Embedding forensic and triage data in memory dumps
View Patent ↗Disclosed herein are methods, systems, and processes to embed forensic and triage data in memory dumps. Memory dump data being written to kernel memory of a computing system by a firmware interface is detected. An operating mode of an operating system executing on the computing system is activated. Hardware forensic data is generated by reading local computer bus data, firmware event log data, and memory mapped input/output (I/O) data associated with the computing system. The hardware forensic data is then stored in a memory location of the kernel memory, causing the hardware forensic data to be included in the memory dump data being written to kernel memory.
1. A computer-implemented method, comprising:
detecting that a firmware interface is writing memory dump data to kernel memory of a computing system;
based on the detecting, activating an operating mode of an operating system executing on the computing system;
generating hardware forensic data by reading local computer bus data, firmware event log data, and memory mapped input/output (I/O) data associated with the computing system; and
storing the hardware forensic data in a memory location of the kernel memory causing the hardware forensic data to be included in the memory dump data.
2. The computer-implemented method of claim 1 , wherein
the firmware interface is a Unified Extensible Firmware Interface (UEFI),
the operating mode is a System Management Mode (SMM),
the local computer bus data is associated with a Peripheral Component Interconnect (PCI) of the computing system, and
the firmware event log is a Basic Input/Output System (BIOS) log.
3. The computer-implemented method of claim 2 , further comprising:
generating thermal data comprising a current temperature of one or more thermistors in the computing system; and
generating Non-Volatile Random Access Memory (NVRAM) data comprising a last configuration created by a memory reference code.
4. The computer-implemented method of claim 3 , wherein
the local computer bus data comprises one or more Peripheral Component Interconnect Express (PCIE) registers for one or more PCIE bridges of the computing system and indicates whether one or more PCI devices have gone offline, and
the memory mapped I/O data comprises information associated with one or more storage controllers and one or more Universal Serial Bus (USB) devices of the computing system and indicates whether the one or more storage controllers or the one or more USB devices have gone offline or into an error state.
5. The computer-implemented method of claim 4 , further comprising:
parsing the hardware forensic data prior to causing the inclusion of the hardware forensic data in the memory dump data, wherein the parsing comprises:
determining whether a machine check is active,
determining whether a boot device went offline,
determining whether a PCIE bridge of the one or more PCIE bridges has an error or has gone offline,
determining whether a storage controller of the one or more storage controllers or a USB device of the one or more USB devices is in an errant state, and
determining whether a thermal sensor is at or within a threshold of a critical level.
6. The computer-implemented method of claim 5 , further comprising:
based on the parsing, generating hardware triage data; and
storing the hardware triage data in the memory location along with the hardware forensic data for inclusion in the memory dump data.
7. The computer-implemented method of claim 6 , wherein
detecting that the firmware interface is writing the memory dump data to the kernel memory comprises determining whether an NVRAM variable associated with a kernel debugger is being written to, and
calling a software System Management Interrupt (SMI) associated with the SMM to write the hardware triage data and the hardware forensic data to an Advanced Configuration and Power Interface (ACPI) memory structure in the kernel memory.
8. A non-transitory computer readable storage medium comprising program instructions executable to:
detect that a firmware interface is writing memory dump data to kernel memory of a computing system;
based on the detecting, activate an operating mode of an operating system executing on the computing system;
generate hardware forensic data by reading local computer bus data, firmware event log data, and memory mapped input/output (I/O) data associated with the computing system; and
store the hardware forensic data in a memory location of the kernel memory causing the hardware forensic data to be included in the memory dump data.
9. The non-transitory computer readable storage medium of claim 8 , wherein
the firmware interface is a Unified Extensible Firmware Interface (UEFI),
the operating mode is a System Management Mode (SMM),
the local computer bus data is associated with a Peripheral Component Interconnect (PCI) of the computing system, and
the firmware event log is a Basic Input/Output System (BIOS) log.
10. The non-transitory computer readable storage medium of claim 9 , further comprising:
generating thermal data comprising a current temperature of one or more thermistors in the computing system; and
generating Non-Volatile Random Access Memory (NVRAM) data comprising a last configuration created by a memory reference code.
11. The non-transitory computer readable storage medium of claim 10 , wherein
the local computer bus data comprises one or more Peripheral Component Interconnect Express (PCIE) registers for one or more PCIE bridges of the computing system and indicates whether one or more PCI devices have gone offline, and
the memory mapped I/O data comprises information associated with one or more storage controllers and one or more Universal Serial Bus (USB) devices of the computing system and indicates whether the one or more storage controllers or the one or more USB devices have gone offline or into an error state.
12. The non-transitory computer readable storage medium of claim 11 , further comprising:
parsing the hardware forensic data prior to causing the inclusion of the hardware forensic data in the memory dump data, wherein the parsing comprises:
determining whether a machine check is active,
determining whether a boot device went offline,
determining whether a PCIE bridge of the one or more PCIE bridges has an error or has gone offline,
determining whether a storage controller of the one or more storage controllers or a USB device of the one or more USB devices is in an errant state, and
determining whether a thermal sensor is at or within a threshold of a critical level.
13. The non-transitory computer readable storage medium of claim 12 , further comprising:
based on the parsing, generating hardware triage data; and
storing the hardware triage data in the memory location along with the hardware forensic data for inclusion in the memory dump data.
14. The non-transitory computer readable storage medium of claim 13 , wherein
detecting that the firmware interface is writing the memory dump data to the kernel memory comprises determining whether an NVRAM variable associated with a kernel debugger is being written to, and
calling a software System Management Interrupt (SMI) associated with the SMM to write the hardware triage data and the hardware forensic data to an Advanced Configuration and Power Interface (ACPI) memory structure in the kernel memory.
15. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
detect that a firmware interface is writing memory dump data to kernel memory of a computing system;
based on the detecting, activate an operating mode of an operating system executing on the computing system;
generate hardware forensic data by reading local computer bus data, firmware event log data, and memory mapped input/output (I/O) data associated with the computing system; and
store the hardware forensic data in a memory location of the kernel memory causing the hardware forensic data to be included in the memory dump data.
16. The system of claim 15 , wherein
the firmware interface is a Unified Extensible Firmware Interface (UEFI),
the operating mode is a System Management Mode (SMM),
the local computer bus data is associated with a Peripheral Component Interconnect (PCI) of the computing system, and
the firmware event log is a Basic Input/Output System (BIOS) log.
17. The system of claim 16 , further comprising:
generating thermal data comprising a current temperature of one or more thermistors in the computing system; and
generating Non-Volatile Random Access Memory (NVRAM) data comprising a last configuration created by a memory reference code.
18. The system of claim 17 , wherein
the local computer bus data comprises one or more Peripheral Component Interconnect Express (PCIE) registers for one or more PCIE bridges of the computing system and indicates whether one or more PCI devices have gone offline, and
the memory mapped I/O data comprises information associated with one or more storage controllers and one or more Universal Serial Bus (USB) devices of the computing system and indicates whether the one or more storage controllers or the one or more USB devices have gone offline or into an error state.
19. The system of claim 18 , further comprising:
parsing the hardware forensic data prior to causing the inclusion of the hardware forensic data in the memory dump data, wherein the parsing comprises:
determining whether a machine check is active,
determining whether a boot device went offline,
determining whether a PCIE bridge of the one or more PCIE bridges has an error or has gone offline,
determining whether a storage controller of the one or more storage controllers or a USB device of the one or more USB devices is in an errant state, and
determining whether a thermal sensor is at or within a threshold of a critical level;
based on the parsing, generating hardware triage data; and
storing the hardware triage data in the memory location along with the hardware forensic data for inclusion in the memory dump data.
20. The system of claim 19 , wherein
detecting that the firmware interface is writing the memory dump data to the kernel memory comprises determining whether an NVRAM variable associated with a kernel debugger is being written to, and
calling a software System Management Interrupt (SMI) associated with the SMM to write the hardware triage data and the hardware forensic data to an Advanced Configuration and Power Interface (ACPI) memory structure in the kernel memory.