Vol. 3C 36-7

INTEL® PROCESSOR TRACE

response to software configurable enable controls, PacketEn is not visible to software directly. The relationship of 
PacketEn to the software-visible controls in the configuration MSRs is described in this section.

36.2.5.1   Packet Enable (PacketEn)

When PacketEn is set, the processor is in the mode that Intel PT is monitoring and all packets can be generated to 
log what is being executed. PacketEn is composed of other states according to this relationship:

PacketEn 



 TriggerEn AND ContextEn AND FilterEn AND BranchEn

These constituent controls are detailed in the following subsections.
PacketEn ultimately determines when the processor is tracing. When PacketEn is set, all control flow packets are 
enabled. When PacketEn is clear, no control flow packets are generated, though other packets (timing and book-
keeping packets) may still be sent. See Section 36.2.6 for details of PacketEn and packet generation.
Note that, on processors that do not support IP filtering (i.e., CPUID.(EAX=14H, 
ECX=0):EBX.IPFILT_WRSTPRSV[bit 2] = 0), FilterEn is treated as always set.

36.2.5.2   Trigger Enable (TriggerEn)

Trigger Enable (TriggerEn) is the primary indicator that trace packet generation is active. TriggerEn is set when 
IA32_RTIT_CTL.TraceEn is set, and cleared by any of the following conditions:

•

TraceEn is cleared by software. 

•

A TraceStop condition is encountered and IA32_RTIT_STATUS.Stopped is set.

•

IA32_RTIT_STATUS.Error is set due to an operational error (see Section 36.3.9).

Software can discover the current TriggerEn value by reading the IA32_RTIT_STATUS.TriggerEn bit. When Trig-
gerEn is clear, tracing is inactive and no packets are generated.

36.2.5.3   Context Enable (ContextEn)

Context Enable (ContextEn) indicates whether the processor is in the state or mode that software configured 
hardware to trace. For example, if execution with CPL = 0 code is not being traced (IA32_RTIT_CTL.OS = 0), then 
ContextEn will be 0 when the processor is in CPL0.
Software can discover the current ContextEn value by reading the IA32_RTIT_STATUS.ContextEn bit. ContextEn is 
defined as follows:

ContextEn = !((IA32_RTIT_CTL.OS = 0 AND CPL = 0) OR

(IA32_RTIT_CTL.USER = 0 AND CPL > 0) OR (IS_IN_A_PRODUCTION_ENCLAVE

1

) OR

(IA32_RTIT_CTL.CR3Filter = 1 AND IA32_RTIT_CR3_MATCH does not match CR3)

If the clearing of ContextEn causes PacketEn to be cleared, a Packet Generation Disable (TIP.PGD) packet is gener-
ated, but its IP payload is suppressed. If the setting of ContextEn causes PacketEn to be set, a Packet Generation 
Enable (TIP.PGE) packet is generated.
When ContextEn is 0, control flow packets (TNT, FUP, TIP.*, MODE.*) are not generated, and no Linear Instruction 
Pointers (LIPs) are exposed. However, some packets, such as MTC and PSB (see Section 36.4.2.16 and Section 
36.4.2.17), may still be generated while ContextEn is 0. For details of which packets are generated only when 
ContextEn is set, see Section 36.4.1.
The processor does not update ContextEn when TriggerEn = 0.
The value of ContextEn will toggle only when TriggerEn = 1.

36.2.5.4   Branch Enable (BranchEn)

This value is based purely on the IA32_RTIT_CTL.BranchEn value. If BranchEn is not set, then relevant COFI 
packets (TNT, TIP*, FUP, MODE.*) are suppressed. Other packets related to timing (TSC, TMA, MTC, CYC), as well 

1. Trace packets generation is disabled in a production enclave, see Section 36.2.8.3. See Intel® Software Guard 

Extensions Programming Reference about differences between a production enclave and a debug enclave.