Processor trace extensions to facilitate real-time security monitoring

Patent metadata

Field	Value
Publication number	US-11016773-B2
Application number	US-201916585287-A
Country	US
Kind code	B2
Filing date	Sep 27, 2019
Priority date	Sep 27, 2019
Publication date	May 25, 2021
Grant date	May 25, 2021

Abstract

Embodiments described herein provide for a computing device comprising a hardware processor including a processor trace module to generate trace data indicative of an order of instructions executed by the processor, wherein the processor trace module is configurable to selectively output a processor trace packet associated with execution of a selected non-deterministic control flow transfer instruction.

First claim

What is claimed is:

1. A computing device comprising:
a hardware processor comprising a processor trace module to:
read a processor trace configuration by reading a first bit in a first configuration register to determine whether output of processor trace packets is enabled for the processor device and reading a second bit in a second configuration register to determine whether a processor trace packet is to be output for an instruction;
detect retirement of an instruction on the hardware processor, wherein the instruction is a retired instruction in a set of non-deterministic control flow transfer instructions;
in response to a determination that the processor trace packet is enabled for the retired instruction based on the first bit, generate the processor trace packet for the retired instruction; and
selectively output, based on the second bit, the processor trace packet associated with execution of a selected non-deterministic control flow transfer instruction.

2. The computing device as in claim 1 , wherein the processor trace module is further to:
in response to a determination that the processor trace packet is not enabled for the instruction, bypass generation of the processor trace packet for the instruction.

3. The computing device as in claim 1 , wherein execution of the selected non-deterministic control flow transfer instruction at the hardware processor is detected upon retirement of the instruction.

4. The computing device as in claim 1 , wherein to read the processor trace configuration for the hardware processor includes to read a configuration register associated with the hardware processor.

5. The computing device as in claim 4 , wherein the configuration register associated with the hardware processor is a first configuration register.

6. The computing device as in claim 5 , wherein the processor trace module includes a packet generator to generate the processor trace packet for the instruction and to selectively output a processor trace packet includes to:
configure the packet generator to generate the processor trace packet for the instruction based on the second bit in the second configuration register.

7. The computing device as in claim 1 , wherein to selectively output the processor trace packet includes to:
determine that the selected non-deterministic control flow transfer instruction is an indirect branch instruction;
read a processor trace configuration for the hardware processor; and
based on the processor trace configuration for the hardware processor, determine if a branch information processor trace packet is enabled for the hardware processor;
output the branch information processor trace packet for the indirect branch instruction, wherein the branch information processor trace packet includes a branch type and an operand type for the indirect branch instruction.

8. The computing device as in claim 7 , wherein the branch type is selected from a set of branch types, the set of branch types including a near indirect call, a near indirect jump, a far indirect call, a far return, a far indirect jump, an asynchronous call, a system call, and a return from a system call.

9. The computing device as in claim 7 , wherein the operand type is selected from a set of operand types, the set of operand types including a register, memory, or immediate.

10. The computing device as in claim 1 , wherein to selectively output the processor trace packet includes to:
determine that a first processor trace packet is to be generated for the selected non-deterministic control flow transfer instruction, wherein the first processor trace packet is to indicate that control flow was transferred to a target instruction pointer;
read a processor trace configuration for the hardware processor to determine whether to output a second processor trace packet for the selected non-deterministic control flow transfer instruction; and
based on the processor trace configuration for the hardware processor, output the second processor trace packet for the selected non-deterministic control flow transfer instruction, wherein the second processor trace packet is to indicate that control flow was transferred to the target instruction pointer from a source instruction pointer.

11. A computing system comprising:
a memory device;
a hardware processor coupled to the memory device, the hardware processor including comprising a processor trace module to:
read a processor trace configuration by reading a first bit in a first configuration register to determine whether output of processor trace packets is enabled for the processor device and reading a second bit in a second configuration register to determine whether a processor trace packet is to be output for an instruction;
detect retirement of an instruction on the hardware processor, wherein the instruction is a retired instruction in a set of non-deterministic control flow transfer instructions;
in response to a determination that the processor trace packet is enabled for the retired instruction based on the first bit, generate the processor trace packet for the retired instruction; and
selectively output, based on the second bit, the processor trace packet associated with execution of a selected non-deterministic control flow transfer instruction.

12. The computing system as in claim 11 , wherein execution of the selected non-deterministic control flow transfer instruction at the hardware processor is detected upon retirement.

13. The computing system as in claim 11 , wherein the processor trace module is to selectively output the processor trace packet based on a type of processor trace packet to be output.

14. The computing system as in claim 13 , wherein the type of processor trace packet to be output is selected from a set of processor trace packets including:
a first processor trace packet to indicate whether a conditional branch is taken;
a second processor trace packet to indicate a target address of an indirect branch instruction; and
a third processor trace packet to indicate a source address for an asynchronous event.

15. The computing system as in claim 14 , wherein the set of processor trace packets additionally includes:
a fourth processor trace packet to indicate a branch type and operand type for an indirect branch instruction; and
wherein the second processor trace packet is to indicate a source address for an indirect branch instruction.

16. The computing system as in claim 11 , wherein the processor trace module is to selectively output a processor trace packet based on a type of the selected non-deterministic control flow transfer instruction.

17. The computing system as in claim 16 , wherein the type of the selected non-deterministic control flow transfer instruction is selected from a set of control flow transfer instructions including a conditional branch, a near indirect call, a near return, a near indirect jump, and a far branch.

18. A method performed on a processor device, the method comprising:
reading a processor trace configuration for the processor device, wherein reading the processor trace configuration for the processor device includes reading a first bit in a first configuration register to determine whether output of processor trace packets is enabled for the processor device and reading a second bit in a second configuration register to determine whether a processor trace packet is to be output for an instruction;
detecting retirement of an instruction on the processor device, wherein the instruction is a retired instruction in a set of non-determinis

Assignees

• Intel Corp

Inventors

• Sultana Salmin
• Strong Beeman
• Sahita Ravi

Classifications

• G06F9/323

  for indirect branch instructions · CPC title

• G06F9/30058

  Conditional branch instructions · CPC title

• G06F11/3636 Primary

  by tracing the execution of the program · CPC title

• G06F9/44505

  Configuring for program initiating, e.g. using registry, configuration files · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title