Hardware enforced content protection for graphics processing units

Patent metadata

Field	Value
Publication number	US-9767320-B2
Application number	US-201514821092-A
Country	US
Kind code	B2
Filing date	Aug 7, 2015
Priority date	Aug 7, 2015
Publication date	Sep 19, 2017
Grant date	Sep 19, 2017

Abstract

This disclosure proposes techniques for graphics processing. In one example, a graphics processing unit (GPU) is configured to access a memory according to one of an unsecure mode and a secure mode. The GPU may include a memory access controller configured to direct memory transactions from at least one hardware unit of the GPU to a secure context bank in a memory controller when the GPU is operating in a secure mode, and configured to direct memory transactions from the at least one hardware unit of the GPU to an unsecure context bank in the memory controller when the GPU is operating in the unsecure mode.

First claim

What is claimed is:

1. An apparatus for graphics processing, the apparatus comprising:
a memory comprising an unsecure portion and a secure portion;
a memory controller comprising a secure context bank and an unsecure context bank, wherein the secure context bank includes read-only page table entries to the unsecure portion of the memory and read/write page table entries to the secure portion of the memory, the unsecure context bank includes read-only page table entries to the unsecure portion of the memory, and the memory controller is configured to issue a page fault when a request to write data into an address contained within the read-only page table entries of the secure context bank is received; and
a graphics processing unit (GPU) configured to access the memory according to one of an unsecure mode and a secure mode, the GPU comprising:
a memory access controller configured to direct memory transactions from at least one hardware unit of the GPU to the secure context bank in the memory controller when the GPU is operating in the secure mode, and configured to direct memory transactions from the at least one hardware unit of the GPU to the unsecure context bank in the memory controller when the GPU is operating in the unsecure mode.

2. The apparatus of claim 1 , wherein the at least one hardware unit of the GPU includes one or more of a vertex fetch decode unit, a high level sequencer, a vertex shader, a pixel shader, and a render backend unit.

3. The apparatus of claim 1 , wherein the GPU further comprises:
a front end command processor configured to read and write data through the unsecure context bank regardless of whether the GPU is operating in the unsecure mode or the secure mode.

4. The apparatus of claim 1 , further comprising:
a central processing unit (CPU) executing a graphics driver, the graphics driver configured to place the GPU in the secure mode or the unsecure mode.

5. The apparatus of claim 4 , wherein the GPU further comprises a command stream register and one or more internal memories, and wherein the graphics driver is configured to send an instruction to the command stream register that causes the GPU to clear and invalidate at least some content from the one or more internal memories when the GPU is transitioned from the secure mode to the unsecure mode.

6. The apparatus of claim 1 , wherein the GPU further comprises a clear register and one or more internal memories, and wherein the GPU is further configured to clear and invalidate at least some content from the one or more internal memories when the GPU is transitioned from the secure mode to the unsecure mode based on an indication in the clear register.

7. The apparatus of claim 1 , wherein the apparatus is a mobile device.

8. A graphics processing unit (GPU), the GPU comprising:
one or more hardware units configured to access a memory according to one of an unsecure mode and a secure mode of the GPU; and
a memory access controller configured to direct memory transactions from at least one of the one or more hardware units of the GPU to a secure context bank in a memory controller when the GPU is operating in the secure mode, wherein the secure context bank includes read-only page table entries to an unsecure portion of the memory and read/write page table entries to a secure portion of the memory, configured to direct memory transactions from the at least one of the one or more hardware units of the GPU to an unsecure context bank in the memory controller when the GPU is operating in the unsecure mode, wherein the unsecure context bank includes read-only page table entries to the unsecure portion of the memory, and configured to receive a page fault from the memory controller when a request to write data into an address contained within the read-only page table entries of the secure context bank is made.

9. The GPU of claim 8 , wherein the at least one of the one or more hardware units of the GPU includes one or more of a vertex fetch decode unit, a high level sequencer, a vertex shader, a pixel shader, and a render backend unit.

10. The GPU of claim 8 , wherein the one or more hardware units includes a front end command processor configured to read and write data through the unsecure context bank regardless of whether the GPU is operating in the unsecure mode or the secure mode.

11. A method for graphics processing, the method comprising:
according to an unsecure mode, with a graphics processing unit (GPU), directing memory transactions from at least one hardware unit of the GPU to an unsecure context bank in a memory controller to access an unsecure portion of a memory, wherein the unsecure context bank includes read-only page table entries to the unsecure portion of the memory;
according to a secure mode, with the GPU, directing memory transactions from the at least one hardware unit of the GPU to a secure context bank in the memory controller to access a secure portion of the memory, wherein the secure context bank includes read-only page table entries to the unsecure portion of the memory and read/write page table entries to the secure portion of the memory; and
issuing a page fault when a request to write data into an address contained within the read-only page table entries of the secure context bank is received.

12. The method of claim 11 , wherein the at least one hardware unit of the GPU includes one or more of a vertex fetch decode unit, a high level sequencer, a vertex shader, a pixel shader, and a render backend unit.

13. The method of claim 11 , further comprising:
accessing the unsecure portion of the memory, with a front end command processor, through the unsecure context bank regardless of whether the GPU is operating in the unsecure mode or the secure mode.

14. The method of claim 11 , further comprising:
placing, with a graphics driver executing on a central processing unit (CPU), the GPU in the secure mode or the unsecure mode.

15. The method of claim 14 , further comprising:
receiving, from the graphics driver, an instruction to a command stream register of the GPU to clear and invalidate one or more internal memories of the GPU; and
clearing and invalidating at least some content from the one or more internal memories of the GPU when the GPU is transitioned from the secure mode to the unsecure mode based on the instruction in the command stream register.

16. The method of claim 11 , further comprising:
receiving, at a clear register of the GPU, an indication to clear and invalidate one or more internal memories of the GPU; and
clearing and invalidating at least some content from the one or more internal memories of the GPU when the GPU is transitioned from the secure mode to the unsecure mode based on an indication in the clear register.

17. An apparatus for graphics processing, the apparatus comprising:
means for directing, according to an unsecure mode, memory transactions from at least one hardware unit of a graphics processing unit (GPU) to an unsecure context bank in a memory controller to access an unsecure portion of a memory, wherein the unsecure context bank includes read-only page table entries to the unsecure portion of the memory;
means for directing, according to a secure mode, memory transactions from the at least one hardware unit of the GPU to a secure context bank in the memory controller to access a secure portion of the memory, wherein the secure context bank includes read-only page table entries to the unsecure portion of the memory and read/write page table entries to the secure portion of the memory; and
means for issuing a page faul

Assignees

• Qualcomm Inc

Inventors

• Sharp Colin Christopher
• Viswanathan Ramesh

Classifications

• G06F2212/1052

  Security improvement · CPC title

• G06F21/74 Primary

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title

• G06T1/20

  Processor architectures; Processor configuration, e.g. pipelining · CPC title

• G06T1/60

  Memory management · CPC title

• G06F12/1458

  by checking the subject access rights · CPC title