36-44 Vol. 3C

INTEL® PROCESSOR TRACE

FUP IP Payload

Flow Update Packet gives the source address of an instruction when it is needed. In general, branch instructions do 
not need a FUP, because the source address is clear from the disassembly. For asynchronous events, however, the 
source address cannot be inferred from the source, and hence a FUP will be sent. Table 36-23 illustrates cases 
where FUPs are sent, and which IP can be expected in those cases.

On a canonical fault due to sequentially fetching an instruction in non-canonical space (as opposed to jumping to 
non-canonical space), the IP of the fault (and thus the payload of the FUP) will be a non-canonical address. This is 
consistent with what is pushed on the stack for such faulting cases.
If there are post-commit task switch faults, the IP value of the FUP will be the original IP when the task switch 
started. This is the same value as would be seen in the LBR_FROM field. But it is a different value as is saved on the 
stack or VMCS.

Table 36-23. FUP Cases and IP Payload

Event

Flow Update IP

Comment

External Interrupt, NMI/SMI, Traps, 

Machine Check (trap-like), INIT/SIPI

Address of next instruction (Next IP) that 

would have been executed

Functionally, this matches the LBR FROM field 

value and also the EIP value which is saved onto 

the stack.

Exceptions/Faults, Machine check 

(fault-like)

Address of the instruction which took the
exception/fault (Current IP)

This matches the similar functionality of LBR 

FROM field value and also the EIP value which is 

saved onto the stack.

Software Interrupt

Address of the software interrupt instruction 

(Current IP)

This matches the similar functionality of LBR 

FROM field value, but does not match the EIP 

value which is saved onto the stack (Next 

Linear Instruction Pointer - NLIP).

EENTER, EEXIT, ERESUME, Enclave 

Exiting Event (EEE), AEX

1

 

NOTES:

1. Information on EENTER, EEXIT, ERESUME, EEE, Asynchronous Enclave eXit (AEX) can be found in Intel® Soft-

ware Guard Extensions Programming Reference.

Current IP of the instruction

This matches the LBR FROM field value and also 

the EIP value which is saved onto the stack.

XACQUIRE

Address of the X* instruction

XRELEASE, XBEGIN, XEND, 

XABORT, other transactional abort

Current IP

#SMI

IP that is saved into SMRAM

WRMSR that clears TraceEn

Current IP