Sessions to host processes with special requirements

• US 8,539,020 B2
• Filed: 06/14/2010
• Issued: 09/17/2013
• Est. Priority Date: 06/14/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Lotlikar, Mahesh, Sampath, Sriram, Bernardi, Ara, Hagiu, Costin
• Primary Examiner(s): Keehn, Richard G
• Application Number:
  US12/815,073
• Publication Number:
  US 20110307544A1
• Time in Patent Office: 1,191 Days
• Field of Search: 709/203
• US Class Current: 709/203
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

Techniques are disclosed for enabling a system service executing in an isolated session to access system resources (such as a graphics processing unit) that it is isolated from. In an embodiment, the system service creates a “worker” session that is not isolated, and a “worker” process inside that worker session. Then, the system service is able to access the system resource that it is directly isolated from accessing by passing a request to the worker process to access the system resource on the system service'"'"'s behalf. The worker process does so, and passes a result to the system service.

Claims

1. A method for enabling a service executing in an isolated session on a system to access a system resource from which the service is isolated, comprising:

instantiating a worker session by an operating system operating on the system, the worker session being a separate session from the isolated session and the worker session being a separate session from any user session executing on the system, instantiating the worker session including creating the worker session by a service executing in the isolated session by establishing a loopback remote presentation session connection to the system;

instantiating a worker process, the worker process executing in the worker session, the worker process having access to the system resource;

receiving by the service, a first communication indicative of a request from a first process to access the system resource;

sending, by the service, a second communication indicative of a request to the worker process to access the system resource;

in response to receiving, by the worker process, the second communication, accessing the system resource to produce a first result; and

transmitting, by the worker process, the first result to the service.

2. The method of claim 1, wherein sending, by the service, the request to the worker process to access the system resource in performed in response to:

receiving, by the service, an indication of the request from a user process executing in a user session; and

further comprising;

transmitting, by the service, the first result to the user process.

3. The method of claim 2, wherein the user process executes within a virtual

machine, the user process comprises a remote presentation session server process in communication with a client computer via a remote presentation session connection, and the request to the worker process comprises a request to compress an image to be sent via the remote presentation session connection.

4. The method of claim 1, wherein creating the worker session includes:

creating the worker session to be non-interactive.

5. The method of claim 1, wherein creating the worker session includes:

setting permissions of the worker session such that an administrator lacks permissions to logoff the worker session.

6. The method of claim 1, wherein a plurality of system resources comprises the system resource and a second system resource, further comprising:

determining that a second process has been instantiated, the second process configured to request access to a system resource of the plurality of system resources;

determining to process requests from the second process to access a system resource of the plurality of system resources with the second system resource, based on an availability of the plurality of system resources;

instantiating a second worker process, the second worker process executing in the worker session, the second worker process having access to the second system resource;

receiving by the service, a third communication indicative of a request from the second process to access the second system resource;

sending, by the service, a fourth communication indicative of a request to the worker process to access the system resource;

in response to receiving, by the worker process, the second communication, accessing the system resource to produce a second result; and

transmitting, by the worker process, the second result to the service.

7. The method of claim 6, wherein the system resource comprises a first graphics processing unit (GPU) and the second system resource comprises a second graphics processing unit (GPU).

8. The method of claim 1, wherein establishing the loopback remote presentation session connection to the system includes:

creating a listener on a distinct port for the loopback remote presentation session connection; and

deleting the listener upon creating the worker session.

9. The method of claim 1, wherein a remote presentation session connection requires a license, further comprising:

assigning the loopback remote presentation session connection a license from a license pool separate from a second license pool of at least one license from which non-loopback remote presentation session connections receive licenses.

10. A system for enabling a service executing in an isolated session on the system to access a system resource from which the service is isolated, comprising:

a processor; and

a memory communicatively coupled to the processor, the memory bearing computer-executable instructions that, upon execution by the processor, cause at least;

creating a worker session, the worker session being a separate session from the isolated session and the worker session being a separate session from any user session executing on the system, creating the worker session including creating the worker session by a service executing in the isolated session by establishing a loopback remote presentation session connection to the system;

creating a worker process, the worker process executing in the worker session, the worker process having access to the system resource;

sending, by the service, a request to the worker process to access the system resource;

in response to receiving, by the worker process, the request to access the system resource, accessing the system resource to produce a result; and

transmitting, by the worker process, the result to the service.

11. The system of claim 10, wherein creating the worker session includes:

determining that a worker user account to be associated with the worker session does not exist;

creating the worker user account;

generating a random password for the worker user account; and

creating the worker session with the worker user account.

12. The system of claim 11, wherein the memory further bears computer- executable instructions, that when executed on the processor, cause the processor to perform operations comprising:

generating a second password for the worker user account in response to creating the worker session with the worker user account.

13. The system of claim 10, wherein creating the worker session includes:

registering, by a worker session provider, for session notifications;

creating, by the worker session provider, a remote presentation session process, the remote presentation session process creating a loopback remote presentation session with the system; and

upon determining that the worker session has logged onto the system, unregistering, by the worker session provider, from session notifications.

14. The system of claim 10, wherein the memory further bears computer- executable instructions, that when executed on the processor, cause the processor to perform operations comprising:

suppressing a warning that other users are logged on during administrator-initiated shutdown, when there are no sessions executing on the system but the isolated session, the worker session, and a session associated with an administrator.

15. The system of claim 10, wherein the system resource comprises a graphics processing unit (GPU).

16. The system of claim 10, wherein creating the worker session includes:

setting the worker session to a disconnected state.

17. The system of claim 10, wherein no user processes execute within the isolated session.

18. The system of claim 10, wherein creating the worker session includes:

creating the worker session in response to determining that no other worker session exists.

19. A computer-readable memory bearing computer-executable instructions for enabling a service executing in an isolated session on a system to access a system resource from which the service is isolated, that when executed on a computer, cause the computer to perform operations comprising:

creating a worker session, the worker session being a separate session from the isolated session and the worker session being a separate session from any user session executing on the computer or another computer, creating the worker session including creating the worker session by a service executing in the isolated session by establishing a loopback remote presentation session connection to the system;

creating a worker process, the worker process executing in the worker session, the worker process having access to a system resource;

sending, by the service, a request to the worker process to access the system resource;

in response to receiving, by the worker process, the request to access the system resource, accessing the system resource to produce a result; and

transmitting, by the worker process, the result to the service.