IA-32 Intel® Architecture Software Developer’s Manual Volume 3B: System Programming Guide, Part 2 NOTE: The IA-32 Intel Architecture Software Developer's Manual consists of five volumes: Basic Architecture, Order Number 253665; Instruction Set Reference A-M, Order Number 253666; Instruction Set Reference N-Z, Order Number 253667; System Programming Guide, Part 1, Order Number 253668; System Programming Guide, Part 2, Order Number 253669. Refer to all five volumes when evaluating your design needs. Order Number: 253669-018 January 2006 INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EX- PRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL’S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER, AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RE- LATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FIT- NESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. INTEL PRODUCTS ARE NOT INTENDED FOR USE IN MEDICAL, LIFE SAVING, OR LIFE SUSTAINING APPLICATIONS. Intel may make changes to specifications and product descriptions at any time, without notice. Developers must not rely on the absence or characteristics of any features or instructions marked “reserved” or “undefined.” Improper use of reserved or undefined features or instructions may cause unpredictable behavior or failure in developer's software code when running on an Intel processor. Intel reserves these features or instructions for future definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from their unauthorized use. The Intel® IA-32 architecture processors (e.g., Pentium® 4 and Pentium III processors) may contain design defects or errors known as errata. Current characterized errata are available on request. Hyper-Threading Technology requires a computer system with an Intel® Pentium® 4 processor supporting Hyper-Threading Technology and an HT Technology enabled chipset, BIOS and operating system. Performance will vary depending on the specific hardware and software you use. See http://www.intel.com/techtrends/technologies/hyperthreading.htm for more in- formation including details on which processors support HT Technology. Intel® Virtualization Technology requires a computer system with an enabled Intel® processor, BIOS, virtual machine monitor (VMM) and for some uses, certain platform software enabled for it. Functionality, performance or other benefits will vary de- pending on hardware and software configurations. Intel® Virtualization Technology-enabled BIOS and VMM applications are currently in development. Intel® Extended Memory 64 Technology (Intel® EM64T) requires a computer system with a processor, chipset, BIOS, OS, device drivers and applications enabled for Intel EM64T. Processor will not operate (including 32-bit operation) with- out an Intel EM64T-enabled BIOS. Performance will vary depending on your hardware and software configurations. Intel EM64T-enabled OS, BIOS, device drivers and applications may not be available. Check with your vendor for more information. Intel, Intel386, Intel486, Pentium, Intel Xeon, Intel NetBurst, Intel SpeedStep, OverDrive, MMX, Celeron, and Itanium are trademarks or registered trademarks of Intel Corporation and its subsidiaries in the United States and other countries. *Other names and brands may be claimed as the property of others. Contact your local Intel sales office or your distributor to obtain the latest specifications and before placing your product order. Copies of documents which have an ordering number and are referenced in this document, or other Intel literature, may be obtained from: Intel Corporation P.O. Box 5937 Denver, CO 80217-9808 or call 1-800-548-4725 or visit Intel’s website at http://www.intel.com Copyright © 1997-2006 Intel Corporation 18 Debugging and Performance Monitoring CHAPTER 18 DEBUGGING AND PERFORMANCE MONITORING The IA-32 architecture provides debug facilities for use in debugging code and monitoring performance. These facilities are valuable for debugging application software, system software, and multitasking operating systems. Debug support is accessed using debug registers (DB0 through DB7) and model-specific registers (MSRs): • Debug registers hold the addresses of memory and I/O locations called breakpoints. Breakpoints are user-selected locations in a program, a data-storage area in memory, or specific I/O ports. They are set where a programmer or system designer wishes to halt execution of a program and examine the state of the processor by invoking debugger software. A debug exception (#DB) is generated when a memory or I/O access is made to a breakpoint address. • MSRs (which were introduced into the IA-32 architecture in the P6 family processors) monitor branches, interrupts, and exceptions and record the addresses of the last branch, interrupt or exception taken and the last branch taken before an interrupt or exception. 18.1 OVERVIEW OF THE DEBUGGING SUPPORT FACILITIES The following processor facilities support debugging and performance monitoring: • Debug exception (#DB) — Transfers program control to a debug procedure or task when a debug event occurs. • Breakpoint exception (#BP) — Transfers program control to a debug procedure or task when an INT 3 instruction is executed. • Breakpoint-address registers (DR0 through DR3) — Specifies the addresses of up to 4 breakpoints. • Debug status register (DR6) — Reports the conditions that were in effect when a debug or breakpoint exception was generated. • Debug control register (DR7) — Specifies the forms of memory or I/O access that cause breakpoints to be generated. • T (trap) flag, TSS — Generates a debug exception (#DB) when an attempt is made to switch to a task with the T flag set in its TSS. • RF (resume) flag, EFLAGS register — Suppresses multiple exceptions to the same instruction. • TF (trap) flag, EFLAGS register — Generates a debug exception (#DB) after every execution of an instruction. Vol. 3B 18-1 DEBUGGING AND PERFORMANCE MONITORING • Breakpoint instruction (INT 3) — Generates a breakpoint exception (#BP) that transfers program control to the debugger procedure or task. This instruction is an alternative way to set code breakpoints. It is especially useful when more than four breakpoints are desired, or when breakpoints are being placed in the source code. • Last branch recording facilities — See Section 18.5, “Last Branch, Interrupt, and Exception Recording (Pentium 4 and Intel Xeon Processors)”, and Section 18.7, “Last Branch, Interrupt, and Exception Recording (P6 Family Processors)”. These facilities allow a debugger to be called as a separate task or as a procedure in the context of the current program or task. The following conditions can be used to invoke the debugger: • Task switch to a specific task. • Execution of the breakpoint instruction. • Execution of any instruction. • Execution of an instruction at a specified address. • Read or write of a byte, word, or doubleword at a specified memory address. • Write to a byte, word, or doubleword at a specified memory address. • Input of a byte, word, or doubleword at a specified I/O address. • Output of a byte, word, or doubleword at a specified I/O address. • Attempt to change the contents of a debug register. 18.2 DEBUG REGISTERS The eight debug registers (see Figure 18-1) control the debug operation of the processor. These registers can be written to and read using the move to or from debug register form of the MOV instruction. A debug register may be the source or destination operand for one of these instruc- tions. The debug registers are privileged resources; a MOV instruction that accesses these regis- ters can only be executed in real-address mode, in SMM, or in protected mode at a CPL of 0. An attempt to read or write the debug registers from any other privilege level generates a general- protection exception (#GP). The primary function of the debug registers is to set up and monitor from 1 to 4 breakpoints, numbered 0 though 3. For each breakpoint, the following information can be specified and detected with the debug registers: • The linear address where the breakpoint is to occur. • The length of the breakpoint location (1, 2, or 4 bytes). • The operation that must be performed at the address for a debug exception to be generated. • Whether the breakpoint is enabled. • Whether the breakpoint condition was present when the debug exception was generated. 18-2 Vol. 3B DEBUGGING AND PERFORMANCE MONITORING 31 30 29 28 27 26 25 24 23 22 21 20 1918 17 16 15 1413 12 11 10 9 8 7 6 5 4 3 2 1 0 LEN R/W LEN R/W LEN R/W LEN R/W 0 0 G 001G L G L G L G L G L DR7 3 3 2 2 1 1 0 0 D E E 3 3 2 2 1 1 0 0 31 16 15 1413 12 11 10 9 8 7 6 5 4 3 2 1 0 Reserved (set to 1) B B B 0111111111B B B B T S D 3 2 1 0 DR6 31 0 DR5 31 0 DR4 31 0 Breakpoint 3 Linear Address DR3 31 0 Breakpoint 2 Linear Address DR2 31 0 Breakpoint 1 Linear Address DR1 31 0 Breakpoint 0 Linear Address DR0 Reserved Figure 18-1. Debug Registers The following paragraphs describe the functions of flags and fields in the debug registers. 18.2.1 Debug Address Registers (DR0-DR3) Each of the debug-address registers (DR0 through DR3) holds the 32-bit linear address of a breakpoint (see Figure 18-1). Breakpoint comparisons are made before physical address trans- lation occurs. The contents of debug register DR7 further specifies each breakpoint condition. Vol. 3B 18-3 DEBUGGING AND PERFORMANCE MONITORING 18.2.2 Debug Registers DR4 and DR5 Debug registers DR4 and DR5 are reserved when debug extensions are enabled (when the DE flag in control register CR4 is set), and attempts to reference the DR4 and DR5 registers cause an invalid-opcode exception (#UD) to be generated.