Intel Corporation

Thilo Schmitt

Matthew C Merten

Beeman C Strong

Tong Li

Ravi L Sahita

Michael Lemay

Konrad K Lai

Ravi Rajwar

Ofer Levy

Frank Binns

Peter Lachner

Yuriy Bulygin

Mayank Bomb

Markus T Metzger

Christine E Wang

Thomas F Toll

Ilya Wagner

Thomas Toll

M D A Rahman

In accordance with embodiments disclosed herein, there is provided systems and methods for tracking the mode of processing devices in an instruction tracing system. The method may include receiving an indication of a change in a current execution mode of the processing device. The method may also include determining that the current execution mode of the received indication is different than a value of an execution mode of a first execution mode (EM) packet previously-generated by the IT module. The method may also include generating, based on the determining that the current execution mode is different, a second EM packet that provides a value of the current execution mode of the processing device to indicate the change in the execution mode for an instruction in a trace generated by the IT module. The method may further include generating transactional memory (TMX) packets having n bit mode pattern in the packet log. The n is at least two and the n bit mode indicates transaction status of the TMX operation.

Tracking mode of a processing device in instruction tracing systems

Technologies for control flow exploit mitigation include a computing device having a processor with real-time instruction tracing support. During execution of a process, the processor generates trace data indicative of control flow of the process. The computing device analyzes the trace data to identify suspected control flow exploits. The computing device may use heuristic algorithms to identify return-oriented programming exploits. The computing device may maintain a shadow stack based on the trace data. The computing device may identify indirect branches to unauthorized addresses based on the trace data to identify jump-oriented programming exploits. The computing device may check the trace data whenever the process is preempted. The processor may detect mispredicted return instructions in real time and invoke a software handler in the process space of the process to verify and maintain the shadow stack. Other embodiments are described and claimed.

Technologies for control flow exploit mitigation using processor trace

In accordance with embodiments disclosed herein, there is provided systems and methods for minimizing bandwidth to compress an output stream of an instruction tracing system. For example, the method may include identifying a current instruction in a trace of the IT module as a conditional branch (CB) instruction. The method includes executing one of generating a CB packet including a byte pattern with an indication of outcome of the CB instruction, or adding an indication of the outcome of the CB instruction to the byte pattern of an existing CB packet. The method includes generating a packet when a subsequent instruction in the trace is not the CB instruction. The packet is different from the CB packet. The method also includes adding the packet into a deferred queue when the packet is deferrable. The method further includes outputting the CB packet followed by the deferred packet into a packet log.

Minimizing bandwith to compress output stream in instruction tracing systems

Growing community of inventors

Biberach/Riβ, Germany

Thilo Schmitt