Kernel-mode in-flight recorder tracing mechanism

• US 7,849,364 B2
• Filed: 03/01/2005
• Issued: 12/07/2010
• Est. Priority Date: 03/01/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Callender, Robin L.
• Primary Examiner(s): Guyton; Philip
• Assistant Examiner(s): Riad; Amine
• Application Number:
  US11/069,786
• Publication Number:
  US 20060200701A1
• Time in Patent Office: 2,107 Days
• Field of Search: 714/38, 714/44
• US Class Current: 714/38.1
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence

Abstract

The subject invention relates to systems and methods that automatically monitor and record component-related activities to support remote diagnostic capabilities. In one aspect, an automated computer diagnostic system is provided. The system includes a trace component that monitors computer-related activities between a driver and an operating system component. The trace component can be embedded within the driver or coupled thereto but, generally records activities relating to a given driver in contrast to generically for the entire operating system. A log records the computer-related activities to facilitate problem diagnosis with respect to the driver or the operating system component.

Claims

1. An automated computer diagnostic system for use in a system comprising a plurality of drivers including at least a first driver, the automated computer diagnostic system comprising at least one processor programmed to implement:

a trace component that monitors computer-related activities between the first driver and an operating system component, the trace component being embedded within the first driver and the monitoring occurring during operation of the first driver;

a log that records indications of all of the computer-related activities to facilitate problem diagnosis with respect to the first driver, the log comprising a circular buffer in which older indications of computer-related activities are overwritten by newer indications of computer-related activities, the computer-related activities recorded by the log comprising one or more of a trace state, event, address, interrupt state, bus state, signal state, register status, framework status, and processor status; and

a remote debugging system that, in the event of a failure of the first driver;

automatically analyzes contents of the log, using one or more of automated error code analysis, statistical analysis and artificial intelligence analysis,

provides a user interface that;

presents, to a user based on content of the log, one or more of an automated suggestion, a help index, and contact information for a support service,

sends, to the trace component for execution, one or more of breakpoint, file inspection and register dump commands,

receives from the trace component a result generated by executing the one or more of breakpoint, file inspection and register dump commands, and

presents to the user an indication of the received result,

determines a cause of the failure, the cause comprising an inconsistency in code level revisions to the first driver and the operating system component, and

repairs the determined cause of the failure, the repair comprising identifying a code update to the first driver to remove the inconsistency and transmitting the identified code update to the first driver.

2. The system of claim 1, the trace component is provided as an instruction that taps information from the operating system component.

3. The system of claim 1, the trace component operates in parallel with at least one other trace component adapted for the operating system component.

4. The system of claim 1, wherein the user interface includes at least one of a trace analyzer, an error code table or listing, a suggestion display, a help index, a support icon, a support number, and controls for at least one of a break command or a file inspection command.

5. The system of claim 1, the remote debugging system includes one or more automated procedures to diagnose a system or driver failure or to repair a system or driver failure.

6. The system of claim 1, the log is provided as part of a system crash dump of information or as part of a miniature dump of information.

7. A computer readable medium having computer-readable instructions stored thereon for implementing the components of claim 1.

8. A method for capturing diagnostic information for use in a computer system comprising a plurality of drivers including at least a first driver, the method comprising:

employing a processor executing computer-executable instructions stored on a computer-readable storage medium to perform acts comprising;

embedding a trace recording element within the first driver to monitor activities between the first driver and an operating system component, the monitoring occurring during operation of the first driver;

interfacing the trace recording element with an operating system;

logging indications of all of the activities monitored by the trace recording element to an analysis file, the analysis file comprising a circular buffer in which older indications of activities are overwritten by newer indications of activities, the output recorded in the analysis file comprising one or more of a trace state, event, address, interrupt state, bus state, signal state, register status, framework status, and processor status;

upon a failure of the first driver or the operating system, automatically analyzing contents of the log, using one or more of automated error code analysis, statistical analysis and artificial intelligence analysis;

providing a user interface that;

presents, to a user based on the content of the analysis file, one or more of an automated suggestion, a help index, and contact information for a support service,

sends, to the trace recording element for execution, one or more of breakpoint, file inspection and register dump commands,

receives from the trace recording element a result generated by executing the one or more of breakpoint, file inspection and register dump commands, and

presents to the user an indication of the received result,

determining a cause of the failure, the cause comprising an inconsistency in code level revisions to the first driver and the operating system component, and

repairs the determined cause of the failure, the repair comprising identifying a code update to the first driver to remove the inconsistency and transmitting the identified code update to the first driver.

9. The method of claim 8, further comprising automatically transmitting the analysis file to a debugging station.

10. The method of claim 8, further comprising automatically responding to at least one event contained in the analysis file.

11. The method of claim 10, further comprising applying a statistical or learning function to respond to the event.

12. A system to facilitate computer diagnostic operations for use in a computer system comprising a plurality of driver components including at least a first driver component, the system comprising at least one processor programmed to implement:

means for tracing activities of the first driver component interfacing with an operating system, the means for tracing being embedded within the first driver and the tracing occurring during operation of the first driver;

means for interfacing the driver component to a log;

means for recording indications of all of the activities of the first driver to the log, the log comprising a circular buffer in which older records of activities are overwritten by newer records of activities, the log recording activities comprising one or more of a trace state, event, address, interrupt state, bus state, signal state, register status, framework status, and processor status;

means for interfacing the first driver component to a computer library component;

means for transmitting the log to a remote debugging system in the event of a first driver failure;

means for automatically analyzing contents of the log, using one or more of automated error code analysis, statistical analysis and artificial intelligence analysis, to diagnose a cause of the first driver failure,

means for presenting a user interface that;

presents, to a user based on content of the log, one or more of an automated suggestion, a help index, and contact information for a support service,

sends, to the means for tracing for execution, one or more of breakpoint, file inspection and register dump commands,

receives, from the means for tracing, a result generated by executing the one or more of breakpoint, file inspection and register dump commands, and

presents to the user an indication of the received result,

means for determining the cause as comprising an inconsistency in code level revisions to the first driver and the operating system; and

means for receiving a corrective measure from the remote debugging system, the corrective measure comprising a code update to the first driver identified by the remote debugging system to remove the inconsistency in code level revisions.

13. The system of claim 12, further comprising means for applying a statistical or learning function to respond to the driver failure.