System and Method of Client Side Analysis for Identifying Failing RAM After a User Mode or Kernel Mode Exception

• US 20080320336A1
• Filed: 06/22/2007
• Published: 12/25/2008
• Est. Priority Date: 06/22/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kinshumann, Kinshumann, Qadir, Haseeb Abdul
• Granted Patent: US 8,140,908 B2
• Time in Patent Office: Days
• US Class Current: 714/42
• CPC Class Codes: G06F 11/0715 in a system implementing multitasking multitasking per se G06F9/46
• CPC Class Codes: G06F 11/073 in a memory management context, e.g. virtual memory or cache management memory management G06F12/00; testing of static memory units G11C29/00
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

A process executing on a computing system may encounter an exception. Pointers or other references created by the exception may identify portions of the computing system'"'"'s memory containing the binary code that was executing at the time of the exception. The exception-causing code from the system memory may be compared to an original version of the code from a non-volatile source. If the comparison identifies a hardware corruption pattern, the computing system may communicate information about the process and the exception to an error analysis server. Using historical exception data, the error analysis server may determine if the identified corruption pattern is most likely the result of corrupt hardware at the computing system. If corrupt hardware was the most likely result of the exception, then the server may communicate with the computing system to recommend or initiate a hardware diagnostic routine at the computing system to identify the faulty hardware.

Claims

1. A method for identifying corrupt system memory resulting in a computing system failure comprising:

loading a run-time executable code from a non-volatile memory of the computing system to the system memory;

executing a process from the run-time executable code on the computing system;

detecting an exception caused by the process executing on the computing system;

reading the run-time executable code from the system memory;

reading a stored executable code from the non-volatile memory of the computing system;

wherein the run-time executable code and the stored executable code correspond to the process causing the exception;

comparing the run-time executable code and the stored executable code; and

identifying a corrupt system memory pattern in the run-time executable code if the run-time executable code and the stored executable code are not identical.

2. The method of claim 1, further comprising examining the system memory if the corrupt system memory pattern indicates that the computing system failure was caused by corrupt system memory.

3. The method of claim 1, wherein the exception includes a plurality of memory pointers referring to locations in the system memory of the computing system that contained the loaded run-time executable code causing the exception.

4. The method of claim 3, further comprising reading the run-time executable code from the locations in the system memory of the computing system referred to by the plurality of memory pointers.

5. The method of claim 1, wherein the run-time executable code includes at least one of an exception parameter, an exception thread context, an exception call stack, or a working set of exception processes.

6. The method of claim 1, further comprising identifying the run-time executable code as the cause of the computing system failure.

7. The method of claim 1, wherein reading the run-time executable code includes collecting a number of pages of the run-time executable code from the system memory, wherein the number of pages is below a threshold amount.

8. The method of claim 7, wherein the threshold amount is no more than 512 kilobytes.

9. The method of claim 1, wherein loading the stored executable code from the non-volatile memory of the computing system comprises loading the stored executable code using unbuffered I/O.

10. The method of claim 1, wherein both the run-time executable code and the stored executable code are in a binary format.

11. The method of claim 1, wherein the corrupt system memory pattern includes at least one of a one-bit corruption pattern or a stride corruption pattern;

wherein the one-bit corruption pattern includes one instance of the first and second address of the system memory not being identical; and

wherein the stride corruption pattern includes a plurality of alternating instances of the first and second address of the system memory not being identical.

12. The method of claim 11, further comprising ignoring the corrupt system memory pattern if it is not the one-bit corruption pattern or the stride corruption pattern.

13. The method of claim 1, further comprising adding the run-time executable code to an error report;

and

communicating the error report to a remote error reporting service.

14. The method of claim 1, further comprising adding an indication of the corrupt system memory to an error report if the corrupt system memory pattern is identified.

15. The method of claim 1, further comprising determining a number of past identifications of the corrupt system memory pattern.

16. The method of claim 1, wherein the corrupt system memory pattern indicates that the computing system failure was caused by corrupt system memory if at least one of:

a number of exceptions corresponding to a number of different processes indicate the corrupt system memory pattern, wherein the number of exceptions and the number of corresponding processes is above a threshold.

17. The method of claim 1, wherein loading the stored executable code from the non-volatile memory of the computing system comprises loading the stored executable code from a hard disk drive of the computing system.

18. A method for client-side analysis for identifying failing RAM after a user mode or kernel mode exception comprising:

loading a run-time executable code from a non-volatile memory of the computing system to the RAM;

executing a process from the loaded run-time executable code on the computing system;

detecting an exception caused by the process executing on the computing system, the exception including a plurality of memory pointers referring to a plurality of locations in the RAM that contained the loaded run-time executable code causing the exception;

identifying a portion of the loaded run-time executable code in the RAM that caused the exception from the plurality of memory pointers;

reading the portion of the loaded run-time executable code from the RAM;

reading an uncorrupted copy of the portion of the loaded run-time executable code that caused the exception from the non-volatile memory of the computing system, wherein the run-time executable code and the stored executable code are in a binary format and correspond to the process causing the exception;

comparing the portion of the loaded run-time executable code in the RAM that caused the exception with the uncorrupted copy of the portion of the loaded run-time executable code causing the exception;

identifying a corrupt system memory pattern in the portion of the loaded run-time executable code in the RAM that caused the exception if the portion and the uncorrupted portion are not identical, the corrupt system memory pattern comprising at least one of a one-bit corruption pattern and a stride corruption pattern;

optionally examining the system memory if the corrupt system memory pattern indicates that the computing system failure was caused by corrupt system memory.

19. The method of claim 18, wherein the portion of the loaded run-time executable code in the RAM that caused the exception includes a plurality of incorrect instructions and the uncorrupted copy of the portion of the loaded run-time executable code causing the exception includes a plurality of correct instructions;

wherein the one-bit corruption pattern includes, within the plurality of incorrect instructions, at least one incorrect instruction that references a first RAM address that is one bit away from a second RAM address, wherein the second RAM address is referenced by one of the correct instructions;

wherein the stride corruption pattern includes, within the plurality of incorrect instructions, a correct instruction that references a correct RAM address, the correct instruction between two incorrect instructions that reference incorrect RAM addresses.

20. A computer system comprising a processor for executing computer executable instructions, a system memory for temporarily storing data related to the computer executable instructions, a non-volatile memory for permanently storing data related to the computer executable instructions, and an input/output circuit, the computer executable instructions comprising instructions for identifying failing memory after a user mode or kernel mode exception, the computer executable instructions comprising instructions for:

loading a run-time executable code from the non-volatile memory of the computer system to the system memory;

executing a process from the run-time executable code on the computer system;

detecting an exception caused by the process executing on the computer system, the exception including a plurality of exception pointers referring to a system memory address containing a corrupted portion of the run-time executable code that caused the exception;

reading the run-time executable code from the system memory with the plurality of exception pointers;

reading a stored executable code from the non-volatile memory of the computer system, the stored executable code including an uncorrupted portion of the run-time executable code that caused the exception;

comparing the run-time executable code and the stored executable code; and

identifying a corrupt system memory pattern in the run-time executable code if the run-time executable code and the stored executable code are not identical.