Vol. 3 16-37
DEBUGGING, PROFILING BRANCHES AND TIME-STAMP COUNTER
• IA32_MISC_ENABLE MSR — Indicates that the processor provides the BTS
facilities.
• Last branch record (LBR) stack — The LBR stack is a circular stack that
consists of four MSRs (MSR_LASTBRANCH_0 through MSR_LASTBRANCH_3) for
the Pentium 4 and Intel Xeon processor family [CPUID family 0FH, models 0H-
02H]. The LBR stack consists of 16 MSR pairs (MSR_LASTBRANCH_0_FROM_LIP
through MSR_LASTBRANCH_15_FROM_LIP and MSR_LASTBRANCH_0_TO_LIP
through MSR_LASTBRANCH_15_TO_LIP) for the Pentium 4 and Intel Xeon
processor family [CPUID family 0FH, model 03H].
• Last branch record top-of-stack (TOS) pointer — The TOS Pointer MSR
contains a 2-bit pointer (0-3) to the MSR in the LBR stack that contains the most
recent branch, interrupt, or exception recorded for the Pentium 4 and Intel Xeon
processor family [CPUID family 0FH, models 0H-02H]. This pointer becomes a
4-bit pointer (0-15) for the Pentium 4 and Intel Xeon processor family [CPUID
family 0FH, model 03H]. See also: Table 16-10, Figure 16-12, and Section
16.7.2, “LBR Stack for Processors Based on Intel NetBurst Microarchitecture.”
• Last exception record — See Section 16.7.3, “Last Exception Records.”
16.7.1 MSR_DEBUGCTLA MSR
The MSR_DEBUGCTLA MSR enables and disables the various last branch recording
mechanisms described in the previous section. This register can be written to using
the WRMSR instruction, when operating at privilege level 0 or when in real-address
mode. A protected-mode operating system procedure is required to provide user
access to this register. Figure 16-12 shows the flags in the MSR_DEBUGCTLA MSR.
The functions of these flags are as follows:
• LBR (last branch/interrupt/exception) flag (bit 0) — When set, the
processor records a running trace of the most recent branches, interrupts, and/or
exceptions taken by the processor (prior to a debug exception being generated)
in the last branch record (LBR) stack. Each branch, interrupt, or exception is
recorded as a 64-bit branch record. The processor clears this flag whenever a
debug exception is generated (for example, when an instruction or data
breakpoint or a single-step trap occurs). See Section 16.7.2, “LBR Stack for
Processors Based on Intel NetBurst Microarchitecture.”
• BTF (single-step on branches) flag (bit 1) — When set, the processor treats
the TF flag in the EFLAGS register as a “single-step on branches” flag rather than
a “single-step on instructions” flag. This mechanism allows single-stepping the
processor on taken branches, interrupts, and exceptions. See Section 16.4.3,
“Single-Stepping on Branches, Exceptions, and Interrupts.”
• TR (trace message enable) flag (bit 2) — When set, branch trace messages
are enabled. Thereafter, when the processor detects a taken branch, interrupt, or
exception, it sends the branch record out on the system bus as a branch trace
message (BTM). See Section 16.4.4, “Branch Trace Messages.”