Method and apparatus for policy-based direct memory access control
AssigneeMicrosoft Corporation
InventorsTodd L. Carpenter, William J. Westerinen
Life of this patent
Estimating the term…
Abstract
A computer that operates in a metered mode for normal use and a restricted mode uses an input/output memory management unit (I/O MMU) in conjunction with a security policy to determine which peripheral devices are allowed direct memory access during the restricted mode of operation. During restricted mode operation, non-authorized peripheral devices are removed from virtual address page tables or given vectors to non-functioning memory areas.
Claims15
An electronic device supporting direct memory access (DMA) arranged and adapted for use in an unrestricted mode of operation and a restricted mode of operation comprising:
- a processor;
- a memory controller coupled to the processor;
- a main memory coupled to the memory controller;
- an input/output (I/O) controller incorporating a peripheral device direct memory access controller coupled to one of the processor and the memory controller;
- a plurality of peripheral devices each coupled the I/O controller and having direct memory access when operation is in the unrestricted mode;
- and
- a policy manager software executable that evaluates subscription status related to pay-per-use operation operable to hinder functionality of each of the plurality of peripheral devices when operation of the electronic device is in the restricted mode because subscription terms are not met, functionality hindered by limiting each of the peripheral device's direct memory access.
A method of limiting operation of a computer peripheral device comprising:
- determining when the computer is in a limited operation mode;
- setting an invalid page table entry for the computer peripheral device direct memory access (DMA) when the computer is in the limited operation mode;
- receiving an address resolution request for direct memory access from the computer peripheral device;
- determining if the computer peripheral device is not authorized for DMA when in the limited operation mode;
- and
- returning the invalid page table entry responsive to the address resolution request when the computer peripheral device is not authorized for DMA and the computer is in the limited operation mode.
Dependencies are inferred from the claim text.