Vol. 3C 36-45
INTEL® PROCESSOR TRACE
36.4.2.7 Paging Information (PIP) Packet
Table 36-24. PIP Packet Definition
Name
Paging Information (PIP) Packet
Packet Format
Dependencies
TriggerEn && ContextEn &&
IA32_RTIT_CTL.OS
Generation
Scenario
MOV CR3, Task switch, INIT, SIPI, PSB+;
If IA32_VMX_MISC[bit 14] reports 1: VM exit, VM entry
Description
The CR3 payload shown includes only the address portion of the CR3 value. For PAE paging, CR3[11:5] are thus
included. For other page modes (32-bit and IA-32e paging), these bits are 0.
This packet holds the CR3 address value. It will be generated on operations that modify CR3:
• MOV CR3 operation
• Task Switch
• INIT and SIPI
• VM exit and VM entry, if appropriate controls in the VMCS are clear (see Section 36.5.1)
PIPs are not generated, despite changes to CR3, on SMI and RSM. This is due to the special behavior on these oper-
ations, see Section for details. Note that, for some cases of task switch where CR3 is not modified, no PIP will be
produced.
The purpose of the PIP is to indicate to the decoder which application is running, so that it can apply the proper
binaries to the linear addresses that are being traced.
The PIP packet contains the new CR3 value when CR3 is written.
PIPs generated by VM entries set the NR bit. PIPs generated in VMX non-root operation set the NR bit if the “con-
ceal VMX non-root operation from Intel PT” VM-execution control is 0. All other PIPs clear the NR bit.
Application
The purpose of the PIP packet is to help the decoder uniquely identify what software is running at any given time.
When a PIP is encountered, a decoder should do the following:
1) If there was a prior unbound FUP (that is, a FUP not preceded by a packet such as MODE.TSX that consumes it,
and it hence pairs with a TIP that has not yet been seen), then this PIP is part of a compound packet event (Section
36.4.1). Find the ending TIP and apply the new CR3/NR values to the TIP payload IP.
2) Otherwise, look for the next MOV CR3, far branch, or VMRESUME/VMLAUNCH in the disassembly, and apply the
new CR3 to the next (or target) IP.
For examples of the packets generated by these flows, see Section 36.7.
7
6
5
4
3
2
1
0
0
0
0
0
0
0
0
1
0
1
0
1
0
0
0
0
1
1
2
CR3[11:5] or 0
RSVD/NR
3
CR3[19:12]
4
CR3[27:20]
5
CR3[35:28]
6
CR3[43:36]
7
CR3[51:44]