Abstract: A processor includes a counter to store a cycle count that tracks a number of cycles between retirement of a first branch instruction and retirement of a second branch instruction during execution of a set of instructions. The processor further includes a stack of registers coupled to the counter, wherein the stack of registers is to store branch type information including: a first value of the counter when the first branch instruction is retired; a second value of the counter when the second branch instruction is retired; a first type information value indicating a type of the first branch instruction; and a second type information value indicating a type of the second branch instruction.

Abstract: A processor is to execute and retire instructions for a virtual machine. A reload register is coupled to the core is to store a reload value. A performance monitoring counter (PMC) register is coupled to the reload register and an event-based sampler operatively is coupled to the reload register and the PMC register. The event-based sampler includes circuitry to load the reload value into the PMC register and increment the PMC register after detecting each occurrence of an event of a certain type as a result of execution of the instructions. Upon detecting an occurrence of the event after the PMC register reaches a predetermined trigger value, the event-based sampler is to execute microcode to generate field data for elements within a sampling record, wherein the field data relates to a current processor state of execution, and reload the reload value from the reload register into the PMC register.

Abstract: A processor is to execute and retire instructions for a virtual machine. A reload register is coupled to the core is to store a reload value. A performance monitoring counter (PMC) register is coupled to the reload register and an event-based sampler operatively is coupled to the reload register and the PMC register. The event-based sampler includes circuitry to load the reload value into the PMC register and increment the PMC register after detecting each occurrence of an event of a certain type as a result of execution of the instructions. Upon detecting an occurrence of the event after the PMC register reaches a predetermined trigger value, the event-based sampler is to execute microcode to generate field data for elements within a sampling record, wherein the field data relates to a current processor state of execution, and reload the reload value from the reload register into the PMC register.

Abstract: A processor includes a counter to store a cycle count that tracks a number of cycles between retirement of a first branch instruction and retirement of a second branch instruction during execution of a set of instructions. The processor further includes a stack of registers coupled to the counter, wherein the stack of registers is to store branch type information including: a first value of the counter when the first branch instruction is retired; a second value of the counter when the second branch instruction is retired; a first type information value indicating a type of the first branch instruction; and a second type information value indicating a type of the second branch instruction.

Abstract: A processor includes a trace unit to monitor activity by the processor and generate trace packets indicative of the activity by the processor. The trace packets may include four additional packets for processor event tracing including: a dormant state request packet, a code execution stop packet, a dormant state entry packet, and a dormant state exit packet.

Abstract: An example processor that includes a decoder, an execution circuit, a counter, and a last branch recorder (LBR) register. The decoder may decode a branch instruction for a program. The execution circuit may be coupled to the decoder, where the execution circuit may execute the branch instruction. The counter may be coupled to the execution circuit, where the counter may store a cycle count. The LBR register coupled to the execution circuit, where the LBR register may include a counter field to store a first value of the counter when the branch instruction is executed and a type field to store type information indicating a type of the branch instruction.

Abstract: A processor is to execute and retire instructions for a virtual machine. A reload register is coupled to the core is to store a reload value. A performance monitoring counter (PMC) register is coupled to the reload register and an event-based sampler operatively is coupled to the reload register and the PMC register. The event-based sampler includes circuitry to load the reload value into the PMC register and increment the PMC register after detecting each occurrence of an event of a certain type as a result of execution of the instructions. Upon detecting an occurrence of the event after the PMC register reaches a predetermined trigger value, the event-based sampler is to execute microcode to generate field data for elements within a sampling record, wherein the field data relates to a current processor state of execution, and reload the reload value from the reload register into the PMC register.

Abstract: A processor includes a processor trace logical unit to produce branch execution records from execution of instructions. The processor further includes logic to determine that a condition has occurred on the processor during execution of the instructions. The condition is to include an asynchronous event or a return from a software handler for an asynchronous event. The processor further includes logic to determine whether event tracing is enabled for the processor. The processor also includes logic to generate a control flow event (CFE) packet. The CFE packet is to indicate a type of the condition. The processor further includes logic to generate an indicator of an instruction address that generated the condition.

Abstract: Methods and apparatuses for generating a suppressed address trace are described. In some embodiments, a processor includes a trace generator having a trace suppressor that outputs a suppressed address trace for instructions executed by the processor. In some embodiments, a method to generate a suppressed address trace for a processor includes generating a suppressed address trace of executed instructions from a trace suppressor of a trace generator of the processor.

Abstract: There is disclosed in an example a processor, having: a front end including circuitry to decode instructions from an instruction stream; a data cache unit including circuitry to cache data for the processor; and a core triggering block (CTB) to provide integration between two or more different debug capabilities.

Abstract: One embodiment provides an apparatus. The apparatus includes collector circuitry to capture processor trace (PT) data from a PT driver. The PT data includes a first target instruction pointer (TIP) packet including a first runtime target address of an indirect branch instruction of an executing target application. The apparatus further includes decoder circuitry to extract the first TIP packet from the PT data and to decode the first TIP packet to yield the first runtime target address. The apparatus further includes control flow validator circuitry to determine whether a control flow transfer to the first runtime target address corresponds to a control flow violation based, at least in part, on a control flow graph (CFG). The CFG including a plurality of nodes, each node including a start address of a first basic block, an end address of the first basic block and a next possible address of a second basic block or a not found tag.

Abstract: A processor is disclosed and comprises a front end including circuitry to decode instructions from an instruction stream; a data cache unit including circuitry to cache data for the processor; and a core triggering block (CTB) to provide integration between two or more different debug capabilities.

Abstract: Technologies for control flow exploit mitigation include a computing device having a processor with real-time instruction tracing support. During execution of a process, the processor generates trace data indicative of control flow of the process. The computing device analyzes the trace data to identify suspected control flow exploits. The computing device may use heuristic algorithms to identify return-oriented programming exploits. The computing device may maintain a shadow stack based on the trace data. The computing device may identify indirect branches to unauthorized addresses based on the trace data to identify jump-oriented programming exploits. The computing device may check the trace data whenever the process is preempted. The processor may detect mispredicted return instructions in real time and invoke a software handler in the process space of the process to verify and maintain the shadow stack. Other embodiments are described and claimed.

Abstract: A processor includes a trace unit to monitor activity by the processor and generate trace packets indicative of the activity by the processor. The trace packets may include four additional packets for processor event tracing including: a dormant state request packet, a code execution stop packet, a dormant state entry packet, and a dormant state exit packet.

Abstract: A processor is to execute and retire instructions for a virtual machine. A reload register is coupled to the core is to store a reload value. A performance monitoring counter (PMC) register is coupled to the reload register and an event-based sampler operatively is coupled to the reload register and the PMC register. The event-based sampler includes circuitry to load the reload value into the PMC register and increment the PMC register after detecting each occurrence of an event of a certain type as a result of execution of the instructions. Upon detecting an occurrence of the event after the PMC register reaches a predetermined trigger value, the event-based sampler is to execute microcode to generate field data for elements within a sampling record, wherein the field data relates to a current processor state of execution, and reload the reload value from the reload register into the PMC register.

Abstract: An example processor that includes a decoder, an execution circuit, a counter, and a last branch recorder (LBR) register. The decoder may decode a branch instruction for a program. The execution circuit may be coupled to the decoder, where the execution circuit may execute the branch instruction. The counter may be coupled to the execution circuit, where the counter may store a cycle count. The LBR register coupled to the execution circuit, where the LBR register may include a counter field to store a first value of the counter when the branch instruction is executed and a type field to store type information indicating a type of the branch instruction.

Abstract: Technologies for control flow exploit mitigation include a computing device having a processor with real-time instruction tracing support. During execution of a process, the processor generates trace data indicative of control flow of the process. The computing device analyzes the trace data to identify suspected control flow exploits. The computing device may use heuristic algorithms to identify return-oriented programming exploits. The computing device may maintain a shadow stack based on the trace data. The computing device may identify indirect branches to unauthorized addresses based on the trace data to identify jump-oriented programming exploits. The computing device may check the trace data whenever the process is preempted. The processor may detect mispredicted return instructions in real time and invoke a software handler in the process space of the process to verify and maintain the shadow stack. Other embodiments are described and claimed.

Abstract: A core includes a memory buffer and executes an instruction within a virtual machine. A processor tracer captures trace data and formats the trace data as trace data packets. An event-based sampler generates field data for a sampling record in response to occurrence of an event of a certain type as a result of execution of the instruction. The processor tracer, upon receipt of the field data: formats the field data into elements of the sampling record as a group of record packets; inserts the group of record packets between the trace data packets as a combined packet stream; and stores the combined packet stream in the memory buffer as a series of output pages. The core, when in guest profiling mode, executes a virtual machine monitor to map output pages of the memory buffer to host physical pages of main memory using multilevel page tables.

Abstract: One embodiment provides an apparatus. The apparatus includes collector circuitry to capture processor trace (PT) data from a PT driver. The PT data includes a first target instruction pointer (TIP) packet including a first runtime target address of an indirect branch instruction of an executing target application. The apparatus further includes decoder circuitry to extract the first TIP packet from the PT data and to decode the first TIP packet to yield the first runtime target address. The apparatus further includes control flow validator circuitry to determine whether a control flow transfer to the first runtime target address corresponds to a control flow violation based, at least in part, on a control flow graph (CFG). The CFG including a plurality of nodes, each node including a start address of a first basic block, an end address of the first basic block and a next possible address of a second basic block or a not found tag.

Abstract: A processor includes a trace unit to monitor activity by the processor and generate trace packets indicative of the activity by the processor. The trace packets may include four additional packets for processor event tracing including: a dormant state request packet, a code execution stop packet, a dormant state entry packet, and a dormant state exit packet.