CN100472471C - A system and method for acquiring computer operating system fault site information - Google Patents

Abstract

A system and method for obtaining on-site information of a computer operating system fault, operating based on EFI BIOS and an operating system running on the EFI BIOS, including an operating system monitoring module (2), a counter (4) and a hardware dog module (5); EFI BIOS includes a memory allocation module (1) and a runtime service module (3); after the computer is powered on, when the EFI BIOS initializes the memory, the memory allocation module (1) divides the physical memory into operating system memory and fault analysis system memory; operation When the system is running, it starts and resides the operating system monitoring module (2), and the operating system monitoring module (2) collects the on-site information of the operating system; when the operating system crashes, the event of the operating system crashing is notified to the runtime service module (3) of the EFI BIOS ); the running time service module (3) establishes a fault analysis system environment for obtaining fault site information of the operating system, and obtains the fault site information of the operating system. It can ensure that the operating system analyzes and diagnoses the system at the site of the fault, and obtains the information of the fault site.

Description

A system and method for acquiring computer operating system fault site information

technical field

The invention relates to the field of computers, in particular to a system and a method for acquiring fault site information of a computer operating system.

Background technique

At present, the computer operating system (Operation System, OS), especially the multitasking operating system, such as the Windows operating system, is relatively complicated. During the operation of a complete operating system, due to the operation of multiple applications or new programs, it may A new failure has occurred. Generally, existing operating systems have some methods for diagnosing and maintaining the operating system, which can monitor the working status of the operating system and alert the user in advance when there is a possible problem. However, when some fatal errors occur in the operating system (such as memory errors, application out-of-bounds access, etc.), the operating system will crash, including an infinite loop (that is, crash) or an unrecognizable error (blue screen). The computer machine restarts. However, at this time, all computer failure site information will be lost, and further failure analysis cannot be carried out, and the root cause of the problem cannot be found. If the problem of the machine is not ruled out, hidden dangers still exist, the stability and performance of the system cannot be guaranteed, and failures may occur again when the constraints are met, and the user's trust in it will decline. Therefore, in the computer operating system, if the operating system crashes or crashes, how to obtain fault site information has become an urgent problem to be solved in the industry.

The existing methods for handling fatal operating system errors are as follows:

1. After the operating system (such as Windows operating system) crashes, the dump process of the operating system will dump (dump). The existing three dump modes are small memory dump (64K); core memory dump; Complete memory dump before analyzing the dump file with the analysis tool program.

But these three methods of handling fatal operating system errors all have the following defects:

The transition of these three dump modes for dealing with fatal errors in the operating system needs to be set under the operating system. If you want to perform a full memory dump, it will take up a lot of core storage space, but if it is too small (small memory dump), it will be lost. A lot of information, of course, users can apply different dump modes according to different applications and crashes, but when the computer operating system crashes, it can only be dumped according to the set dump mode, and cannot be changed to Other dump modes. On the other hand, this method still needs to rely on the dump under the operating system. If there is a serious operating system failure, such as the crash of the dump, or the failure of the local memory of the operating system In this case, the site information cannot be saved.

2. When a fatal error occurs in the computer operating system, the system administrator or operating system developer will restart the computer on site, obtain fault site information, and perform operations such as computer fault diagnosis and maintenance.

However, the disadvantages of this method are also obvious. The main disadvantage is that system administrators or operating system developers need to go to the site to operate, which requires a lot of time and energy for system administrators or operating system developers to develop the operating system. diagnostics and maintenance. And because there is no scene when the computer crashes, the system administrator or operating system developer cannot accurately locate the fault, but can only rely on experience and a large number of analysis tool programs to find problems and obtain on-site fault information by running for a long time. It is very low, and the probability of being able to find out the on-site information of the computer operating system failure is also low. Therefore, this method cannot be widely used in practical applications.

Contents of the invention

The purpose of the present invention is to overcome the above defects and provide a system and method for obtaining computer fault site information, which can ensure that the operating system analyzes and diagnoses the system at the fault site, and obtains the information of the fault site, including memory information, etc. .

The system that a kind of computer operating system failure site information acquisition provided for realizing the purpose of the present invention operates based on EFI BIOS and the operating system running on the EFI BIOS;

Including an operating system monitoring module, the EFI BIOS includes a memory allocation module and a runtime service module;

The memory allocation module is used to divide the physical memory into operating system memory and fault analysis system memory when EFI BIOS initializes the memory in the pre-boot stage after the computer system is powered on;

The operating system monitoring module runs and resides in the operating system, and is used to collect and store the on-site information of the operating system when the operating system is running normally; at the same time, when the operating system crashes, the event of the operating system crash is notified to the EFI BIOS The runtime service module.

The runtime service module runs in the memory space of the fault analysis system, and is used to initialize the fault analysis system files for obtaining operating system fault information, establish a fault analysis system environment for obtaining operating system fault site information, and provide an analysis system support environment, Obtain the operating system fault site information, select the operating system fault site information and save location, and save the information content to the location.

The system of the present invention may also include a counter and a hardware dog module;

Described counter is used for timing computer running time; Operating system monitoring module regularly rewrites counter, prevents counter from overflowing; When counter overflows, then produces interruption, triggers EFI BIOS interrupt management program, starts hardware dog module;

The hardware dog module is used to adjust the pointer of the system program to the runtime service module in the fault analysis system memory space, so that the control right of the computer system is transferred to the runtime service module of the EFI BIOS.

The operating system is Windows operating system.

The present invention also provides a method for acquiring computer operating system failure site information, which is characterized in that it includes the following steps:

Step A) After the computer is powered on, when the EFI BIOS initializes the memory, the memory allocation module divides the physical memory into operating system memory and fault analysis system memory;

Step B) when the operating system is running, start and reside in the operating system monitoring module, the operating system monitoring module collects the site information of the operating system; when the operating system crashes, the event of the operating system crashing is notified to the runtime service module of the EFI BIOS;

Step C) The runtime service module runs in the memory space of the fault analysis system, establishes a fault analysis system environment for obtaining fault site information of the operating system, and obtains fault site information of the operating system.

Described step B) also comprises the following steps:

Step B1) when the operating system is running, start and reside in the operating system monitoring module, and the operating system monitoring module regularly writes the counter;

Step B2) When the operating system crashes and enters the EFI BIOS system management mode, the hardware dog module points the system program pointer to the runtime service module, and starts the runtime service module.

Described step C) comprises the following steps:

Step C1) The runtime service module uploads the device driver based on EFI;

Step C2) The analysis tool selects the memory content and storage location of the operating system failure site, records and saves the site information.

Said step C1) also includes the following steps:

The runtime service module loads the EFI web service, establishes a network-based connection, and after loading the network card driver, sends a system warning to the control terminal through the network to inform the control terminal of the current state of the operating system.

The device drivers include network card drivers, IDE/SCSI device drivers, USB device drivers, and PCI device drivers.

The context information includes one or more types of information among CPU utilization information, memory utilization information, register content information and process information.

The beneficial effect of the present invention is: the present invention utilizes EFI BIOS to finish the analysis to operating system crash, when computer operating system breaks down, utilizes the memory space that is independent of operating system and analysis operation environment to analyze the reason that computer operating system crashes, Obtain fault site information. It judges and saves the current state of the computer operating system, and enters an independent memory space when the operating system fails without destroying the memory area and memory state of the operating system, and analyzes the memory area and memory state of the operating system in the analysis environment. Combined with the bottom-level diagnosis of the hardware system, the on-site information of the machine failure is obtained, and the cause of the failure of the computer operating system is obtained.

Description of drawings

Fig. 1 is a schematic diagram of the system structure of computer operating system failure site information acquisition of the present invention;

Fig. 2 is a flowchart of the working process of the monitoring module in Fig. 1;

Fig. 3 is a flowchart of the counter interrupt module of the present invention;

Fig. 4 is the flow chart of EFI BIOS running time service module of the present invention.

Detailed ways

A system and method for acquiring fault site information of a computer operating system according to the present invention will be further described below in conjunction with accompanying drawings 1 to 4 .

The present invention overcomes the weakness of the existing basic input/output system (Basic Input/Output System, BIOS), utilizes the improvement and enhancement of EFI BIOS in two aspects of the runtime (runtime) function and the pre-boot (pre-boot) function, and solves the problem of The problem of obtaining computer failure scene information when the computer operating system crashes is solved.

The present invention will relate to Extensible Firmware Interface (EFI) technology, we first introduce it below:

Extensible Firmware Interface (Extensible Firmware Interface, EFI) is a new generation of interface program that appeared in 1999 to replace the basic input and output system (BIOS) that has been used for many years. For an introduction to the Extensible Firmware Interface, see UEFI Forum for details on EFI technology Introduction to http://www.UEFI.org. EFI BIOS is between hardware devices and operating systems (such as Windows or Linux). Different from traditional BIOS, EFI BIOS is written in C language, the most widely used high-level language in the world. It provides both traditional BIOS functions and extended functions superior to traditional BIOS, and is also different from traditional BIOS in terms of design mechanism and architecture. The realization of the BIOS interface specification is the next generation, which means that more engineers can participate in the development of EFI BIOS and add many more valuable functions.

The basic functions of EFI BIOS are:

Hardware platform initialization;

Support booting the operating system;

Platform management tools that are independent of the operating system.

The working mode of EFI BIOS can be simply summarized as follows: start the system, initialize the standard firmware platform, then load the EFI driver library and execute related programs, select the system to enter in the EFI BIOS system boot menu and submit the boot guide to EFI BIOS If the code is normal, it will enter the system, otherwise it will stop the startup service and return to the EFI BIOS system startup menu.

In the fault scene information acquisition method for the computer operating system of the present invention, the Windows operating system is particularly described, but the present invention is also applicable to operating systems other than the Windows operating system.

As shown in Figure 1, the system that the computer operating system failure site information acquisition of the present invention includes:

(1) The memory allocation module 1 is used to support EFI BIOS in the hardware architecture. After the computer system is powered on (Power on), the EFI BIOS is in the pre-boot (pre-boot) stage. When the EFI BIOS initializes the memory, it will Part of the memory is reserved. At this time, the memory size provided by the EFI BIOS to the Windows operating system is the size of the system physical memory minus the size of the reserved memory.

At the same time, the memory allocation module 1 puts the fault analysis system file used for obtaining the fault information of the operating system into the reserved memory area for access when the operating system crashes.

After the system is powered on (Power on), the EFI BIOS initializes the memory in the pre-boot stage, starts the memory allocation module 1, and the memory allocation module 1 divides the memory into two parts:

Part of it is the operating system memory, which is used for the Windows operating system after entering the operating system installation (OS load) stage, the operating system controls this part of the memory, and allocates it to the operating system and various process programs running on the operating system.

The other part is reserved for the fault analysis system memory. When the EFI BIOS is started, it is initialized to reserve memory space for the fault analysis system environment. This reserved memory space is only allocated to the fault analysis system files, and the Windows operating system cannot find and use this memory after startup. part space. Run the runtime (runtime) service module 3 of EFI BIOS in this reserved space. The main function of this module is to set up the necessary operating environment to obtain fault information, such as loading the driver of EFI network card (NIC), loading analysis tools (diagnostic tool) and save the content of the Windows operating system fault information.

(2) The operating system monitoring module 2 is used to collect operating system site information when the operating system is running; at the same time, it is found that the operating system cannot respond to the operation request of the application program, and when the operating system crashes, the event of the operating system crash is notified to EFI BIOS The runtime (runtime) service module 3.

(3) counter (Timer) 4, is used for timing computer running time; Operating system monitoring module 2 regularly rewrites counter 4, prevents counter 4 from overflowing; When counter 4 overflows, then produces interruption, triggers EFI BIOS interrupt management program, starts hardware dog module 5.

When the operating system was running normally, the operating system monitoring module 2 regularly rewritten the counting register of the counter 4 in the south bridge ICH chip (I/OController HUB) in the computer hardware, thereby ensuring that the counter 4 would not overflow and produce an overflow interrupt; when the operating system When it crashes, the monitoring module 2 residing and running in the operating system cannot operate normally, so the counting register of the south bridge counter 4 cannot be written regularly, thus causing the counter 4 to not reset regularly, the counter 4 overflows, generates an interrupt, and triggers The EFI BIOS interrupt management program is executed, and the hardware dog module 5 is started.

(4) hardware dog module 5, be used for the pointer of system program is adjusted to the running time (runtime) service module 3 in the fault analysis system memory space, thereby the control right of computer system is transferred to the running time (runtime) of EFI BIOS In service module 3.

(5) The running time (runtime) service module 3 of EFI BIOS is used to initialize the parts of the analysis environment for obtaining operating system failure information. When entering the running time service module 3, the hardware system needs to be initialized to make it set up Generate failure analysis system environment, provide analysis system support environment, such as loading EFI NIC driver, loading analysis tool (diagnostic tool), select operating system failure scene information and save location, and save information content to this location.

When the Windows operating system crashes, the analysis tool 6 obtains the information of the system failure by reading the information such as memory and register contents when the operating system crashes, and combines the underlying diagnosis of the system hardware to diagnose the specific cause of the failure of the operating system. Then select the operating system failure site information and save location, and save the information content to the location.

After the Windows operating system is started, under the condition of normal operation, when the operating system monitoring module 2 runs and resides in the operating system, it collects the on-site information of the Windows operating system, including CPU utilization, memory utilization, register content, process information, And write to the fixed memory space of the memory managed by the operating system.

At the same time, the operating system monitoring module 2 regularly rewrites the counting register of the south bridge counter 4 to ensure that the counter 4 will not overflow and generate an overflow interrupt.

If the operating system crashes, the monitoring module 2 residing and running in the operating system cannot operate normally, so the counting register of the south bridge counter 4 cannot be rewritten regularly, resulting in counter 4 not being reset regularly, counter 4 overflows, and an interrupt is generated , triggered the EFI BIOS interrupt management program, entered the EFI BIOS system management mode (System Management, SM), started the hardware dog module 5, and the hardware dog module 5 pointed the system program pointer to the runtime (runtime) in the fault analysis system memory space Service module 3, so that system control is transferred to the runtime (runtime) service module 3 of EFI BIOS.

Runtime (runtime) service module 3 first uploads the device driver based on EFI, including network card (NIC), IDE/SCSI device driver, USB device driver, PCI device driver, by uploading the above drivers, EFI BIOS obtains the control right of the corresponding device , can carry out the operation of I/O device; Then, load EFI web service (service), establish based on network connection, preferably, be based on http network connection, after loading network card (NIC) driver, send to a certain place through network The control terminal sends a system warning to notify the remote administrator of the current state of the operating system; finally, the analysis tool (diagnostictool) 6 selects the memory content of dump (dump), storage location, such as USB storage according to the instruction of the remote console. , network storage, or local hard disk storage, so as to record the information on site.

Below in conjunction with above-mentioned system, further describe a kind of method of computer failure field information acquisition of the present invention:

Step A: After the computer is powered on, in the pre-boot stage, when the EFI BIOS initializes the memory, the memory allocation module 1 divides the physical memory into the operating system memory and the fault analysis system memory.

After the computer is powered on (Power on), the EFI BIOS initializes the memory in the pre-boot stage, starts the memory allocation module 1, and the memory allocation module 1 divides the memory into two parts:

Part of it is the operating system memory, which is used for the Windows operating system after entering the operating system installation (OS load) stage, the operating system controls this part of the memory, and allocates it to the operating system and various process programs running on the operating system.

The other part is reserved for the fault analysis system memory, which is initialized to reserve memory space for the fault analysis system environment when the EFI BIOS is started. This reserved memory space is only allocated to the fault analysis system environment, and the Windows operating system cannot find and use this memory space after startup. part space. And run the runtime (runtime) service module 3 of EFI BIOS in this reserved space, the runtime service module 3 establishes the necessary operating environment to obtain fault information, such as loading the driver of EFI NIC, loading analysis tool (diagnostic tool) 6 And save the content of the fault information of the Windows operating system.

Step B: when the operating system is running, start and reside in the operating system monitoring module 2, collect the on-site information of the operating system, and regularly rewrite the counter 4; when the operating system crashes, notify the runtime service module 3 of the EFI BIOS of the event of the operating system crash .

Step B1: When the operating system is running, start and reside the operating system monitoring module 2, collect and save the on-site information of the operating system, and rewrite the counter 4 at regular intervals.

As shown in Figure 2, after the Windows operating system is started, under normal operation conditions, the operating system monitoring module 5 runs and resides in the operating system to collect the on-site information of the Windows operating system, including CPU utilization information, memory usage Information, register content information, process information, and write to the fixed memory space managed by the operating system.

At the same time, the operating system monitoring module 2 regularly rewrites the counting register of the south bridge counter 4 to ensure that the counter 4 will not overflow and generate an overflow interrupt.

Step B2: When the operating system crashes and enters the EFI BIOS system management mode, the hardware dog module 5 points the system program pointer to the runtime (runtime) service module 3, and starts the runtime (runtime) service module 3.

As shown in Figure 3, if the operating system crashes, such as the blue screen of system crash, etc., then the monitoring module 2 that resides and operates in the operating system cannot operate normally, so the counting register of the south bridge counter 4 cannot be written regularly, thereby causing the counter 4 does not reset regularly, and the counter 4 overflows, and interrupts are generated, which triggers the EFI BIOS interrupt management program, enters the EFI BIOS system management mode (SystemManagement, SM), and points the system program pointer to the running time in the fault analysis system memory space ( runtime) service module 3, so that the system control right is transferred to the runtime (runtime) service module 3 of EFI BIOS.

Step C: The runtime service module 3 establishes a fault analysis system environment for obtaining fault site information of the operating system, and obtains fault site information of the operating system.

When the runtime service module 3 is started, it uploads the device driver, establishes a network connection, starts the analysis tool, and selects and stores fault site information.

The operating system monitoring module 2 can not regularly write the counting register of the counter 4 when the operating system crashes, the timer 4 overflows, triggers the interrupt management program of the EFI BIOS, enters the system management mode (SM) of the EFI BIOS, and starts the hardware dog module 5 , the hardware dog module 5 points the pointer of the system program to the runtime (runtime) service module 3 .

Runtime (runtime) service module 3 first uploads the device driver based on EFI, including network card (NIC), IDE/SCSI device driver, USB device driver, PCI device driver, by uploading the above drivers, EFI BIOS obtains the control right of the corresponding device , you can operate the I/O device;

Then, the runtime service module 3 loads the EFI web service (service), establishes a network connection based on, preferably, a network connection based on http, and after loading the network card (NIC) driver, sends a system warning to a certain control terminal through the network , notify the remote administrator of the current status of the operating system;

Finally, an analysis tool (diagnostic tool) 6 records and saves on-site information according to the instructions of the remote console, such as selecting the memory content of dump (dump), storage location, such as USB storage, network storage, or local hard disk storage.

The present invention utilizes EFI BIOS at runtime (runtime) and pre-boot (pre-boot) operating environment to complete the monitoring of on-site fault information not dependent on the operating system when the operating system crashes, and its operation and residing in the operating system Module 2 acquires the on-site information of the operating system, judges the current state of the operating system, enters the analysis environment when the operating system crashes, does not destroy the memory area of windows, and analyzes the memory area of the operating system in the analysis environment and combines the analysis of the hardware system The underlying diagnosis is used to obtain information about machine failures, and can be combined with existing operating system failure analysis tools to find out the cause of operating system failures and ensure the stability of the operating system when it is running.

This embodiment is a detailed description for a better understanding of the present invention, and is not a limitation of the protection scope of the present invention. Changes are within the protection scope of the present invention.

Claims (10)

1. A system for computer operating system failure scene information acquisition, based on EFI BIOS and operating system running on EFI BIOS, is characterized in that: Including an operating system monitoring module (2), the EFI BIOS includes a memory allocation module (1) and a runtime service module (3); The memory allocation module (1) is used to divide the physical memory into operating system memory and fault analysis system memory when the EFI BIOS is in the pre-boot stage after the computer system is powered on, and when the memory is initialized by the EFI BIOS; The operating system monitoring module (2) runs and resides in the operating system, and is used to collect and store the on-site information of the operating system when the operating system is running normally; Notify the runtime service module (3) of EFI BIOS; The runtime service module (3) runs in the memory space of the fault analysis system, and is used to initialize the fault analysis system files for obtaining fault information of the operating system, establish a fault analysis system environment for obtaining fault site information of the operating system, and provide an analysis system Support the environment, obtain the on-site information of the operating system failure, select the on-site information and storage location of the operating system failure, and save the information content to the location. 2. the system that computer operating system failure site information acquisition according to claim 1 is characterized in that, also comprises counter (4) and hardware dog module (5); The counter (4) is used for timing computer running time; the operating system monitoring module (2) rewrites the counter (4) regularly to prevent the counter (4) from overflowing; when the counter (4) overflows, an interrupt is generated to trigger the EFI BIOS Interrupt management program, start hardware dog module (5); The hardware dog module (5) is used to adjust the pointer of the system program to the runtime service module (3) in the fault analysis system memory space, so that the control right of the computer system is transferred to the runtime service module (3) of the EFI BIOS middle. 3. The system for acquiring on-site information of a computer operating system fault according to claim 1 or 2, wherein the operating system is a Windows operating system. 4. The system for acquiring computer operating system failure site information according to claim 1 or 2, wherein said site information includes CPU utilization rate information, memory usage rate information, register content information and process information. Or a combination of multiple types of information. 5. A method for computer operating system failure site information acquisition, characterized in that, comprising the following steps: Step A) After the computer is powered on, when the EFI BIOS initializes the memory, the memory allocation module (1) divides the physical memory into operating system memory and fault analysis system memory; Step B) when the operating system is running, start and reside in the operating system monitoring module (2), the operating system monitoring module (2) collects the site information of the operating system; when the operating system crashes, the event of the operating system crashing is notified to the running time of the EFI BIOS service module (3); Step C) The runtime service module (3) runs in the memory space of the fault analysis system, establishes a fault analysis system environment for obtaining fault site information of the operating system, and obtains the fault site information of the operating system. 6. the method for computer operating system failure site information acquisition according to claim 5, is characterized in that, described step B) also comprises the following steps: Step B1) when the operating system is running, start and reside in the operating system monitoring module (2), and the operating system monitoring module (2) regularly writes the counter (4); Step B2) When the operating system crashes and enters the EFI BIOS system management mode, the hardware dog module (5) points the system program pointer to the runtime service module (3), and starts the runtime service module (3). 7. according to the method for claim 5 or 6 described computer operating system failure site information acquisition, it is characterized in that, described site information comprises CPU utilization rate information, memory usage rate information, a class in register content information and process information Or a combination of multiple types of information. 8. according to claim 5 or the method for the computer operating system failure site information acquisition described in claim 6, it is characterized in that, described step C) comprises the following steps: Step C1) runtime service module (3) uploads the device driver based on EFI; Step C2) The analysis tool (6) selects the memory content and storage location of the operating system failure site, records and saves the site information. 9. The method for computer operating system fault scene information acquisition according to claim 8, is characterized in that, described step C1) also comprises the following steps: The runtime service module (3) loads the EFI web service and establishes a network connection. After the network card driver is loaded, a system warning is sent to the control terminal through the network to notify the control terminal system of the current state of the operating system. 10. The method for computer operating system failure site information acquisition according to claim 8, wherein said device driver comprises a network card driver, an IDE/SCSI device driver, a USB device driver, and a PCI device driver.

Images