Geoff Chappell, Software Analyst
The CPU_VENDORS enumeration is a convenient classification of the vendor string that the cpuid instruction’s leaf 0 produces in the ebx, edx and ecx registers. The recognised vendors and the corresponding values in the enumeration are specific to the processor architecture. This page concerns itself only with 32-bit Windows for the processor architecture that’s variously named i386 or x86. The x64 CPU_VENDORS is presented separately.
From as far back as version 3.50 (but specifically not in version 3.10), the kernel saves each processor’s vendor string into the processor’s KPRCB as the VendorString member. At first, the kernel cared only whether the processor is from Intel or AMD, the first to be checked for the VME, TSC and MCE bits in the feature flags produced in edx from cpuid leaf 1, the second to be checked just for VME and TSC. A small reorganisation for version 4.0, perhaps motivated by the addition of Cyrix to the recognised vendors and the expansion of features to check, sees the vendor string get classified to a 32-bit number. This is here taken as the origin of the CPU_VENDORS enumeration. Version 6.0 starts recording this classification in the KPRCB as the 8-bit CpuVendor. That the 32-bit number is formally an enumeration named CPU_VENDORS is not known for certain until it starts turning up in public symbol files for the kernel in Windows 8. The possible values are:
|Value||Name||CPU Vendor String||Versions|
|0||CPU_NONE||4.0 and higher|
|1||CPU_INTEL||GenuineIntel||4.0 and higher|
|2||CPU_AMD||AuthenticAMD||4.0 and higher|
|3||CPU_CYRIX||CyrixInstead||4.0 and higher|
|4||CPU_TRANSMETA||GenuineTMx86||5.1 and higher|
|CentaurHauls||5.1 and higher|
late 5.2 and higher
6 (early 5,1, early 5.2);
Though the CPU_VENDORS enumeration is not documented, Microsoft’s names for its values are known from public symbol files for the kernel starting with Windows 8. They are also in private symbol files that Microsoft has distributed in downloadable packages of public symbols. These are notable because they are for user-mode modules which have no known access to the enumeration but pick up its definition because a source file includes the NTOSP.H header. Microsoft does not ordinarily publish this header but its possibly accidental disclosure in early editions of the Windows Driver Kit (WDK) for Windows 10 means that the full C-language definition in this header must now be considered published. The same names for some, but not all, are reproduced in the assembly-language KS386.INC from the WDK starting with Windows Vista. For versions before Windows Vista, the table above describes usage by the kernel and assumes continuity with the names as known for later versions.
In version 5.0 and higher, CPU_NONE means specifically that no vendor string is known (cpuid being absent or unusable) and CPU_UNKNOWN means that a vendor string is obtained but is not recognised. The x86 kernel has always tolerated processors from unrecognised vendors. (It may treat them poorly, but at least it does not reject them.)
Though CPU_VIA and CPU_CENTAUR are established as aliases by symbol files for version 6.2 and higher, and a comment in NTOSP.H is plain that CPU_CENTAUR is the older, it is not known which earlier version introduced CPU_VIA.