Abstract: A computer system that records a replayable execution trace based on recording cache coherency protocol (CCP) messages into a first trace, and on recording memory snapshot(s) into a second trace. Based on determining that tracing of execution of a first execution context is to be enabled, the computer system initiates logging, into the second trace, of one or more memory snapshots of a memory space of the first execution context, and enables a hardware tracing feature of a processor. Enabling the tracing feature causes the processor to log, into the first trace, CCP message(s) generated in response to one or more memory access into the memory space of the first execution context. After enabling the hardware tracing feature of the processor, the computer system also logs or otherwise handles a write into the memory space of the first execution context by a second execution context.

Abstract: A computer system that records a replayable execution trace based on recording cache coherency protocol (CCP) messages into a first trace, and on recording memory snapshot(s) into a second trace. Based on determining that tracing of execution of a first execution context is to be enabled, the computer system initiates logging, into the second trace, of one or more memory snapshots of a memory space of the first execution context, and enables a hardware tracing feature of a processor. Enabling the tracing feature causes the processor to log, into the first trace, CCP message(s) generated in response to one or more memory access into the memory space of the first execution context. After enabling the hardware tracing feature of the processor, the computer system also logs or otherwise handles a write into the memory space of the first execution context by a second execution context.

Abstract: Using entropy to prevent inclusion of payload data in code execution log data. Embodiments determine that a payload data item associated with code execution log data has entropy exceeding a defined entropy threshold and identify a particular executable code that interacted with the payload data item. Embodiments then take a preventative action that excludes the payload data item from inclusion with a record of execution of the particular executable code. Examples of preventative actions include preventing the payload data item from being exported from the computer system, preventing the payload data item from being included in the code execution log data, and adding the payload data item to a block list in reference to the particular executable code.

Abstract: Exposing a memory cell value during trace replay prior to an execution time at which the memory cell value was recorded into a trace. A computer system identifies a first and a second trace fragment within a trace, each recording an uninterrupted consecutive execution of a plurality of executable instructions. The computer system determines that the first trace fragment is orderable prior to the second trace fragment and, based on an inter-fragment analysis, that a value of a memory cell recorded into the second trace fragment is compatible with the first trace fragment. The computer system generates output data indicating that the value of the memory cell can be exposed, during a replay of the trace, at a first execution time that is prior to a second execution time of an event that caused the value of the memory cell to be recorded into the second trace fragment.

Abstract: Cache-based tracing based on categorizing memory regions as being logged or not logged. A computer system identifies a first memory region within a first memory space of a first context, and determines that the first context is in a logging state. The computer system configures a data structure to categorize the first memory region as being logged. The data structure also categorizes a second memory region corresponding to a second context as being not logged. The computer system exposes the data structure to a processor. Upon detecting a memory access by a processing unit, the processor uses determinations of one or more of (i) whether a target memory address is categorized as being logged or not logged, (ii) whether an executing context is logging or not non-logging, or (iii) a type of the memory access to initiate a logging action or refrain from the logging action.

Abstract: Using entropy to prevent inclusion of pay load data in code execution log data. Embodiments determine that a payload data item associated with code execution log data has entropy exceeding a defined entropy threshold and identify a particular executable code that interacted with the payload data item. Embodiments then take a preventative action that excludes the pay load data item from inclusion with a record of execution of the particular executable code. Examples of preventative actions include preventing the pay load data item from being exported from the computer system, preventing the pay load data item from being included in the code execution log data, and adding the payload data item to a block list in reference to the particular executable code.

Abstract: Cache-based tracing based on categorizing memory regions as being logged or not logged. A computer system identifies a first memory region within a first memory space of a first context, and determines that the first context is in a logging state. The computer system configures a data structure to categorize the first memory region as being logged. The data structure also categorizes a second memory region corresponding to a second context as being not logged. The computer system exposes the data structure to a processor. Upon detecting a memory access by a processing unit, the processor uses determinations of one or more of (i) whether a target memory address is categorized as being logged or not logged, (ii) whether an executing context is logging or not non-logging, or (iii) a type of the memory access to initiate a logging action or refrain from the logging action.

Abstract: Automated root cause identification using data flow analysis of plural execution traces. A computer system generates data flow dependency graphs from first and second execution traces an entity. These graphs represent input/output data flows of corresponding executions of the entity. The computer system generates topological sortings of those graphs and identifies output pairings across these graphs based on outputs having common labels and topological correspondence. The computer system identifies output pairing(s) that are mismatched as having different values and, for at least one mismatched output pairing, traverses the graphs in order to identify input pairing(s) that are topological root(s) to the mismatched output pairing(s) and that are causal to the mismatch(es). Each input pairing comprises inputs that have a common label, a common topological correspondence, and mismatched values.

Abstract: Automated root cause identification using data flow analysis of plural execution traces. A computer system generates data flow dependency graphs from first and second execution traces an entity. These graphs represent input/output data flows of corresponding executions of the entity. The computer system generates topological sortings of those graphs and identifies output pairings across these graphs based on outputs having common labels and topological correspondence. The computer system identifies output pairing(s) that are mismatched as having different values and, for at least one mismatched output pairing, traverses the graphs in order to identify input pairing(s) that are topological root(s) to the mismatched output pairing(s) and that are causal to the mismatch(es). Each input pairing comprises inputs that have a common label, a common topological correspondence, and mismatched values.

Abstract: A processor records a trace of execution of an execution entity, including recording initial processor register state into the trace. The recorded initial processor register state includes a value of at least one register of a plurality of registers. Subsequent to recording initial processor register state, and based on detection of a cache miss during execution of the execution entity, the processor records an influx of data imported into the processor cache in response to the cache miss. Also subsequent to recording initial processor register state, and based on execution of a non-deterministic processor instruction of the execution entity, the processor records at least one side effect of an access to at least one model-specific register, including recording a change in the value of the at least one register of the plurality of registers. The change results from the execution of the non-deterministic processor instruction of the execution entity.

Abstract: Omitting or obfuscating physical memory addresses within an execution trace. A microprocessor identifies a first translation lookaside buffer (TLB) entry mapping a first virtual memory page to a physical memory page, and initiates logging of the first TLB entry by initiating logging of at least a first virtual address of the first virtual memory page and a first identifier. The microprocessor identifies a second TLB entry mapping a second virtual memory page to the physical memory page, and initiates logging of the second TLB entry by initiating logging of at least a second virtual address of the second virtual memory page and a second identifier. The microprocessor determines that the first and second TLB entries are each live, logged into the execution trace, and mapped to the same physical address, and ensures that the execution trace indicates that the first and second TLB entries each map to the physical address.

Abstract: Logging cache line lifetime hints when recording an execution trace. A microprocessor detects occurrence of a first cache event that initiates a lifetime of a cache line within a memory cache, and initiates logging first trace information indicating a beginning of the lifetime of the cache line within the memory cache. Subsequently, the microprocessor detects occurrence of a second cache event that ends the lifetime of the cache line within the memory cache. Based on detecting the second cache event, the microprocessor initiates logging second trace information indicating an ending of the lifetime of the cache line within the memory cache.

Abstract: Compressing memory addresses within an execution trace via reference to a translation lookaside buffer (TLB) entry. A microprocessor identifies a TLB entry within a TLB slot, the TLB entry mapping a virtual memory page to a physical memory page. The microprocessor initiates logging of the TLB entry by initiating logging of at least a virtual address of the virtual memory page, and an identifier that uniquely identifies the TLB entry from among a plurality of live TLB entries. Subsequently, the microprocessor identifies a cache entry within a memory cache slot, the cache entry comprising a physical memory address corresponding to a cache line. The microprocessor initiates logging of the cache entry by matching a physical memory page identification portion of the physical memory address with the TLB entry, and then initiates logging of at least the identifier for the TLB entry and an offset portion.

Abstract: A method executed in a computing device with multiple processing units and a shared processor cache for caching data from memory involves identifying a read operation from a cache line in the processor cache while executing a thread on a processing unit. The method further includes identifying the memory page in the memory device corresponding to the read, determining the cleanliness of the memory page based on a bit in a memory page table, and selectively logging the cache line to a thread trace based on the cleanliness status of the memory page. If the memory page is dirty, the cache line is logged to the trace; if clean, the logging is omitted.

Abstract: Using entropy to prevent inclusion of pay load data in code execution log data. Embodiments determine that a payload data item associated with code execution log data has entropy exceeding a defined entropy threshold and identify a particular executable code that interacted with the payload data item. Embodiments then take a preventative action that excludes the pay load data item from inclusion with a record of execution of the particular executable code. Examples of preventative actions include preventing the pay load data item from being exported from the computer system, preventing the pay load data item from being included in the code execution log data, and adding the payload data item to a block list in reference to the particular executable code.

Abstract: Omitting or obfuscating physical memory addresses within an execution trace. A microprocessor identifies a first translation lookaside buffer (TLB) entry mapping a first virtual memory page to a physical memory page, and initiates logging of the first TLB entry by initiating logging of at least a first virtual address of the first virtual memory page and a first identifier. The microprocessor identifies a second TLB entry mapping a second virtual memory page to the physical memory page, and initiates logging of the second TLB entry by initiating logging of at least a second virtual address of the second virtual memory page and a second identifier. The microprocessor determines that the first and second TLB entries are each live, logged into the execution trace, and mapped to the same physical address, and ensures that the execution trace indicates that the first and second TLB entries each map to the physical address.

Abstract: Automated root cause identification using data flow analysis of plural execution traces. A computer system generates data flow dependency graphs from first and second execution traces an entity. These graphs represent input/output data flows of corresponding executions of the entity. The computer system generates topological sortings of those graphs and identifies output pairings across these graphs based on outputs having common labels and topological correspondence. The computer system identifies output pairing(s) that are mismatched as having different values and, for at least one mismatched output pairing, traverses the graphs in order to identify input pairing(s) that are topological root(s) to the mismatched output pairing(s) and that are causal to the mismatch(es). Each input pairing comprises inputs that have a common label, a common topological correspondence, and mismatched values.

Abstract: Diffing prior executions of an executable program. A computer system assigns a weighting to each entity type in a first ordered set of a first plurality of entities and a second ordered set of a second plurality of entities, including assigning different weightings to different entity types. The computer system calculates an edit distance between the first and second ordered sets based on calculating a minimal cost path through a diffing structure. Calculating the minimal cost path includes partitioning the diffing structure around intersecting entries that are identified based on (i) only permitting replacements between entities that have a common entity type, and (ii) utilizing the different weightings to identify single-entity replacements that have higher cost than adjoining multi-entity replacements. Calculating the minimal cost path also includes applying a differencing algorithm to these partitions, in order to identify corresponding segments of the minimal cost path.

Abstract: Removing payload data from an execution trace. Embodiments identify a pay load data item within an execution trace, identify particular executable code that interacted with the payload data item, and determine constraint(s) that execution of the particular executable code has placed on the pay load data item. Embodiments then replace a value of the payload data item in the execution trace with information maintaining the constraint(s). Examples of information maintaining the constraint(s) include one or more bytes of the particular executable code. a memory address corresponding to the pay load data item, and data structured to preserve code flow-such as a replacement value for the pay load data item, a specification of a set of one or more valid values for the pay load data item, or an instruction of a code path to follow in the particular executable code.

Abstract: Compressing memory addresses within an execution trace via reference to a translation lookaside buffer (TLB) entry. A microprocessor identifies a TLB entry within a TLB slot, the TLB entry mapping a virtual memory page to a physical memory page. The microprocessor initiates logging of the TLB entry by initiating logging of at least a virtual address of the virtual memory page, and an identifier that uniquely identifies the TLB entry from among a plurality of live TLB entries. Subsequently, the microprocessor identifies a cache entry within a memory cache slot, the cache entry comprising a physical memory address corresponding to a cache line. The microprocessor initiates logging of the cache entry by matching a physical memory page identification portion of the physical memory address with the TLB entry, and then initiates logging of at least the identifier for the TLB entry and an offset portion.