Microsoft Technology Licensing, LLC

Peter W Wieland

Norbert Paul Kusters

Kumar Rajeev

Luis Felipe Cabrera

Martin Abadi

Mingtzong Lee

Adrian J Oney

John Joseph Richardson

Benjamin Scott McGregor

Nar Ganapathy

Robert Dale Rinne

John Michael Sheehan

Kai Chen

Ulfar Erlingsson

Henry Gabryjelski

Krishnan Varadarajan

Alan M Warwick

Peter Eberhardy

Jason Stewart Wohlgemuth

Dilip Naik

Gor Nishanov

Peter J Torr

Ray Sun

Melur K Raghuraman

Lonny Dean McMichael

George Evangelos Roussos

Shyamal Kaushik Varma

Raju Ramanathan

Yifan Wang

Minsang Kim

Dylan D'Silva

Aacer Hatem Daken

Paul Sliwowicz

Dylan David Miller

Matthew Gonzalez

Ulfar Erlingson

Various systems and methods for capability access management are disclosed herein. In one example, a system includes a memory and a processor to send a signed custom capability description (SCCD) received from a first vendor to the memory for storage. The system may send an application received from a second vendor to the memory for storage. The system attempts to match the application to an authorization listing of the SCCD, where the application can be modified to allow access to a previously inaccessible custom capability in response to the application matching the authorization listing of the SCCD.

Capability access management

Described herein is a system for driver execution. A driver is loaded in a first domain with the driver controlling an associated device. In response to a request from the driver, the driver companion is loaded in a second domain different than the first domain, the second domain comprising a secure environment. The driver companion communicates with the associated device. Communications between the driver and the driver companion are managed (e.g., by an operating system framework). In response to a request from the driver, the driver companion is unloaded.

Execution of subset of driver code in separate protection domain

Techniques described herein enable the implementation of a secure driver framework. In one example, a method includes managing an unsecure operating system execution environment comprising a first user mode and a first kernel mode. The method can also include managing a secure execution environment comprising a second user mode and a second kernel mode, and executing a secure driver within the second user mode of the secure execution environment in response to a system call from an unsecure driver in the first kernel mode or the first user mode, wherein the secure driver enables the unsecure driver to communicate with a secure device. Furthermore, the method can include providing one or more system services of the second kernel mode to the secure driver.

Secure driver platform

Systems, methods, and computer-readable storage media are provided for brokering access to peripheral devices and/or device models associated with a computing system. An access broker evaluates requests for access to peripheral devices/models on behalf of a plurality of applications. The access broker evaluates requests for access to peripheral devices including scanners, point-of-sale devices, and devices using ubiquitous device protocols (e.g., USB, HID, Bluetooth, and Bluetooth LE) utilizing application declarations and user consents based upon device model identifiers and/or device-specific identifiers associated with the various devices. Applications may be notified of consent changes at runtime and/or application firmware updates for peripheral devices may be conducted upon receipt of user consent, for instance, to ensure adequate battery power before performing a peripheral device firmware update.

Brokering application access for peripheral devices

A device driver includes a kernel mode and a user-mode module. The device driver may access device registers while operating in user-mode to promote system stability while providing a low-latency software response from the system upon interrupts. The device driver may include kernel stubs that are loaded into the operating system, and may be device specific code written. The stubs may be called by a reflector to handle exceptions caught by the stubs. A reset stub may be invoked by the reflector when the user-mode module or host terminates abruptly or detects an interrupt storm. The reset stub may also be invoked if errant direct memory access DMA operations are being performed by a hardware device. The reset stub may ensure that hardware immediately stops unfinished DMA from further transfer, and may be called by the user-mode driver module.

Synchronizing split user-mode/kernel-mode device driver architecture

A method and a processing device are provided for mapping a non-page aligned memory buffer to an address space of a process. A beginning portion of a non-page aligned memory buffer and an ending portion of the non-page aligned memory buffer may be copied from respective original memory pages to new memory pages. Unused portions of the new memory pages may be initialized to zeros, ones, or other values. A safe buffer may be created, which resides in the new memory pages and all original memory pages of the non-page aligned memory buffer, except for the original memory pages including either the beginning portion or the ending portion of the non-page aligned buffer. The safe buffer may then be mapped to an address space of a process while avoiding unintended information disclosure.

Avoiding information disclosure when direct mapping non-page aligned buffers

A device driver includes a kernel stub and a user-mode module. The device driver may access device registers while operating in user-mode to promote system stability while providing a low-latency software response from the system upon interrupts. Upon receipt of an interrupt, the kernel stub may run an interrupt service routine and write information to shared memory. Control is passed to the user-mode module by a reflector. The user-mode module may then read the information from the shared memory to continue servicing the interrupt.

Split user-mode/kernel-mode device driver architecture

A computer configured to operate in diagnostic mode during which the operating system is suspended. During the diagnostic mode, tests can be performed on the computer system, including hardware, and the tests do not disrupt the operating system and are not disrupted by the operating system. When diagnostic mode is triggered, execution of the operating system is suspended. When the diagnostic tests are completed, the operating system may resume operation and test data may be made available within the operating system environment. Upon resuming, the state of the computer prior to entering diagnostic mode may be restored, preventing any changes made during diagnostic mode from interfering with operation of the operating system or application components.

Offline hardware diagnostic environment

When multiple contacts are detected for a phone number of an incoming call, a notification that multiple contacts matched the phone number is displayed. When the display area for displaying the notification is adequate to display a full list of the contacts that correspond to the phone number of the incoming call, the full list is displayed. When the display area is inadequate to display the full list, a scrollable list of the multiple contacts is displayed. Alternatively, when the display area is inadequate, a multiple contacts message is displayed that notifies a user that multiple stored contacts matched the phone number of the incoming phone call.

Display accurate information when multiple contacts are matched for an incoming phone number

A system that facilitates the storage of data using a write barrier. The system interfaces to a hardware component that stores data, and includes a write barrier component that dynamically employs instructions compatible with the hardware component to ensure data integrity during storage of the data. The write barrier component is independent of at least an operating system and an application and can operate in a least one of a user mode and a kernel mode. The write barrier component includes at least one of software instructions, routines, and methods, the selection of one or more of which is based on hardware data extracted from the hardware component. A selection component interrogates the hardware component for hardware data to facilitate selection of one or more instructions most suitable for interfacing to the hardware component. A coalescing component combines cache synchronization requests into a single set of instructions, which set is processed to flush a disk cache in one process.

Write barrier for data storage integrity

In a distributed system, a resource such as a storage device is protected by an owner node's exclusive access to it, wherein exclusive access is established via a persistent reservation on the resource. A persistent reservation is never removed, however the owner node's persistent reservation may be challenged in an arbitration process, to take it away from a failed owner node. A challenger node challenges by changing an owner's access key (that establishes the persistent reservation) to a challenge key, delaying, and determining whether the owner restored the owner's access key during the delay, because a properly operating owner replaces a challenge key with its owner access key. If the owner fails to restore its owner access key, the challenger node becomes the new resource owner by replacing the challenge key with an owner access key of the challenger node. The key may include additional information to provide extensibility.

Distributed system resource protection via arbitration and ownership

A system, methodology and/or computer architecture that facilitates processing device interrupts (including level-triggered interrupts) in a user-mode process is provided. The kernel interrupt handler can cause a dedicated thread in the process to wake and invoke the driver interrupt service routine. This thread can then return control to the kernel interrupt handler. In addition to processing interrupts in an isolated mode, the context switching technique could be used in any isolated environment to process interrupts via dedicated execution context methods.

System and method for interrupt handling

A mount manager and supporting data structures enable automatic identification and re-establishment of logical volumes on non-removable storage devices in a computer system across multiple reboots and reconfigurations. The mount manager generates a redirected name for a new logical volume when a unique volume identifier is presented to the mount manager by the operating system. The mount manager stores the unique volume identifier and the associated redirected name in a persistent mount manager data structure. The mount manager establishes a symbolic link between the persistent redirected name and a non-persistent device name used by the operating system. During the boot process, the mount manager uses the data structure entries identified by the unique volume identifiers of the arriving logical volumes to reconstruct the symbolic links so that references to the redirected name will resolve to the correct non-persistent device name.

Logical volume mount manager

A partition manager enables the dynamic creation, reconfiguration, and deletion of logical volumes as non-removable storage devices are connected, reconfigured, or disconnected in a computer system by assigning partitions on a connected device to volume managers which create the logical volumes, and by removing the assignment when the device is disconnected or reconfigured. The partition manager receives notification from the operating system of the arrival of new volume managers in a system. When new partitions are created on a non-removable storage device in the system by a device driver, the partition manager intercepts the partitions before they can be registered with the operating system. The partition manager queries each volume manager, in order of their arrival in the system, as to whether the volume manager handles a particular new partition and assigns control of the partition to the appropriate volume manager. The partition manager associates the partition with the appropriate volume manager in an in-memory partition manager database. The partition manager also removes a partition from the control of the associated volume manager and disassociates the partition from the volume manager when the partition is inaccessible.

Growing community of inventors

Bellevue, WA, United States of America

Peter W Wieland