See Chapter 36 of the Intel Architecture Software Developer's Manual.
There are two modes of tracing:
Only one may be active at a time.
In this mode of operation each cpu is traced, regardless of what is running on the cpu, except as can be controlled by PT configuration MSRs (e.g., cr3 filtering, kernel/user, address filtering).
In this mode of operation individual threads are traced, even as they migrate from CPU to CPU. This is achieved via the PT state save/restore capabilities of the XSAVES and XRSTORS instructions.
Filtering control (e.g., cr3, user/kernel) is not available in this mode. Address filtering is possible, but is still TODO.
The interface for driving insntruction tracing is specified by //zircon/system/fidl/fuchsia-hardware-cpu-insntrace/insntrace.fidl
.
Here's a sketch of typical usage when tracing in cpu mode.
We currently only support Table of Physical Addresses mode so that we can also support stop-on-full behavior in addition to wrap-around.
Each cpu/thread has the same size trace buffer.
While it's possible to allocate and configure buffers outside of the driver, this is not done so that we have control over their contents. ToPA buffers must have specific contents or Bad Things can happen.
support tracing individual threads using xsaves
handle driver crashes