Method for determining scope and cause of memory corruption

• US 20040054989A1
• Filed: 09/17/2002
• Published: 03/18/2004
• Est. Priority Date: 09/17/2002
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Harres, John M.
• Granted Patent: US 7,231,634 B2
• Time in Patent Office: Days
• US Class Current: 717/124
• CPC Class Codes: G06F 11/073 in a memory management context, e.g. virtual memory or cache management memory management G06F12/00; testing of static memory units G11C29/00
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

A method for analyzing memory after a system panic to identify scope and cause of memory corruption. The method includes retrieving a memory image for a computer system and identifying a data structure in the memory image that caused the panic. A rule set for the identified data structure is selected and applied to the memory image to determine a scope of the memory corruption. The method includes identifying data structures in the memory that are related to the identified data structure by type, structure, content, or location and applying the rule set to this subset of data structures. The method may include generating the rule set for the identified data structure and then validating the created rule set such as by applying it to data structures that are known to be uncorrupted. The corrupted data structures are then processed to determine a cause of the corruption.

Claims

1. A computer-based method for analyzing computer system memory after a system panic, comprising:

retrieving an image for memory in a computer system generated after a panic in the computer system;

identifying a data structure in the memory image as a link to the panic; and

applying a data structure rule set to the memory image to determine a scope of corruption in the memory, wherein the data structure rule set is selected based on the identified data structure.

2. The method of claim 1, wherein the applying is performed on other data structures in the memory image related to the identified data structure by type or location.

3. The method of claim 2, further including prior to the applying, processing the identified data structure to determine the location and the data structure type for the identified data structure and retrieving the data structure rule set based on the processing.

4. The method of claim 1, further including prior to the applying generating, creating the data structure rule set for the identified data structure to define a set of data structure characteristics for other data structures in the memory image related to the identified data structure.

5. The method of claim 4, further including validating the created data structure rule set prior to the applying including applying the created data structure rule set to an uncorrupted memory image having data structures complying to rules in the created data structure rule set.

6. The method of claim 1, further including receiving the memory image in a crash dump file generated for the computer system.

7. The method of claim 1, wherein the scope is defined by a set of corrupted data structures including the identified data structure and other data structures in the memory image which did not comply to the rule set in the applying.

8. The method of claim 7, further including processing the set of corrupted data structures to determine a cause of the corruption in the memory.

9. The method of claim 8, wherein the processing includes identifying a pattern to the corruption in the set of corrupted data structures.

10. The method of claim 8, further including generating a report including a listing of at least a portion of the set of corrupted data structures and the cause of the corruption.

11. A method for identifying a cause of memory corruption, comprising:

providing a set of corrupted data structures from a computer system memory;

identifying a pattern to data corruption in the data structures; and

processing the pattern of the data corruption to determine a cause of the data corruption.

12. The method of claim 11, wherein the set of corrupted data structures is related based on location in the computer system memory.

13. The method of claim 11, wherein the set of corrupted data structures is related based on content of data in the data structures.

14. The method of claim 11, wherein the providing includes identifying one of the corrupted data structures as a cause of a panic in the computer system memory, selecting a rule set based on the identified corrupted data structure, locating other data structures in the memory related in structure to the identified corrupted data structure, and comparing the other data structures to the rule set to generate the set of corrupted data structures.

15. The method of claim 14, further including creating the rule set for the identified corrupted structure and validating the rule set using uncorrupted data structures.

16. The method of claim 11, wherein the providing includes receiving a core file from a computer system having the memory generated after a panic in the computer system.

17. A client support computer system, comprising:

a memory device storing a received core file for a client computer system having a memory image for the client computer system and storing data structure rules for a plurality of data structures; and

a memory analysis tool configured to retrieve the memory image of the received core file, to select one of the data structure rules, and to apply the selected one of the data structure rules to a set of data structures in the memory image to create a list of corrupted data structures in the memory image.

18. The system of claim 17, wherein the memory analysis tool is further configured to process the memory image to identify a data structure that caused a panic in the client computer system and to perform the selecting based on the identified data structure.

19. The system of claim 18, wherein the memory analysis tool processes the memory image to establish the set of data structures for applying the selected one of the data structure rules based on construction or location of the identified data structure.

20. The system of claim 17, wherein the memory analysis tool processes the list of corrupted data structures to identify a pattern in data corruption.