Abstract: Using entropy to prevent inclusion of pay load data in code execution log data. Embodiments determine that a payload data item associated with code execution log data has entropy exceeding a defined entropy threshold and identify a particular executable code that interacted with the payload data item. Embodiments then take a preventative action that excludes the pay load data item from inclusion with a record of execution of the particular executable code. Examples of preventative actions include preventing the pay load data item from being exported from the computer system, preventing the pay load data item from being included in the code execution log data, and adding the payload data item to a block list in reference to the particular executable code.

Abstract: Cache-based tracing based on categorizing memory regions as being logged or not logged. A computer system identifies a first memory region within a first memory space of a first context, and determines that the first context is in a logging state. The computer system configures a data structure to categorize the first memory region as being logged. The data structure also categorizes a second memory region corresponding to a second context as being not logged. The computer system exposes the data structure to a processor. Upon detecting a memory access by a processing unit, the processor uses determinations of one or more of (i) whether a target memory address is categorized as being logged or not logged, (ii) whether an executing context is logging or not non-logging, or (iii) a type of the memory access to initiate a logging action or refrain from the logging action.

Abstract: Automated root cause identification using data flow analysis of plural execution traces. A computer system generates data flow dependency graphs from first and second execution traces an entity. These graphs represent input/output data flows of corresponding executions of the entity. The computer system generates topological sortings of those graphs and identifies output pairings across these graphs based on outputs having common labels and topological correspondence. The computer system identifies output pairing(s) that are mismatched as having different values and, for at least one mismatched output pairing, traverses the graphs in order to identify input pairing(s) that are topological root(s) to the mismatched output pairing(s) and that are causal to the mismatch(es). Each input pairing comprises inputs that have a common label, a common topological correspondence, and mismatched values.

Abstract: Automated root cause identification using data flow analysis of plural execution traces. A computer system generates data flow dependency graphs from first and second execution traces an entity. These graphs represent input/output data flows of corresponding executions of the entity. The computer system generates topological sortings of those graphs and identifies output pairings across these graphs based on outputs having common labels and topological correspondence. The computer system identifies output pairing(s) that are mismatched as having different values and, for at least one mismatched output pairing, traverses the graphs in order to identify input pairing(s) that are topological root(s) to the mismatched output pairing(s) and that are causal to the mismatch(es). Each input pairing comprises inputs that have a common label, a common topological correspondence, and mismatched values.

Abstract: A processor records a trace of execution of an execution entity, including recording initial processor register state into the trace. The recorded initial processor register state includes a value of at least one register of a plurality of registers. Subsequent to recording initial processor register state, and based on detection of a cache miss during execution of the execution entity, the processor records an influx of data imported into the processor cache in response to the cache miss. Also subsequent to recording initial processor register state, and based on execution of a non-deterministic processor instruction of the execution entity, the processor records at least one side effect of an access to at least one model-specific register, including recording a change in the value of the at least one register of the plurality of registers. The change results from the execution of the non-deterministic processor instruction of the execution entity.

Abstract: Omitting or obfuscating physical memory addresses within an execution trace. A microprocessor identifies a first translation lookaside buffer (TLB) entry mapping a first virtual memory page to a physical memory page, and initiates logging of the first TLB entry by initiating logging of at least a first virtual address of the first virtual memory page and a first identifier. The microprocessor identifies a second TLB entry mapping a second virtual memory page to the physical memory page, and initiates logging of the second TLB entry by initiating logging of at least a second virtual address of the second virtual memory page and a second identifier. The microprocessor determines that the first and second TLB entries are each live, logged into the execution trace, and mapped to the same physical address, and ensures that the execution trace indicates that the first and second TLB entries each map to the physical address.

Abstract: Logging cache line lifetime hints when recording an execution trace. A microprocessor detects occurrence of a first cache event that initiates a lifetime of a cache line within a memory cache, and initiates logging first trace information indicating a beginning of the lifetime of the cache line within the memory cache. Subsequently, the microprocessor detects occurrence of a second cache event that ends the lifetime of the cache line within the memory cache. Based on detecting the second cache event, the microprocessor initiates logging second trace information indicating an ending of the lifetime of the cache line within the memory cache.

Abstract: Compressing memory addresses within an execution trace via reference to a translation lookaside buffer (TLB) entry. A microprocessor identifies a TLB entry within a TLB slot, the TLB entry mapping a virtual memory page to a physical memory page. The microprocessor initiates logging of the TLB entry by initiating logging of at least a virtual address of the virtual memory page, and an identifier that uniquely identifies the TLB entry from among a plurality of live TLB entries. Subsequently, the microprocessor identifies a cache entry within a memory cache slot, the cache entry comprising a physical memory address corresponding to a cache line. The microprocessor initiates logging of the cache entry by matching a physical memory page identification portion of the physical memory address with the TLB entry, and then initiates logging of at least the identifier for the TLB entry and an offset portion.

Abstract: A method executed in a computing device with multiple processing units and a shared processor cache for caching data from memory involves identifying a read operation from a cache line in the processor cache while executing a thread on a processing unit. The method further includes identifying the memory page in the memory device corresponding to the read, determining the cleanliness of the memory page based on a bit in a memory page table, and selectively logging the cache line to a thread trace based on the cleanliness status of the memory page. If the memory page is dirty, the cache line is logged to the trace; if clean, the logging is omitted.

Abstract: Using entropy to prevent inclusion of pay load data in code execution log data. Embodiments determine that a payload data item associated with code execution log data has entropy exceeding a defined entropy threshold and identify a particular executable code that interacted with the payload data item. Embodiments then take a preventative action that excludes the pay load data item from inclusion with a record of execution of the particular executable code. Examples of preventative actions include preventing the pay load data item from being exported from the computer system, preventing the pay load data item from being included in the code execution log data, and adding the payload data item to a block list in reference to the particular executable code.

Abstract: Omitting or obfuscating physical memory addresses within an execution trace. A microprocessor identifies a first translation lookaside buffer (TLB) entry mapping a first virtual memory page to a physical memory page, and initiates logging of the first TLB entry by initiating logging of at least a first virtual address of the first virtual memory page and a first identifier. The microprocessor identifies a second TLB entry mapping a second virtual memory page to the physical memory page, and initiates logging of the second TLB entry by initiating logging of at least a second virtual address of the second virtual memory page and a second identifier. The microprocessor determines that the first and second TLB entries are each live, logged into the execution trace, and mapped to the same physical address, and ensures that the execution trace indicates that the first and second TLB entries each map to the physical address.

Abstract: Diffing prior executions of an executable program. A computer system assigns a weighting to each entity type in a first ordered set of a first plurality of entities and a second ordered set of a second plurality of entities, including assigning different weightings to different entity types. The computer system calculates an edit distance between the first and second ordered sets based on calculating a minimal cost path through a diffing structure. Calculating the minimal cost path includes partitioning the diffing structure around intersecting entries that are identified based on (i) only permitting replacements between entities that have a common entity type, and (ii) utilizing the different weightings to identify single-entity replacements that have higher cost than adjoining multi-entity replacements. Calculating the minimal cost path also includes applying a differencing algorithm to these partitions, in order to identify corresponding segments of the minimal cost path.

Abstract: Automated root cause identification using data flow analysis of plural execution traces. A computer system generates data flow dependency graphs from first and second execution traces an entity. These graphs represent input/output data flows of corresponding executions of the entity. The computer system generates topological sortings of those graphs and identifies output pairings across these graphs based on outputs having common labels and topological correspondence. The computer system identifies output pairing(s) that are mismatched as having different values and, for at least one mismatched output pairing, traverses the graphs in order to identify input pairing(s) that are topological root(s) to the mismatched output pairing(s) and that are causal to the mismatch(es). Each input pairing comprises inputs that have a common label, a common topological correspondence, and mismatched values.

Abstract: Removing payload data from an execution trace. Embodiments identify a pay load data item within an execution trace, identify particular executable code that interacted with the payload data item, and determine constraint(s) that execution of the particular executable code has placed on the pay load data item. Embodiments then replace a value of the payload data item in the execution trace with information maintaining the constraint(s). Examples of information maintaining the constraint(s) include one or more bytes of the particular executable code. a memory address corresponding to the pay load data item, and data structured to preserve code flow-such as a replacement value for the pay load data item, a specification of a set of one or more valid values for the pay load data item, or an instruction of a code path to follow in the particular executable code.

Abstract: Compressing memory addresses within an execution trace via reference to a translation lookaside buffer (TLB) entry. A microprocessor identifies a TLB entry within a TLB slot, the TLB entry mapping a virtual memory page to a physical memory page. The microprocessor initiates logging of the TLB entry by initiating logging of at least a virtual address of the virtual memory page, and an identifier that uniquely identifies the TLB entry from among a plurality of live TLB entries. Subsequently, the microprocessor identifies a cache entry within a memory cache slot, the cache entry comprising a physical memory address corresponding to a cache line. The microprocessor initiates logging of the cache entry by matching a physical memory page identification portion of the physical memory address with the TLB entry, and then initiates logging of at least the identifier for the TLB entry and an offset portion.

Abstract: Using way-locking to record plural execution contexts into independent execution traces. A processor partitions a cache into a first subset of ways that are locked to a first context recorded into a first trace and a second subset of ways that are locked to a second context recorded into a second trace. The processor also detects a memory operation by the first context into the second cache subset. The processor then performs at least one of: when the memory operation causes an influx into the second cache subset, initiating logging of the influx to the second trace; when the memory operation is a read from the second cache subset, initiating logging of the read to the first trace; or when the memory operation is a write to the second cache subset, performing one of initiating logging of the write to the second trace, or evicting a target cache line.

Abstract: A processor records a trace of execution of an execution entity, including recording initial processor register state into the trace. The recorded initial processor register state includes a value of at least one register of a plurality of registers. Subsequent to recording initial processor register state, and based on detection of a cache miss during execution of the execution entity, the processor records an influx of data imported into the processor cache in response to the cache miss. Also subsequent to recording initial processor register state, and based on execution of a non-deterministic processor instruction of the execution entity, the processor records at least one side effect of an access to at least one model-specific register, including recording a change in the value of the at least one register of the plurality of registers. The change results from the execution of the non-deterministic processor instruction of the execution entity.

Abstract: Using memory markings to record plural execution contexts into independent traces. A processor detects a memory operation and identifies an associated memory marking from among a first marking indicating that a first memory region is logged for the first context, and a second marking indicating that a second memory region is logged for a second context. Based on identifying the memory marking as the second marking, and based the first context causing the memory operation, the processor performs at least one of: when the memory operation causes an influx into a cache, logging the influx to a second trace associated with the second context; when the memory operation is a read, logging the read to a first trace associated with the first context; or when the memory operation is a write, performing one of logging the write to the second trace, or evicting a target cache line.

Abstract: Recording a trace of code execution using reference bits in a processor cache. A computing device comprises processing units and a shared cache. The shared cache includes a plurality of cache lines that is each associated with a plurality of accounting bits, which each includes a reference bits portion. Stored control logic uses these reference bits to log a second read operation by a second processing unit in reference to an already logged first read operation by a first processing unit.

Abstract: Logging cache line lifetime hints when recording an execution trace. A microprocessor detects occurrence of a first cache event that initiates a lifetime of a cache line within a memory cache, and initiates logging first trace information indicating a beginning of the lifetime of the cache line within the memory cache. Subsequently, the microprocessor detects occurrence of a second cache event that ends the lifetime of the cache line within the memory cache. Based on detecting the second cache event, the microprocessor initiates logging second trace information indicating an ending of the lifetime of the cache line within the memory cache.