Content      ..     117      118      119      120     ..

Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 119

INTEL® PROCESSOR TRACE

Table 33-47. BIP Encodings (Contd.)

BBP.Type

BIP.ID

State Value

0x0A

0x18

LBR[TOS-29]_TO_IP

0x0A

0x19

LBR[TOS-29]_INFO

0x0A

0x1A

LBR[TOS-30]_FROM_IP

0x0A

0x1B

LBR[TOS-30]_TO_IP

0x0A

0x1C

LBR[TOS-30]_INFO

0x0A

0x1D

LBR[TOS-31]_FROM_IP

0x0A

0x1E

LBR[TOS-31]_TO_IP

0x0A

0x1F

LBR[TOS-31]_INFO

XMM Registers

0x10

0x00

XMM0_Q0

0x10

0x01

XMM0_Q1

0x10

0x02

XMM1_Q0

0x10

0x03

XMM1_Q1

0x10

0x04

XMM2_Q0

0x10

0x05

XMM2_Q1

0x10

0x06

XMM3_Q0

0x10

0x07

XMM3_Q1

0x10

0x08

XMM4_Q0

0x10

0x09

XMM4_Q1

0x10

0x0A

XMM5_Q0

0x10

0x0B

XMM5_Q1

0x10

0x0C

XMM6_Q0

0x10

0x0D

XMM6_Q1

0x10

0x0E

XMM7_Q0

0x10

0x0F

XMM7_Q1

0x10

0x10

XMM8_Q0

0x10

0x11

XMM8_Q1

0x10

0x12

XMM9_Q0

0x10

0x13

XMM9_Q1

0x10

0x14

XMM10_Q0

0x10

0x15

XMM10_Q1

0x10

0x16

XMM11_Q0

0x10

0x17

XMM11_Q1

0x10

0x18

XMM12_Q0

0x10

0x19

XMM12_Q1

0x10

0x1A

XMM13_Q0

0x10

0x1B

XMM13_Q1

0x10

0x1C

XMM14_Q0

Vol. 3C

33-69

INTEL® PROCESSOR TRACE

Table 33-47. BIP Encodings (Contd.)

BBP.Type

BIP.ID

State Value

0x10

0x1D

XMM14_Q1

0x10

0x1E

XMM15_Q0

0x10

0x1F

XMM15_Q1

33.4.2.28 Block End Packet (BEP)

Table 33-48. Block End Packet Definition

Name

BEP

Packet Format

7

6

5

4

3

2

1

0

0

0

0

0

0

0

0

1

0

1

IP

0

1

1

0

0

1

1

Dependencies

TriggerEn

Generation

See BBP.

Scenario

Description

Indicates the end of a packet block. The IP bit indicates if a FUP will follow, and will be set if ContextEn=1.

Application

The block, from initial BBP to the BEP, binds to the FUP IP, if IP=1, and consumes the FUP.

33-70

Vol. 3C

INTEL® PROCESSOR TRACE

33.4.2.29 Control Flow Event (CFE) Packet

Table 33-49. Control Flow Event Packet Definition

Name

CFE

Packet Format

7

6

5

4

3

2

1

0

0

0

0

0

0

0

0

1

0

1

0

0

0

1

0

0

1

1

2

IP

Reserved

Type[4:0]

3

Vector[7:0]

IP bit indicates if a stand-alone FUP will follow.

Dependencies

IA32_RTIT_CTL.EventEn &&

Generation

Software interrupt, external interrupt, user interrupt, or

TriggerEn && ContextEn

Scenario

exception, including those injected on VM entry.

On ContextEn transitions, the CFE

INIT, SIPI, SMI, RSM, IRET, Shutdown.

will be generated regardless of

VM exit, if “Conceal VMX in PT” VMCS exit control is 0.

direction (1→0 or 0→1). VM

VM entry, if “Conceal VMX in PT” VMCS entry control is 0.

exit is an exception, where

TSX Abort.

CFE.VMEXIT depends only on the

prior value of ContextEn.

Description

This packet indicates that an asynchronous event or related event (see list above) has occurred. The type of event

is provided in the packet (see Table 33-50 below), and, if the IP bit is set, the IP at which the event occurred is pro-

vided in a stand-alone FUP packet that follows. Further, in the case of an interrupt or exception, the vector field

provides the vector of the event.

The IP bit will be set only when ContextEn=1 before the event is taken, and either BranchEn=0 or else no FUP is

generated for this event by BranchEn=1. There are some cases, such as SIPI and RSM, where no FUP is generated.

Note that events that are not delivered to software, such as nested events or events which cause a VM exit, do not

generate CFE packets.

Application

If the IP bit is set, a FUP will follow that is stand-alone (not part of a compound packet event), and the CFE con-

sumes the FUP. If the IP bit is not set, the CFE binds to the next FUP if PacketEn=1 (hence the CFE comes after a

TIP.PGE but before the next TIP.PGD), and is stand-alone if PacketEn=0.

CFE Packet Type and Vector Fields

Every CFE has a Type field, which provides the type of event which generated the packet. For a subset of CFE

Types, the CFE.Vector field may be valid. Details on these fields, as well as the IP to be expected in any following

FUP packet, are provided in the table below.

Table 33-50. CFE Packet Type and Vector Fields Details

CFE Subtype

Type

Vector

FUP IP

Details

INTR

0x1

Event Vector

Varies

Used for interrupts (external and software),

Exceptions, Faults, and NMI. FUP contains that address

of the instruction that has not completed (NLIP for trap

events, CLIP for fault events).

IRET

0x2

Invalid

CLIP

SMI

0x3

Invalid

NLIP

RSM

0x4

Invalid

None

SIPI

0x5

SIPI Vector

None

INIT

0x6

Invalid

NLIP

VMENTRY

0x7

Invalid

CLIP

FUP contains IP of VMLAUNCH/VMRESUME.

Vol. 3C

33-71

INTEL® PROCESSOR TRACE

Table 33-50. CFE Packet Type and Vector Fields Details (Contd.)

CFE Subtype

Type

Vector

FUP IP

Details

VMEXIT

0x8

Invalid

Varies

FUP IP varies depending on type of VM exit, but will be

the address of the instruction that has not completed.

Will be consistent with Guest IP saved in VMCS.

VMEXIT_INTR

0x9

Event Vector

Varies

Sent in cases where VM exit was caused by an INTR

event (interrupt, exception, fault, or NMI). Vector

provided is for the event which caused the VM exit.

FUP IP behavior matches that of INTR type above.

SHUTDOWN

0xa

Invalid

Varies

FUP IP varies depending on the type of event that

caused shutdown, but will be the address of the

instruction that has not completed.

Reserved

0xb

N/A

N/A

UINTR

0xc

User Interrupt Vector

NLIP

User interrupt delivered.

UIRET

0xd

Invalid

CLIP

Exiting from user interrupt routine.

Reserved

0xe...0x1f

N/A

N/A

Reserved

33-72

Vol. 3C

INTEL® PROCESSOR TRACE

33.4.2.30 Event Data (EVD) Packet

Table 33-51. Event Data Packet Definition

Name

EVD

Packet Format

7

6

5

4

3

2

1

0

0

0

0

0

0

0

0

1

0

1

0

1

0

1

0

0

1

1

2

Reserved

Type[5:0]

3

Payload[7:0]

4

Payload[15:8]

5

Payload[23:16]

6

Payload[31:24]

7

Payload[39:32]

8

Payload[47:40]

9

Payload[55:48]

10

Payload[63:56]

Dependencies

IA32_RTIT_CTL.EventEn &&

Generation

Page fault, including those injected on VM entry.

TriggerEn && ContextEn

Scenario

VM exit, if “Suppress VMX packets on exit” VMCS exit control

is 0.

Description

Provides additional data about the event that caused the following CFE. The Payload field is dictated by the Type.

Type

Payload

'000000

Page Fault Linear Address, same as CR2 (PFA)

'000001

VMX Exit Qualification (VMXQ)

'000010

VMX Exit Reason (VMXR)

'000011 - '111111

Reserved

EVD packets are never generated in cases where a CFE is not.

Application

EVD packets bind to the same IP (if any) as the subsequent CFE packet.

33.5

TRACING IN VMX OPERATION

On processors that IA32_VMX_MISC[bit 14] reports 1, TraceEn can be set in VMX operation. The VMM can

configure specific VMX controls to control what virtualization-specific data is included within the trace packets (see

Section 33.5.1 for details). The VMM can also configure the VMCS to limit tracing to non-root operation, or to trace

across both root and non-root operation. The VMCS controls exist to simplify virtualization of Intel PT for guest use,

including the “Clear IA32_RTIT_CTL” exit control (See Section 25.7.1), “Load IA32_RTIT_CTL” entry control (See

Section 25.8.1), and “Intel PT uses guest physical addresses” execution control (See Section 26.5.3).

For older processors that do not support these VMCS controls, the MSR-load areas used by VMX transitions can be

employed by the VMM to restrict tracing to the desired context. See Section 33.5.2 for details. Tracing with SMM

Transfer Monitor is described in Section 33.6.

Vol. 3C

33-73

INTEL® PROCESSOR TRACE

33.5.1 VMX-Specific Packets and VMCS Controls

In all of the usages of VMX and Intel PT, a decoder in the host or VMM context can identify the occurrences of VMX

transitions with the aid of VMX-specific packets. There are four kinds of packets relevant to VMX:

• VMCS packet. The VMX transitions of individual VMs can be distinguished by a decoder using the VMCS-

pointer field in a VMCS packet. A VMCS packet is sent on a successful execution of VMPTRLD, and its VMCS-

pointer field stores the VMCS pointer loaded by that execution. See Section 33.4.2.15 for details.

• The NR (non-root) bit in a PIP packet. Normally, the NR bit is set in any PIP packet generated in VMX non-

root operation. In addition, PIP packets are generated with each VM entry and VM exit. Thus a transition of the

NR bit from 0 to 1 indicates the occurrence of a VM entry, and a transition of 1 to 0 indicates the occurrence of

a VM exit.

• CFE packet. Identifies VM exit and VM entry operations.

• EVD packet. Provides the exit reason and exit qualification for VM exits.

There are VMX controls that a VMM can set to conceal some of this VMX-specific information (by suppressing its

recording) and thereby prevent it from leaking across virtualization boundaries. There is one of these controls

(each of which is called “conceal VMX from PT”) of each type of VMX control.

Table 33-52. VMX Controls For Intel Processor Trace

Type of VMX

Bit

Value

Behavior

Control

Position¹

Secondary

19

0

Each PIP generated in VM non-root operation will set the NR bit.

processor-based

PSB+ in VMX non-root operation will include the VMCS packet, to ensure that the decoder

VM-execution

knows which guest is currently in use.

control

1

Each PIP generated in VMX non-root operation will clear the NR bit.

PSB+ in VMX non-root operation will not include the VMCS packet.

VM-exit control

24

0

Each VM exit generates a PIP in which the NR bit is clear, and a CFE/EVD if Event Trace is

enabled.

In addition, SMM VM exits generate VMCS packets.

1

VM exits do not generate PIPs, CFEs, or EVDs, and no VMCS packets are generated on SMM

VM exits.

VM-entry control

17

0

Each VM entry generates a PIP in which the NR bit is set (except VM entries that return

from SMM to VMX root operation), and a CFE if Event Trace is enabled.

In addition, VM entries that return from SMM generate VMCS packets.

1

VM entries do not generate PIPs or CFEs, and no VMCS packets are generated on

VM entries that return from SMM.

NOTES:

1. These are the positions of the control bits in the relevant VMX control fields.

The 0-settings of these VMX controls enable all VMX-specific packet information. The scenarios that would use

these default settings also do not require the VMM to use VMX MSR-load areas to enable and disable trace-packet

generation across VMX transitions.

If IA32_VMX_MISC[bit 14] reports 0, the 1-settings of the VMX controls in Table 33-52 are not supported, and

VM entry will fail on any attempt to set them.

33.5.2 Managing Trace Packet Generation Across VMX Transitions

In tracing scenarios that collect packets for both VMX root operation and VMX non-root operation, a host executive

can manage the MSRs associated with trace packet generation directly. The states of these MSRs need not be modi-

fied across VMX transitions.

For tracing scenarios that collect packets only within VMX root operation or only within VMX non-root operation, the

VMM can toggle IA32_RTIT_CTL.TraceEn on VMX transitions.

33-74

Vol. 3C

INTEL® PROCESSOR TRACE

33.5.2.1 System-Wide Tracing

When a host or VMM configures Intel PT to collect trace packets of the entire system, it can leave the relevant VMX

controls clear to allow VMX-specific packets to provide information across VMX transitions.

The decoder will desire to identify the occurrence of VMX transitions. The packets of interests to a decoder are

shown in Table 33-53.

Table 33-53. Packets on VMX Transitions (System-Wide Tracing)

Event

Packets

Enable

Description

VM exit

EVD.VMXR,

EventEn

The CFE identifies the transfer as a VM exit, while the associated EVDs

EVD.VMXQ,

provide the exit reason and exit qualification.

CFE.VMEXIT*

FUP(GuestIP)

BranchEn or

The FUP indicates at which point in the guest flow the VM exit occurred. This

EventEn

is important, since VM exit can be an asynchronous event. The IP will match

that written into the VMCS.

PIP(HostCR3, NR=0)

The PIP packet provides the new host CR3 value, as well as indication that

the logical processor is entering VMX root operation. This allows the decoder

to identify the change of executing context from guest to host and load the

appropriate set of binaries to continue decode.

TIP(HostIP)

BranchEn

The TIP indicates the destination IP, the IP of the first instruction to be

executed in VMX root operation.

Note, this packet could be preceded by a MODE.Exec packet (Section

33.4.2.8). This is generated only in cases where CS.D or (CS.L & EFER.LMA)

change during the transition.

VM entry

CFEVMENTRY,

EventEn

The CFE identifies the transfer as a VM entry, while the FUP identifies the

VMLAUNCH/VMRESUME IP.

FUP(CLIP)

PIP(GuestCR3, NR=1)

BranchEn

The PIP packet provides the new guest CR3 value, as well as indication that

the logical processor is entering VMX non-root operation. This allows the

decoder to identify the change of executing context from host to guest and

load the appropriate set of binaries to continue decode.

TIP(GuestIP)

BranchEn

The TIP indicates the destination IP, the IP of the first instruction to be

executed in VMX non-root operation. This should match the RIP loaded from

the VMCS.

Note, this packet could be preceded by a MODE.Exec packet (Section

33.4.2.8). This is generated only in cases where CS.D or (CS.L & EFER.LMA)

change during the transition.

Since the VMX controls that suppress packet generation are cleared, a VMCS packet will be included in all PSB+ for

this usage scenario. Additionally, VMPTRLD will generate such a packet. Thus the decoder can distinguish the

execution context of different VMs.

When the host VMM configures a system to collect trace packets in this scenario, it should emulate CPUID to report

CPUID.(EAX=07H, ECX=0):EBX[bit 26] as 0 to guests, indicating to guests that Intel PT is not available.

VMX TSC Manipulation

The TSC packets generated while in VMX non-root operation will include any changes resulting from the use of a

VMM’s use of the TSC offsetting or TSC scaling VMX controls (see Chapter 26, “VMX Non-Root Operation”). In this

system-wide usage model, the decoder may need to account for the effect of per-VM adjustments in the TSC

packets generated in VMX non-root operation and the absence of TSC adjustments in TSC packets generated in

VMX root operation. The VMM can supply this information to the decoder.

33.5.2.2 Guest-Only Tracing

A VMM can configure trace-packet generation while in VMX non-root operation for guests executing normally. This

is accomplished by utilizing VMCS controls to manipulate the guest IA32_RTIT_CTL value on VMX transitions. For

Vol. 3C

33-75

INTEL® PROCESSOR TRACE

older processors that do not support these VMCS controls, a VMM can use the VMX MSR-load areas on VM exits

(see Section 25.7.2, “VM-Exit Controls for MSRs”) and VM entries (see Section 25.8.2, “VM-Entry Controls for

MSRs”) to limit trace-packet generation to the guest environment.

For this usage, VM entry is programmed to enable trace packet generation, while VM exit is programmed to clear

IA32_RTIT_CTL.TraceEn so as to disable trace-packet generation in the host. Further, if it is preferred that the

guest packet stream contain no indication that execution was in VMX non-root operation, the VMM should set to 1

all the VMX controls enumerated in Table 33-52.

33.5.2.3 Emulation of Intel PT Traced State

If a VMM emulates an element of processor state by taking a VM exit on reads and/or writes to that piece of state,

and the state element impacts Intel PT packet generation or values, it may be incumbent upon the VMM to insert

or modify the output trace data.

If a VM exit is taken on a guest write to CR3 (including “MOV CR3” as well as task switches), the PIP packet

normally generated on the CR3 write will be missing.

To avoid decoder confusion when the guest trace is decoded, the VMM should emulate the missing PIP by writing it

into the guest output buffer. If the guest CR3 value is manipulated, the VMM may also need to manipulate the

IA32_RTIT_CR3_MATCH value, in order to ensure the trace behavior matches the guest's expectation.

Similarly, if a VMM emulates the TSC value by taking a VM exit on RDTSC, the TSC packets generated in the trace

may mismatch the TSC values returned by the VMM on RDTSC. To ensure that the trace can be properly aligned

with software logs based on RDTSC, the VMM should either make corresponding modifications to the TSC packet

values in the guest trace, or use mechanisms such as TSC offsetting or TSC scaling in place of exiting.

33.5.2.4 TSC Scaling

When TSC scaling is enabled for a guest using Intel PT, the VMM should ensure that the value of Maximum Non-

Turbo Ratio[15:8] in MSR_PLATFORM_INFO (MSR 0CEH) and the TSC/”core crystal clock” ratio (EBX/EAX) in CPUID

leaf 15H are set in a manner consistent with the resulting TSC rate that will be visible to the VM. This will allow the

decoder to properly apply TSC packets, MTC packets (based on the core crystal clock or ART, whose frequency is

indicated by CPUID leaf 15H), and CBR packets (which indicate the ratio of the processor frequency to the Max

Non-Turbo frequency). Absent this, or separate indication of the scaling factor, the decoder will be unable to prop-

erly track time in the trace. See Section 33.8.3 for details on tracking time within an Intel PT trace.

33.5.2.5 Failed VM Entry

The packets generated by a failed VM entry depend both on the VMCS configuration, as well as on the type of

failure. The results to expect are summarized in the table below. Note that packets in italics may or may not be

generated, depending on implementation choice, and the point of failure.

Table 33-54. Packets on a Failed VM Entry

Usage Model

Entry Configuration

Early Failure (fall

Late Failure (VM exit like)

through to next IP)

System-Wide

No use of “Load

TIP (NextIP)

CFE.VMENTRY, FUP(CLIP) if EventEn=1

IA32_RTIT_CTL” entry

PIP(Guest CR3, NR=1), TraceEn 0→1 Packets (See Section

control or VM-entry

33.2.8.3), PIP(HostCR3, NR=0), TIP(HostIP)

MSR-load area

VMM Only

“Load IA32_RTIT_CTL”

TIP (NextIP)

TraceEn 0→1 Packets (See Section 33.2.8.3), TIP(HostIP)

entry control or VM-

entry MSR-load area

used to clear TraceEn

VM Only

“Load IA32_RTIT_CTL”

None

None

entry control or VM-

entry MSR-load area

used to set TraceEn

33-76

Vol. 3C

INTEL® PROCESSOR TRACE

33.5.2.6 VMX Abort

VMX abort conditions take the processor into a shutdown state. On a VM exit that leads to VMX abort, some

packets (FUP, PIP) may be generated, but any expected TIP, TIP.PGE, or TIP.PGD may be dropped.

33.6

TRACING AND SMM TRANSFER MONITOR (STM)

The SMM-transfer monitor (STM) is a VMM that operates inside SMM while in VMX root operation. An STM operates

in conjunction with an executive monitor. The latter operates outside SMM and in VMX root operation. Transitions

from the executive monitor or its VMs to the STM are called SMM VM exits. The STM returns from SMM via a

VM entry to the VM in VMX non-root operation or the executive monitor in VMX root operation.

Intel PT supports tracing in an STM similar to tracing support for VMX operation as described above in Section 33.5.

As a result, on a SMM VM exit resulting from #SMI, TraceEn is neither saved nor cleared by default. Software can

save the state of the trace configuration MSRs and clear TraceEn using the MSR load/save lists.

Within Event Trace, SMM VM exits generate packets indicating both an #SMI and a VM exit. Similarly, VM entries

that return from SMM generate packets that indicate both an RSM and a VM entry. SMM VM exits initiated by the

VMCALL instruction do not generate any CFE packet, though the subsequent VM entry returning from SMM will

generate a CFE.RSM.

33.7

PACKET GENERATION SCENARIOS

The following tables provides examples of packet generation for various operations. The following acronyms are

used in the packet examples below:

• CLIP - Current LIP

• NLIP - Next Sequential LIP

• BLIP - Branch Target LIP

Table 33-55 illustrates the packets generated by a series of example operations, assuming that PacketEn

(TriggerEn && ContextEn && FilterEn && BranchEn) is set before and after the operation.

Table 33-55. Packet Generation under Different Example Operations

Case

Operation

Details

Packets

1

Normal non-jump operation

None

2

Conditional branch

6th branch in internal TNT buffer

TNT

3

Conditional branch

1^st..5^th branch in internal TNT buffer

None

4

Near indirect JMP or CALL

TIP(BLIP)

5

Direct near JMP or CALL

None

6

Near RET

Uncompressed

TIP(BLIP)

7

Near RET

Compressed, 6th branch in internal TNT buffer

TNT

8

Far Branch

Assumes no update to CR3, CS.L, or CS.D

TIP(BLIP)

9

Far Branch

Assumes update to CR3

PIP(NewCR3), TIP(BLIP)

10

Far Branch

Assumes update to CR3 and CS.D/CS.L

PIP(NewCR3), MODE.Exec, TIP(BLIP)

11

External Interrupt or NMI

Assumes no update to CR3, CS.D, or CS.L

FUP(NLIP), TIP(BLIP)

12

External Interrupt or NMI

Assumes update to CR3 and CS.D/CS.L

FUP(NLIP), PIP(NewCR3),

MODE.Exec, TIP(BLIP)

13

Exception/Fault or Software Interrupt

Assumes no update to CR3, CS.D, or CS.L

FUP(CLIP), TIP(BLIP)

14

MOV to CR3

PIP(NewCR3, NR)

Vol. 3C

33-77

INTEL® PROCESSOR TRACE

Table 33-55. Packet Generation under Different Example Operations

Case

Operation

Details

Packets

15

VM exit

Assumes system-wide tracing, see Section

See Table 33-53

33.5.2.1

16

VM entry

Assumes system-wide tracing, see Section

See Table 33-53

33.5.2.1

17

ENCLU[EENTER] / ENCLU[ERESUME] /

Only debug enclaves allow PacketEn to be set

FUP(CLIP), TIP(BLIP)

ENCLU[EEXIT] / AEX/EEE

during enclave execution. Assumes no change

to CS.L or CS.D.

18

XBEGIN/XACQUIRE/XEND/XRELEASE

Does not begin/end transactional execution

None

19

XBEGIN/XACQUIRE

Assumes beginning of transactional execution

MODE.TSX(InTX=1, TXAbort=0),

FUP(CLIP)

20

XEND/XRELEASE

Completes transaction

MODE.TSX(InTX=0, TXAbort=0),

FUP(CLIP)

21

XABORT or Asynchronous Abort

Aborts transactional execution

MODE.TSX(InTX=0, TXAbort=1),

FUP(CLIP), TIP(BLIP)

22

INIT

On BSP. Assumes no CR3, CS.D, or CS.L update.

FUP(NLIP), TIP(ResetLIP)

23

INIT

On AP, goes to wait-for-SIPI. Assumes no CR3

FUP(NLIP)

update.

24

SIPI

Assumes no CS.D or CS.L update

TIP.PGE(SIPI.LIP)

25

Wake from state deeper than C0.1, P-

TSC?, TMA?, CBR

TSC if TSCEn=1

state change, or other scenario where

TMA if TSCEn=MTCEn=1

timing packets (MTC, CYC) may have

ceased.

26

UINTR

User interrupt handler entry.

FUP(NLIP)

27

UIRET

Exiting from user interrupt handler.

FUP(NLIP)

Table 33-56 illustrates the packets generated in example scenarios where the operation alters the value of

PacketEn. Note that insertion of PSB+ is not included here, though it can be coincident with initial enabling of Intel

PT. See Section 33.3.7 for details.

Table 33-56. Packet Generation with Operations That Alter the Value of PacketEn

Case

Operation

PktEn

PktEn

CntxEn

Details

Packets

Before

After

After

1

WRMSR/XRSTORS that

0

1

0

TSC if TSCEn=1;

TSC?, TMA?, CBR, MODE.Exec

changes TraceEn 0 → 1

TMA if TSCEn=MTCEn=1

2

WRMSR/XRSTORS that

0

1

1

TSC if TSCEn=1;

TSC?, TMA?, CBR, MODE.Exec,

changes TraceEn 0 → 1

TMA if TSCEn=MTCEn=1

TIP.PGE(NLIP)

3

WRMSR that changes

1

0

D.C.

FUP(CLIP), TIP.PGD()

TraceEn 1 → 0

4

Taken Branch

1

0

1

Source is in IP filter region.

TIP.PGD(BLIP)

Target is outside IP filter region.

5

Taken Branch, Interrupt,

0

1

1

Source is outside IP filter region.

TIP.PGE(BLIP)

EEXIT, etc.

Target is in IP filter region.

6

Far Branch, Interrupt, EEN-

1

0

0

Requires change to CPL or CR3,

TIP.PGD()

TER, etc.

or entry to opt-out enclave.

33-78

Vol. 3C

INTEL® PROCESSOR TRACE

Table 33-56. Packet Generation with Operations That Alter the Value of PacketEn (Contd.)

Case

Operation

PktEn

PktEn

CntxEn

Details

Packets

Before

After

After

7

Trap-like event (external

1

0

0

Requires change to CPL or CR3.

FUP(NLIP), TIP.PGD()

interrupt, NMI, VM exit/entry,

etc.)

8

Fault-like event (excep-

1

0

0

Requires change to CPL or CR3.

FUP(CLIP), TIP.PGD()

tion/fault, software inter-

rupt, VM exit/entry, etc.)

9

SMI, VM exit/entry

1

0

0

TraceEn is cleared.

FUP(NLIP), TIP.PGD()

10

RSM, VM exit/entry

0

1

1

TraceEn is set.

See Case 2 for packets on

enable. FUP/TIP.PGE IP is the

BLIP.

11

VM Exit

1

0

0

Assumes guest-only tracing, see

FUP(VMCSg.RIP), TIP.PGD()

Section 33.5.2.2.

TraceEn is cleared.

12

VM entry

0

1

1

Assumes guest-only tracing, see

TIP.PGE(VMCSg.RIP)

Section 33.5.2.2.

TraceEn is set.

Table 33-57 illustrates examples of PTWRITE, assuming TriggerEn && PTWEn is true.

Table 33-57. Examples of PTWRITE when TriggerEn && PTWEn is True

Case

Operation

ContextEn

Details

Packets

1

MWAIT/UMWAIT gets fault or VM exit.

D.C.

None.

Other trace sources may generate pack-

ets on fault or VM exit.

2

MWAIT/UMWAIT requests C0, or moni-

D.C.

None.

tor not armed, or VMX virtual-interrupt

delivery.

3

MWAIT/UMWAIT enters C-state deeper

0

PWRE(Cx), EXSTOP

than C0.1.

4

MWAIT/UMWAIT enters C-state deeper

1

MWAIT(Cy), PWRE(Cx), EXSTOP(IP),

than C0.1.

FUP(CLIP)

5

HLT, Triple-fault shutdown, other oper-

1

PWRE(C1), EXSTOP(IP), FUP(CLIP)

ation that enters C1.

6

Hardware Duty Cycling (HDC).

1

TSC if TSCEn=1

PWRE(HW, C6), EXSTOP(IP), FUP(NLIP),

TMA if TSCEn=MTCEn=1

TSC?, TMA?, CBR, PWRX(CC6, CC6, 0x8)

7

Wake event during Cx (x > 0).

D.C.

TSC if TSCEn=1

TSC?, TMA?, CBR, PWRX(LCC, DCC, 0x1)

TMA if TSCEn=MTCEn=1

Other trace sources may generate pack-

ets for the wake operation (e.g., inter-

rupt).

Table 33-58 illustrates examples of Power Event Trace, assuming TriggerEn && PwrEvtEn is true.

Table 33-58. Examples of Power Event Trace when TriggerEn && PwrEvtEn is True

Case

Operation

ContextEn

Details

Packets

&&

FilterEn

1

PTWRITE rm32/64

0

None

Vol. 3C

33-79

INTEL® PROCESSOR TRACE

Table 33-58. Examples of Power Event Trace when (Contd.)TriggerEn && PwrEvtEn is True

Case

Operation

ContextEn

Details

Packets

&&

FilterEn

2

PTWRITE rm32

1

FUP, PTW.IP=1 if FUPonPTW=1

PTW(IP=1?, 4B, rm32_value),

FUP(CLIP)?

3

PTWRITE rm64

1

FUP, PTW.IP=1 if FUPonPTW=1

PTW(IP=1?, 8B, rm64_value),

FUP(CLIP)?

Table 33-59 illustrates examples of Event Trace, assuming TriggerEn && ContextEn && EventEn is true. In all cases,

other trace sources (e.g., BranchEn), if enabled, may generate additional packets. For details, see the other tables

in this section.

Table 33-59. Event Trace Examples when TriggerEn && ContextEn && EventEn is True

Case

Operation

ContextEn

ContextEn

Details

Packets

Before

After

1

IRET

1

D.C.

CFE.IRET(IP=1), FUP(CLIP)

2

IRET

0

1

CFE(IRET)

3

External interrupt, including

1

D.C.

CFE.INTR(IP=1, Vector), FUP(NLIP)

NMI

4

External interrupt, including

1

1

Assumes BranchEn=1,

CFE.INTR(IP=0, Vector), FUP(NLIP),

NMI

illustrates the shared FUP.

TIP(BLIP)

5

SW Interrupt, Exception/Fault

1

D.C.

CFE.INTR(IP=1, Vector), FUP(CLIP)

other than #PF

6

Page Fault (#PF)

1

D.C.

EVD.PFA, CFE.INTR(IP=1,14),

FUP(CLIP)

7

Page Fault (#PF)

0

D.C.

None

10

SMI

1

D.C.

CFE.SMI(IP=1), FUP(NLIP)

11

RSM, TraceEn restored to 1

D.C.

1

CFE.RSM(IP=0)

12

Entry to Shutdown

1

D.C.

CFE.SHUTDOWN(IP=1), FUP(CLIP)

13

VM exit caused by interrupt,

1

D.C.

Assumes “Conceal VMX in

EVD.VMXQ, EVD.VMXR,

fault, or SMI

PT” exit control is 0.

CFE.VMEXIT_INTR(IP=1, Vector),

FUP(VMCSg.LIP)

14

VM exit caused by other than

1

D.C.

Assumes “Conceal VMX in

EVD.VMXQ, EVD.VMXR,

interrupt, fault, or SMI

PT” exit control is 0.

CFE.VMEXIT(IP=1), FUP(VMCSg.LIP)

15

VM exit caused by other than

0

1

Assumes “Conceal VMX in

CFE.VMEXIT(IP=0)

interrupt, fault, or SMI

PT” exit control is 0.

16

VM entry

1

D.C.

Assumes “Conceal VMX in

CFE.VMENTRY(IP=1), FUP(VMCSh.LIP)

PT” entry control is 0.

17

AEX/EEE, from opt-out (non-

0

0

None

debug) enclave

18

AEX/EEE, from opt-out (non-

0

1

CFE.INTR(IP=0)

debug) enclave

19

AEX, from opt-in (debug)

1

D.C.

CFE.INTR(IP=1, Vec), FUP(AEP LIP)

enclave

20

INIT

1

D.C.

CFE.INIT(IP=1), FUP(NLIP)

21

SIPI

1

D.C.

CFE.SIPI(IP=0)

33-80

Vol. 3C

INTEL® PROCESSOR TRACE

Table 33-59. Event Trace Examples when TriggerEn && ContextEn && EventEn is True

Case

Operation

ContextEn

ContextEn

Details

Packets

Before

After

22

STI/CLI/POPF

1

1

Assumes a change to

MODE.Exec, FUP(CLIP)

RFLAGS.IF.

33.8

SOFTWARE CONSIDERATIONS

33.8.1 Tracing SMM Code

Nothing prevents an SMM handler from configuring and enabling packet generation for its own use. As described in

Section Section 33.2.9.3, SMI will always clear TraceEn, so the SMM handler would have to set TraceEn in order to

enable tracing. There are some unique aspects and guidelines involved with tracing SMM code, which follow:

1. SMM should save away the existing values of any configuration MSRs that SMM intends to modify for tracing.

This will allow the non-SMM tracing context to be restored before RSM.

2. It is recommended that SMM wait until it sets CSbase to 0 before enabling packet generation, to avoid possible

LIP vs RIP confusion.

3. Packet output cannot be directed to SMRR memory, even while tracing in SMM.

4. Before performing RSM, SMM should take care to restore modified configuration MSRs to the values they had

immediately after #SMI. This involves first disabling packet generation by clearing TraceEn, then restoring any

other configuration MSRs that were modified.

5. RSM

— Software must ensure that TraceEn=0 at the time of RSM. Tracing RSM is not a supported usage model, and

the packets generated by RSM are undefined.

— For processors on which Intel PT and LBR use are mutually exclusive (see Section 33.3.1.2), any RSM

during which TraceEn is restored to 1 will suspend any LBR or BTS logging.

33.8.2 Cooperative Transition of Multiple Trace Collection Agents

A third-party trace-collection tool should take into consideration the fact that it may be deployed on a processor

that supports Intel PT but may run under any operating system.

In such a deployment scenario, Intel recommends that tool agents follow similar principles of cooperative transition

of single-use hardware resources, similar to how performance monitoring tools handle performance monitoring

hardware:

• Respect the “in-use” ownership of an agent who already configured the trace configuration MSRs, see architec-

tural MSRs with the prefix “IA32_RTIT_” in Chapter 2, “Model-Specific Registers (MSRs)‚” in the Intel^® 64 and

IA-32 Architectures Software Developer’s Manual, Volume 4, where “in-use” can be determined by reading the

“enable bits” in the configuration MSRs.

• Relinquish ownership of the trace configuration MSRs by clearing the “enabled bits” of those configuration

MSRs.

33.8.3 Tracking Time

This section describes the relationships of several clock counters whose update frequencies reside in different

domains that feed into the timing packets. To track time, the decoder also needs to know the regularity or irregu-

larity of the occurrences of various timing packets that store those clock counters.

Intel PT provides time information for three different but related domains:

Vol. 3C

33-81

Content      ..     117      118      119      120     ..