Abstract: There is disclosed in an example a processor, having: a front end including circuitry to decode instructions from an instruction stream; a data cache unit including circuitry to cache data for the processor; and a core triggering block (CTB) to provide integration between two or more different debug capabilities.

Abstract: A core includes a memory buffer and executes an instruction within a virtual machine. A processor tracer captures trace data and formats the trace data as trace data packets. An event-based sampler generates field data for a sampling record in response to occurrence of an event of a certain type as a result of execution of the instruction. The processor tracer, upon receipt of the field data: formats the field data into elements of the sampling record as a group of record packets; inserts the group of record packets between the trace data packets as a combined packet stream; and stores the combined packet stream in the memory buffer as a series of output pages. The core, when in guest profiling mode, executes a virtual machine monitor to map output pages of the memory buffer to host physical pages of main memory using multilevel page tables.

Abstract: A processor includes a front end including circuitry to receive an instruction to monitor execution of a thread, a decoder including circuitry to decode the instruction, a scheduler including circuitry to schedule the instruction, a retirement unit including circuitry to retire the instruction, and a core. The core includes circuitry to, based on execution of the instruction, monitor execution of the thread, identify an attempted read of an address during execution of the thread, determine whether a value at the address was previously read during monitoring of the execution of the thread, log the attempted read based on a determination that the value at the address was not previously read during monitoring of the execution of the thread, and omit logging of the attempted read based on a determination that the value at the address was previously read during monitoring of the execution of the thread.

Abstract: In accordance with embodiments disclosed herein, there is provided systems and methods for using thresholds to gate timing packet generation in a tracing system (TS). For example, the method may include generating and outputting a trace data (TD) packet into a packet log. The method also includes generating and outputting a timing packet (TM) corresponding to the TD packet into the packet log when a number of clock cycles elapsed since an output of a previous TM packet exceeds a clock threshold value.

Abstract: A processing device implementing tracking of deferred data packets in a debug trace architecture is disclosed. The processing device is to determine an order number corresponding to an order in which an instruction was executed relative to other executed instructions that correspond to an instruction type within a sequence of executed instructions, identify a first data packet corresponding to a first packet type and sequentially ordered, according to the order number, with respect to data packets of the first packet type within a data trace log, identify a second data packet corresponding to a second packet type and sequentially ordered, according to the order number, with respect to data packets of the second packet type within the data trace log, and map the identified first and second data packets to the instruction, wherein at least one of the first or second data packets was generated post-retirement of the instruction.

Abstract: Methods and apparatuses for generating a suppressed address trace are described. In some embodiments, a processor includes a trace generator having a trace suppressor that outputs a suppressed address trace for instructions executed by the processor. In some embodiments, a method to generate a suppressed address trace for a processor includes generating a suppressed address trace of executed instructions from a trace suppressor of a trace generator of the processor.

Abstract: In accordance with embodiments disclosed herein, there is provided systems and methods for providing status of a processing device with a periodic synchronization point in an instruction tracing system. For example, the method may include generating a boundary packet based on a unique byte pattern in a packet log. The boundary packet provides a starting point for packet decode. The method may also include generating a plurality of state packets based on status information of the processor. The plurality of state packets follows the boundary packet when outputted into the packet log.

Abstract: A processor includes a processor trace logical unit to produce branch execution records from execution of instructions. The processor further includes logic to determine that a condition has occurred on the processor during execution of the instructions. The condition is to include an asynchronous event or a return from a software handler for an asynchronous event. The processor further includes logic to determine whether event tracing is enabled for the processor. The processor also includes logic to generate a control flow event (CFE) packet. The CFE packet is to indicate a type of the condition. The processor further includes logic to generate an indicator of an instruction address that generated the condition.

Abstract: In an embodiment, a processor includes a core that is to include fetch logic to fetch instructions that include first instructions and a second instruction. The core also includes execution logic to execute the instructions. The execution logic is to retrieve an operand value that is one of an immediate value, a register value, and a memory value stored in a memory location, responsive to execution of the second instruction. The core also includes logic to output a packet that includes a representation of the operand value responsive to execution of the second instruction. The core also includes processor trace (PT) logic to generate a processor trace that includes a plurality of PT packets, where each PT packet correspond to an outcome of execution of a respective first instruction. The processor trace logic is further to include the packet within the processor trace. Other embodiments are described and claimed.

Abstract: Methods and apparatuses for generating a suppressed address trace are described. In some embodiments, a processor includes a trace generator having a trace suppressor that outputs a suppressed address trace for instructions executed by the processor. In some embodiments, a method to generate a suppressed address trace for a processor includes generating a suppressed address trace of executed instructions from a trace suppressor of a trace generator of the processor.

Abstract: Technologies for control flow exploit mitigation include a computing device having a processor with real-time instruction tracing support. During execution of a process, the processor generates trace data indicative of control flow of the process. The computing device analyzes the trace data to identify suspected control flow exploits. The computing device may use heuristic algorithms to identify return-oriented programming exploits. The computing device may maintain a shadow stack based on the trace data. The computing device may identify indirect branches to unauthorized addresses based on the trace data to identify jump-oriented programming exploits. The computing device may check the trace data whenever the process is preempted. The processor may detect mispredicted return instructions in real time and invoke a software handler in the process space of the process to verify and maintain the shadow stack. Other embodiments are described and claimed.

Abstract: A processing device implementing minimizing bandwidth to track return targets by an instruction tracing system is disclosed. A processing device of the disclosure an instruction fetch unit comprising a return stack buffer (RSB) to predict a target address of a return (RET) instruction corresponding to a call (CALL) instruction. The processing device further includes a retirement unit comprising an instruction tracing module to initiate instruction tracing for instructions executed by the processing device, determine whether the target address of the RET instruction was mispredicted, determine a value of call depth counter (CDC) maintained by the instruction tracing module, and when the target address of the RET instruction was not mispredicted and when the value of the CDC is greater than zero, generate an indication that the RET instruction branches to a next linear instruction after the corresponding CALL instruction.

Abstract: A processor includes a trace unit to monitor activity by the processor and generate trace packets indicative of the activity by the processor. The trace packets may include four additional packets for processor event tracing including: a dormant state request packet, a code execution stop packet, a dormant state entry packet, and a dormant state exit packet.

Abstract: A processing device implementing tracking of deferred data packets in a debug trace architecture is disclosed. The processing device is to determine an order number corresponding to an order in which an instruction was executed relative to other executed instructions that correspond to an instruction type within a sequence of executed instructions, identify a first data packet corresponding to a first packet type and sequentially ordered, according to the order number, with respect to data packets of the first packet type within a data trace log, identify a second data packet corresponding to a second packet type and sequentially ordered, according to the order number, with respect to data packets of the second packet type within the data trace log, and map the identified first and second data packets to the instruction, wherein at least one of the first or second data packets was generated post-retirement of the instruction.

Abstract: A processing device with tracing functionality for a virtual machine is described. The processing device includes a tracing register to store a value indicative of whether tracing is enabled or disabled, a tracing module to generate trace data while tracing is enabled, and an internal buffer to store the trace data. When tracing is disabled, the processing device removes the trace data from the buffer. Mechanisms are described to ensure that the trace data is not corrupted during this process, despite the presence of page faults that may result from trace output writes.

Abstract: In accordance with embodiments disclosed herein, there is provided systems and methods for using thresholds to gate timing packet generation in a tracing system (TS). For example, the method may include generating and outputting a trace data (TD) packet into a packet log. The method also includes generating and outputting a timing packet (TM) corresponding to the TD packet into the packet log when a number of clock cycles elapsed since an output of a previous TM packet exceeds a clock threshold value.

Abstract: Methods and apparatuses for generating a suppressed address trace are described. In some embodiments, a processor includes a trace generator having a trace suppressor that outputs a suppressed address trace for instructions executed by the processor. In some embodiments, a method to generate a suppressed address trace for a processor includes generating a suppressed address trace of executed instructions from a trace suppressor of a trace generator of the processor.

Abstract: A processing device with tracing functionality for a virtual machine is described. The processing device includes a tracing register to store a value indicative of whether tracing is enabled or disabled, a tracing module to generate trace data while tracing is enabled, and an internal buffer to store the trace data. When tracing is disabled, the processing device removes the trace data from the buffer. Mechanisms are described to ensure that the trace data is not corrupted during this process, despite the presence of page faults that may result from trace output writes.

Abstract: A method is described that involves referring to first information from a directory table in system memory. The first information includes location information and size information of a first slice of system memory where first tracing data is to be stored. The method also includes tracking the amount of tracing data stored in the first slice of system memory and comparing the amount against the size information. The method also includes, before the first slice of system memory is filled, referring to second information from the directory table in system memory, where, the second information includes location information and size information of a second slice of system memory where second tracing data is to be stored. The first slice is not contiguous with the second slice of system memory.

Abstract: A method is described that involves referring to first information from a directory table in system memory. The first information includes location information and size information of a first slice of system memory where first tracing data is to be stored. The method also includes tracking the amount of tracing data stored in the first slice of system memory and comparing the amount against the size information. The method also includes, before the first slice of system memory is filled, referring to second information from the directory table in system memory, where, the second information includes location information and size information of a second slice of system memory where second tracing data is to be stored. The first slice is not contiguous with the second slice of system memory.