Microprocessor system architectures

1
Microprocessor system architectures IA32
debugging and performance monitoring

• Jakub Yaghob

2
Overview of debugging support

• Debug exception DB
• Nearly all debug events
• Breakpoint exception BP
• Exception invoked by INT3
• Debug registers
• DR0-DR3, DR6, DR7
• T flag in TSS
• During attempt to switch task

• EFLAGSRF
• Resume Flag disables multiple exceptions to the
  instruction
• EFLAGSTF
• Trap Flag generates DB after every execution
  of an instruction
• Breakpoint instruction
• INT3
• Last branch recording
• Only P6

3
Conditions for invoking the debugger

• Task switch
• Execution of breakpoint instruction
• Execution of any instruction
• Execution of an instruction at a specified
  address
• Read or write of B, W, D at a specified memory
  address
• Write to B, W, D at a specified memory address
• Input of B, W, D at a specified I/O address
  (Pentium)
• Output to B, W, D at a specified I/O address
  (Pentium)
• Attempt to change the contents of a debug register

4
Program tracing

• Tracing enabled by EFLAGSTF1
• Exception DB invoked after every instruction
  execution with TF set before the instruction
  execution
• It is a TRAP
• An instruction, which sets TF, does not invoke
  the exception
• An instruction, which clears TF, invokes the
  exception
• TF cleared before calling the exception/interrupt
  handler
• TF does not change its state during CPL changes
• Concurrent occurrence of single-step and an
  external interrupt
• DB invoked
• TF cleared
• The external interrupt handler invoked before the
  first instruction of DB handler

5
Task switching

• TSST set for a target task
• Invoked after the task is switched before the
  first instruction of the target task is executed
• DB should not be handled by a task with T flag
  set
• CPU in loop

6
Breakpoint instruction

• Instruction INT3
• Encoded as 1B instruction
• Suitable for inserting into the code to any
  address
• Using
• Write the INT3 instruction to the breakpoint and
  remember previous contents
• BP invokes debugger
• Before returning from BP the EFLAGSTF is set
  on the stack and original contents is written
  back to the breakpoint
• Return from the exception
• DB for single-step invoked after the instruction
  on the breakpoint is executed
• Clear the TF and write back INT3 to the breakpoint

7
Debug registers I
8
Debug registers II

• Status register DR6
• Bn condition n detected
• BD debug registers access detected with DR7GD
• BS single step
• BT task switch
• Control register DR7
• Ln local breakpoint enabled
• Gn global breakpoint enabled
• GD general detect enable
• R/Wn breakpoint condition
• LENn size of memory location

00 Instruction execution
01 Write
10 I/O (CR4DE1), undefined (CR4DE0)
11 Read and write
00 1B
01 2B
10 Undefined (8B for newer CPUs)
11 4B
9
Breakpoint recognition

• Address
• The address must be aligned to the size
• Data and I/O breakpoint
• Any accessed byte inside the range
• Instruction breakpoint
• Must have size 1B
• Only the first byte of an instruction

10
Breakpoint conditions
11
Instruction breakpoint

• It is FAULT
• We need to avoid endless loop on the breakpoint
• High priority
• Invoked before other exceptions
• Not invoked on an instruction after the POP
  SS/MOV SS instruction
• How to avoid the endless loop
• The flag EFLAGSRF
• Automatically set before any FAULT exception is
  invoked, except of instruction breakpoint
• Cleared after successful execution of an
  instruction, except of task switch (JMP, CALL,
  INT, IRET)
• It can be explicitly set only by reading EFLAGS
  from the stack/TSS returning from interrupt
  handler
• Using as a breakpoint
• Set the RF in the EFLAGS image on the stack/v TSS

12
Last branch recording

• Introduced in the Pentium Pro
• Depends tightly on model and MSRs
• Branches, interrupts, exceptions
• Branches JMP, Jcc, LOOP, CALL/RET

13
Performance monitoring

• Introduced in the Pentium
• Time-stamp counter
• Architectural performance monitoring
• Behaves consistently across microarchitectures
• Performance monitoring depending on a
  microarchitecture
• MSRs

14
Time-stamp counter

• Support
• TSC flag
• Availability check in CPUID.1EDX.TSC
• IA32_TIME_STAMP_COUNTER MSR
• MSR used as a counter
• 64-bit
• RDTSC instruction
• TSD flag
• Enable/disable TSC (CR4TSD)
• Behavior
• Older CPUs
• Increments with every internal clock cycle
• Newer CPUs
• Increments at a constant rate