Data processing systems
A data processing system includes a host processor that executes an operating system and an accelerator operable to process data under the control of the operating system executing on the host processor. The accelerator can be switched between a normal mode of operation and a protected mode of operation in which the side channel information that can be provided by the accelerator to the host processor is restricted. The data processing system also includes a mechanism for switching the accelerator from its normal mode of operation to the protected mode of operation, and from its protected mode of operation to the normal mode of operation.
1. A data processing system, the data processing system comprising:
a host processor that executes an operating system; and
an accelerator operable to process data under the control of the operating system executing on the host processor; wherein:
the accelerator can be switched between a normal mode of operation and a protected mode of operation in which the accelerator is capable of reducing a size of individual pieces of side channel information related to the processing of the data by the accelerator that can be provided by the accelerator to the host processor to a non-zero reduced size of individual pieces of side channel information,
wherein in the protected mode of operation, the accelerator is capable of restricting the side channel information by reducing the size of individual pieces of side channel information that can be provided by the accelerator to the host processor to a non-zero reduced size of individual pieces of side channel information compared to the size of individual pieces of side channel information that can be provided in the normal mode of operation by the accelerator to the host processor; and
the data processing system further comprises a mechanism for switching the accelerator from its normal mode of operation to the protected mode of operation, and from its protected mode of operation to the normal mode of operation.
2. The system of claim 1 , wherein the accelerator comprises a graphics processing unit.
3. The system of claim 1 , wherein the system comprises one or more registers and the side channel information is written into the one or more registers, and the side channel information that can be provided by the accelerator is restricted by masking the side channel information in the register.
4. The system of claim 1 , wherein the system comprises a memory and the side channel information is stored in the memory, and the side channel information that can be provided by the accelerator is restricted by setting the side channel information to a dummy or default value in the memory.
5. The system of claim 1 , wherein the data processing system comprises one or more communication links between the accelerator and the host processor, wherein in the protected mode of operation the side channel information that can be transferred by the accelerator to the host processor is restricted.
6. The system of claim 1 , wherein the side channel information comprises one or more of: memory management unit fault information, information relating to the status of a task or a group of tasks, information relating to debugging, performance counters, information for communicating between the shader kernel and the host processor, information relating to the completion status of a task or a group of tasks, accelerator fault addresses, cache timing data, an exception, and an interrupt.
7. The system of claim 1 , wherein the restriction on the side channel information is enabled by setting a configuration of a trusted register.
8. The system of claim 1 , wherein the mechanism for switching the accelerator from its normal mode of operation to the protected mode of operation, and from its protected mode of operation to the normal mode of operation comprises one of: using trusted firmware to control the switching; using open firmware in conjunction with trusted host software for the switching; fully through trusted software; or using a trusted hardware implemented mechanism.
9. The system of claim 1 , wherein the data processing system further comprises:
a memory for storing data to be used or processed by or generated by the accelerator, the memory being configurable to have both protected memory regions that are not readable by the operating system when it is operating in a non-secure mode and non-protected memory regions that are readable by the operating system when it is operating in a non-secure mode; wherein:
when the accelerator is in the normal mode of operation the accelerator has read and write access to data that is stored in non-protected memory regions but no or write-only access to any protected memory regions; and
when the accelerator is in the protected mode of operation the accelerator has read and write access to data that is stored in protected memory regions but only has read-only access to any non-protected memory regions.
10. A method of operating a data processing system that comprises:
a host processor that executes an operating system; and
an accelerator operable to process data under the control of the operating system executing on the host processor; wherein:
the accelerator can be switched between a normal mode of operation and a protected mode of operation in which the accelerator is capable of reducing a size of individual pieces of side channel information related to the processing of the data by the accelerator that can be provided by the accelerator to the host processor to a non-zero reduced size of individual pieces of side channel information; and
the method comprising:
when it is desired to use the accelerator to perform processing of protected data:
switching the accelerator to its protected mode of operation;
while the accelerator is operating in its protected mode of operation restricting the side channel information that can be provided by the accelerator to the host processor by reducing the size of individual pieces of side channel information that can be provided by the accelerator to the host processor to a non-zero reduced size of individual pieces of side channel information compared to the size of individual pieces of side channel information that is able to be provided by the accelerator to the host processor in the normal mode of operation; and
when the accelerator has completed its protected processing task, switching the accelerator back to its normal mode of operation.
11. The method of claim 10 , wherein the accelerator comprises a graphics processing unit.
12. The method of claim 10 , wherein the side channel information is written into one or more registers, and the method comprises restricting the side channel information that can be provided by the accelerator by masking the side channel information in the register.
13. The method of claim 10 , wherein the side channel information is stored in a memory, and the method comprises restricting the side channel information that can be provided by the accelerator by setting the side channel information to a dummy or default value in the memory.
14. The method of claim 10 , wherein the data processing system comprises one or more communication links between the accelerator and the host processor, and the method comprises: in the protected mode of operation, restricting the side channel information that can be transferred by the accelerator to the host processor.
15. The method of claim 10 , wherein the side channel information comprises one or more of: memory management unit fault information, information relating to the status of a task or a group of tasks, information relating to debugging, performance counters, information for communicating between the shader kernel and the host processor, information relating to the completion status of a task or a group of tasks, accelerator fault addresses, cache timing data, an exception, and an interrupt.
16. The method of claim 10 , wherein the method further comprises enabling the restriction on the side channel information by setting a configuration of a trusted register.
17. The method of claim 10 wherein the mechanism for switching the accelerator from its normal mode of operation to the protected mode of operation, and from its protected mode of operation to the normal mode of operation comprises one of: using trusted firmware to control the switching; using open firmware in conjunction with trusted host software for the switching; fully through trusted software; or using a trusted hardware implemented mechanism.
18. The method of claim 10 , wherein the data processing system further comprises:
a memory for storing data to be used or processed by or generated by the accelerator, the memory being configurable to have both protected memory regions that are not readable by the operating system when it is operating in a non-secure mode and non-protected memory regions that are readable by the operating system when it is operating in a non-secure mode; and the method further comprises:
the accelerator, whilst it is operating in its protected mode of operation, reading data from and writing data to the protected regions of the memory, and reading data from, but not writing data to, the non-protected regions of the memory.
19. A non-transient computer readable storage medium storing computer software code which when executing on a data processing system performs a method of operating a data processing system that comprises:
a host processor that executes an operating system; and
an accelerator operable to process data under the control of the operating system executing on the host processor; wherein:
the accelerator can be switched between a normal mode of operation and a protected mode of operation in which the accelerator is capable of reducing a size of individual pieces of side channel information related to the processing of the data by the accelerator that can be provided by the accelerator to the host processor to a non-zero reduced size of individual pieces of side channel information; and
the method comprising:
when it is desired to use the accelerator to perform processing of protected data:
switching the accelerator to its protected mode of operation;
while the accelerator is operating in its protected mode of operation restricting the side channel information that can be provided by the accelerator to the host processor by reducing the size of individual pieces of side channel information that can be provided by the accelerator to the host processor to a non-zero reduced size of individual pieces of side channel information compared to the size of individual pieces of side channel information that is able to be provided by the accelerator to the host processor in the normal mode of operation; and
when the accelerator has completed its protected processing task, switching the accelerator back to its normal mode of operation.