
General
Null descriptor, this byte contains no information
01H
TLB
Instruction TLB: 4 KByte pages, 4-way set associative, 32 entries
02H
TLB
Instruction TLB: 4 MByte pages, fully associative, 2 entries
03H
TLB
Data TLB: 4 KByte pages, 4-way set associative, 64 entries
04H
TLB
Data TLB: 4 MByte pages, 4-way set associative, 8 entries
05H
TLB
Data TLB1: 4 MByte pages, 4-way set associative, 32 entries
06H
Cache
1st-level instruction cache: 8 KBytes, 4-way set associative, 32 byte line size
08H
Cache
1st-level instruction cache: 16 KBytes, 4-way set associative, 32 byte line size
09H
Cache
1st-level instruction cache: 32KBytes, 4-way set associative, 64 byte line size
0AH
Cache
1st-level data cache: 8 KBytes, 2-way set associative, 32 byte line size
0BH
TLB
Instruction TLB: 4 MByte pages, 4-way set associative, 4 entries
0CH
Cache
1st-level data cache: 16 KBytes, 4-way set associative, 32 byte line size
0DH
Cache
1st-level data cache: 16 KBytes, 4-way set associative, 64 byte line size
0EH
Cache
1st-level data cache: 24 KBytes, 6-way set associative, 64 byte line size
1DH
Cache
2nd-level cache: 128 KBytes, 2-way set associative, 64 byte line size
21H
Cache
2nd-level cache: 256 KBytes, 8-way set associative, 64 byte line size
22H
Cache
3rd-level cache: 512 KBytes, 4-way set associative, 64 byte line size, 2 lines per sector
23H
Cache
3rd-level cache: 1 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector
24H
Cache
2nd-level cache: 1 MBytes, 16-way set associative, 64 byte line size
25H
Cache
3rd-level cache: 2 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector
29H
Cache
3rd-level cache: 4 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector
2CH
Cache
1st-level data cache: 32 KBytes, 8-way set associative, 64 byte line size
30H
Cache
1st-level instruction cache: 32 KBytes, 8-way set associative, 64 byte line size
40H
Cache
No 2nd-level cache or, if processor contains a valid 2nd-level cache, no 3rd-level cache
41H
Cache
2nd-level cache: 128 KBytes, 4-way set associative, 32 byte line size
42H
Cache
2nd-level cache: 256 KBytes, 4-way set associative, 32 byte line size
43H
Cache
2nd-level cache: 512 KBytes, 4-way set associative, 32 byte line size
44H
Cache
2nd-level cache: 1 MByte, 4-way set associative, 32 byte line size
45H
Cache
2nd-level cache: 2 MByte, 4-way set associative, 32 byte line size
46H
Cache
3rd-level cache: 4 MByte, 4-way set associative, 64 byte line size
47H
Cache
3rd-level cache: 8 MByte, 8-way set associative, 64 byte line size
48H
Cache
2nd-level cache: 3MByte, 12-way set associative, 64 byte line size
49H
Cache
3rd-level cache: 4MB, 16-way set associative, 64-byte line size (Intel Xeon processor MP, Family 0FH, Model
06H);
2nd-level cache: 4 MByte, 16-way set associative, 64 byte line size
4AH
Cache
3rd-level cache: 6MByte, 12-way set associative, 64 byte line size
4BH
Cache
3rd-level cache: 8MByte, 16-way set associative, 64 byte line size
4CH
Cache
3rd-level cache: 12MByte, 12-way set associative, 64 byte line size
4DH
Cache
3rd-level cache: 16MByte, 16-way set associative, 64 byte line size
4EH
Cache
2nd-level cache: 6MByte, 24-way set associative, 64 byte line size
4FH
TLB
Instruction TLB: 4 KByte pages, 32 entries
CPUID-CPU Identification
Vol. 2A
3-247
INSTRUCTION SET REFERENCE, A-L
Table 3-12. Encoding of CPUID Leaf 2 Descriptors (Contd.)
Value
Type
Description
50H
TLB
Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 64 entries
51H
TLB
Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 128 entries
52H
TLB
Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 256 entries
55H
TLB
Instruction TLB: 2-MByte or 4-MByte pages, fully associative, 7 entries
56H
TLB
Data TLB0: 4 MByte pages, 4-way set associative, 16 entries
57H
TLB
Data TLB0: 4 KByte pages, 4-way associative, 16 entries
59H
TLB
Data TLB0: 4 KByte pages, fully associative, 16 entries
5AH
TLB
Data TLB0: 2 MByte or 4 MByte pages, 4-way set associative, 32 entries
5BH
TLB
Data TLB: 4 KByte and 4 MByte pages, 64 entries
5CH
TLB
Data TLB: 4 KByte and 4 MByte pages,128 entries
5DH
TLB
Data TLB: 4 KByte and 4 MByte pages,256 entries
60H
Cache
1st-level data cache: 16 KByte, 8-way set associative, 64 byte line size
61H
TLB
Instruction TLB: 4 KByte pages, fully associative, 48 entries
63H
TLB
Data TLB: 2 MByte or 4 MByte pages, 4-way set associative, 32 entries and a separate array with 1 GByte
pages, 4-way set associative, 4 entries
64H
TLB
Data TLB: 4 KByte pages, 4-way set associative, 512 entries
66H
Cache
1st-level data cache: 8 KByte, 4-way set associative, 64 byte line size
67H
Cache
1st-level data cache: 16 KByte, 4-way set associative, 64 byte line size
68H
Cache
1st-level data cache: 32 KByte, 4-way set associative, 64 byte line size
6AH
Cache
uTLB: 4 KByte pages, 8-way set associative, 64 entries
6BH
Cache
DTLB: 4 KByte pages, 8-way set associative, 256 entries
6CH
Cache
DTLB: 2M/4M pages, 8-way set associative, 128 entries
6DH
Cache
DTLB: 1 GByte pages, fully associative, 16 entries
70H
Cache
Trace cache: 12 K-μop, 8-way set associative
71H
Cache
Trace cache: 16 K-μop, 8-way set associative
72H
Cache
Trace cache: 32 K-μop, 8-way set associative
76H
TLB
Instruction TLB: 2M/4M pages, fully associative, 8 entries
78H
Cache
2nd-level cache: 1 MByte, 4-way set associative, 64byte line size
79H
Cache
2nd-level cache: 128 KByte, 8-way set associative, 64 byte line size, 2 lines per sector
7AH
Cache
2nd-level cache: 256 KByte, 8-way set associative, 64 byte line size, 2 lines per sector
7BH
Cache
2nd-level cache: 512 KByte, 8-way set associative, 64 byte line size, 2 lines per sector
7CH
Cache
2nd-level cache: 1 MByte, 8-way set associative, 64 byte line size, 2 lines per sector
7DH
Cache
2nd-level cache: 2 MByte, 8-way set associative, 64byte line size
7FH
Cache
2nd-level cache: 512 KByte, 2-way set associative, 64-byte line size
80H
Cache
2nd-level cache: 512 KByte, 8-way set associative, 64-byte line size
82H
Cache
2nd-level cache: 256 KByte, 8-way set associative, 32 byte line size
83H
Cache
2nd-level cache: 512 KByte, 8-way set associative, 32 byte line size
84H
Cache
2nd-level cache: 1 MByte, 8-way set associative, 32 byte line size
85H
Cache
2nd-level cache: 2 MByte, 8-way set associative, 32 byte line size
86H
Cache
2nd-level cache: 512 KByte, 4-way set associative, 64 byte line size
87H
Cache
2nd-level cache: 1 MByte, 8-way set associative, 64 byte line size
3-248
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-12. Encoding of CPUID Leaf 2 Descriptors (Contd.)
Value
Type
Description
A0H
DTLB
DTLB: 4k pages, fully associative, 32 entries
B0H
TLB
Instruction TLB: 4 KByte pages, 4-way set associative, 128 entries
B1H
TLB
Instruction TLB: 2M pages, 4-way, 8 entries or 4M pages, 4-way, 4 entries
B2H
TLB
Instruction TLB: 4KByte pages, 4-way set associative, 64 entries
B3H
TLB
Data TLB: 4 KByte pages, 4-way set associative, 128 entries
B4H
TLB
Data TLB1: 4 KByte pages, 4-way associative, 256 entries
B5H
TLB
Instruction TLB: 4KByte pages, 8-way set associative, 64 entries
B6H
TLB
Instruction TLB: 4KByte pages, 8-way set associative, 128 entries
BAH
TLB
Data TLB1: 4 KByte pages, 4-way associative, 64 entries
C0H
TLB
Data TLB: 4 KByte and 4 MByte pages, 4-way associative, 8 entries
C1H
STLB
Shared 2nd-Level TLB: 4 KByte/2MByte pages, 8-way associative, 1024 entries
C2H
DTLB
DTLB: 4 KByte/2 MByte pages, 4-way associative, 16 entries
C3H
STLB
Shared 2nd-Level TLB: 4 KByte /2 MByte pages, 6-way associative, 1536 entries. Also 1GBbyte pages, 4-way,
16 entries.
C4H
DTLB
DTLB: 2M/4M Byte pages, 4-way associative, 32 entries
CAH
STLB
Shared 2nd-Level TLB: 4 KByte pages, 4-way associative, 512 entries
D0H
Cache
3rd-level cache: 512 KByte, 4-way set associative, 64 byte line size
D1H
Cache
3rd-level cache: 1 MByte, 4-way set associative, 64 byte line size
D2H
Cache
3rd-level cache: 2 MByte, 4-way set associative, 64 byte line size
D6H
Cache
3rd-level cache: 1 MByte, 8-way set associative, 64 byte line size
D7H
Cache
3rd-level cache: 2 MByte, 8-way set associative, 64 byte line size
D8H
Cache
3rd-level cache: 4 MByte, 8-way set associative, 64 byte line size
DCH
Cache
3rd-level cache: 1.5 MByte, 12-way set associative, 64 byte line size
DDH
Cache
3rd-level cache: 3 MByte, 12-way set associative, 64 byte line size
DEH
Cache
3rd-level cache: 6 MByte, 12-way set associative, 64 byte line size
E2H
Cache
3rd-level cache: 2 MByte, 16-way set associative, 64 byte line size
E3H
Cache
3rd-level cache: 4 MByte, 16-way set associative, 64 byte line size
E4H
Cache
3rd-level cache: 8 MByte, 16-way set associative, 64 byte line size
EAH
Cache
3rd-level cache: 12MByte, 24-way set associative, 64 byte line size
EBH
Cache
3rd-level cache: 18MByte, 24-way set associative, 64 byte line size
ECH
Cache
3rd-level cache: 24MByte, 24-way set associative, 64 byte line size
F0H
Prefetch
64-Byte prefetching
F1H
Prefetch
128-Byte prefetching
FEH
General
CPUID leaf 2 does not report TLB descriptor information; use CPUID leaf 18H to query TLB and other address
translation parameters.
FFH
General
CPUID leaf 2 does not report cache descriptor information, use CPUID leaf 4 to query cache parameters
CPUID-CPU Identification
Vol. 2A
3-249
INSTRUCTION SET REFERENCE, A-L
Example 3-1. Example of Cache and TLB Interpretation
The first member of the family of Pentium 4 processors returns the following information about caches and TLBs
when the CPUID executes with an input value of 2:
EAX
66 5B 50 01H
EBX
0H
ECX
0H
EDX
00 7A 70 00H
Which means:
• The least-significant byte (byte 0) of register EAX is set to 01H. This value should be ignored.
• The most-significant bit of all four registers (EAX, EBX, ECX, and EDX) is set to 0, indicating that each register
contains valid 1-byte descriptors.
• Bytes 1, 2, and 3 of register EAX indicate that the processor has:
- 50H - a 64-entry instruction TLB, for mapping 4-KByte and 2-MByte or 4-MByte pages.
- 5BH - a 64-entry data TLB, for mapping 4-KByte and 4-MByte pages.
- 66H - an 8-KByte 1st level data cache, 4-way set associative, with a 64-Byte cache line size.
• The descriptors in registers EBX and ECX are valid, but contain NULL descriptors.
• Bytes 0, 1, 2, and 3 of register EDX indicate that the processor has:
- 00H - NULL descriptor.
- 70H - Trace cache: 12 K-μop, 8-way set associative.
- 7AH - a 256-KByte 2nd level cache, 8-way set associative, with a sectored, 64-byte cache line size.
- 00H - NULL descriptor.
INPUT EAX = 04H: Returns Deterministic Cache Parameters for Each Level
When CPUID executes with EAX set to 04H and ECX contains an index value, the processor returns encoded data
that describe a set of deterministic cache parameters (for the cache level associated with the input in ECX). Valid
index values start from 0.
Software can enumerate the deterministic cache parameters for each level of the cache hierarchy starting with an
index value of 0, until the parameters report the value associated with the cache type field is 0. The architecturally
defined fields reported by deterministic cache parameters are documented in Table 3-8.
This Cache Size in Bytes
= (Ways + 1) * (Partitions + 1) * (Line_Size + 1) * (Sets + 1)
= (EBX[31:22] + 1) * (EBX[21:12] + 1) * (EBX[11:0] + 1) * (ECX + 1)
The CPUID leaf 04H also reports data that can be used to derive the topology of processor cores in a physical
package. This information is constant for all valid index values. Software can query the raw data reported by
executing CPUID with EAX=04H and ECX=0 and use it as part of the topology enumeration algorithm described in
Chapter 9, “Multiple-Processor Management,” in the Intel® 64 and IA-32 Architectures Software Developer’s
Manual, Volume 3A.
INPUT EAX = 05H: Returns MONITOR and MWAIT Features
When CPUID executes with EAX set to 05H, the processor returns information about features available to
MONITOR/MWAIT instructions. The MONITOR instruction is used for address-range monitoring in conjunction with
MWAIT instruction. The MWAIT instruction optionally provides additional extensions for advanced power manage-
ment. See Table 3-8.
INPUT EAX = 06H: Returns Thermal and Power Management Features
When CPUID executes with EAX set to 06H, the processor returns information about thermal and power manage-
ment features. See Table 3-8.
3-250
Vol. 2A
CPUID-CPU Identification