Performing secure data integrity checks at a parallel processor of a display system

Abstract

A display system (100) increases the number of regions of interest supported and enables dynamic background images (205) by offloading region of interest computation and data integrity checks from a display controller (112) of the display system to a parallel processor (104). The parallel processor computes a configurable number of regions of interest for a frame and performs error checking on each of the regions of interest before sending the frame to the display controller.

Description

Background Technology

[0001] The processing system executing the display application generates images for display. In some instances, one or more portions of the image have a relatively high level of criticality. For example, in a vehicle such as a car, the processing system may generate an image for display to the driver, where some portions of the image have relatively low importance (e.g., a portion showing the outside temperature or a portion showing media played by the car), and other portions of the image have relatively high importance (e.g., a portion showing a warning message about overheating engine). Such high-importance or safety-critical portions of the image are referred to herein as regions of interest (ROIs) and are used to display warning or “alert” icons that may affect the safety of the driver or passengers. However, errors in image generation can cause more critical portions of the image to be improperly generated or displayed. Summary of the Invention

[0002] A display system increases the number of supported regions of interest (ROIs) and enables dynamic background images by offloading ROI calculation and data integrity checks from the display controller of the display system to a parallel processor. In a specific implementation, one method includes: calculating a configurable number of ROIs for a frame at a parallel processor of the display system; performing error checking on each ROI at the parallel processor; and sending the frame to the display controller of the display system for display.

[0003] In some implementations, the method further includes overlaying the region of interest onto a dynamic background. Error checking may include performing a first data integrity check on each region of interest at the shader engine of the parallel processor. Performing the first data integrity check may include calculating a first cyclic redundancy check (CRC) value for each region of interest; and comparing the first CRC value with a reference value at an external component of the display system.

[0004] In some embodiments, the method further includes: calculating a second CRC value for each region of interest within the region of interest; and comparing the second CRC value with the first CRC value, wherein comparing the first CRC value with the reference value is in response to a match between the second CRC value and the first CRC value. The method may also include: transmitting the frame from the display controller to the display via a serializer / deserializer. In some embodiments, the method further includes: calculating a Cyclic Redundancy Check (CRC) value for each region of interest at the serializer / deserializer; and transmitting the CRC value to an external component of the display system for comparison with the reference value.

[0005] In another embodiment, a processing system includes a parallel processor configured to: calculate a configurable number of regions of interest (ROIs) for a frame; and perform error checking on each ROI. The processing system also includes a display controller for receiving the frame from the parallel processor and sending the frame to a display.

[0006] The parallel processor can also be configured to overlay the region of interest onto a dynamic background. In some implementations, the parallel processor is further configured to perform a first data integrity check at the shader engine for each region of interest. The parallel processor can perform the first data integrity check by calculating a first cyclic redundancy check (CRC) value for each region of interest and transmitting the first CRC value to an external component of the processing system for comparison with a reference value.

[0007] In some specific implementations, the parallel processor is also configured to: calculate a second CRC value for each region of interest within the region of interest; and compare the second CRC value with the first CRC value, wherein transmitting the first CRC value to the external component is in response to the second CRC value matching the first CRC value.

[0008] The processing system may also include a serializer / deserializer configured to receive the frame from the display controller and transmit the frame to the display. In some embodiments, the serializer / deserializer is further configured to: calculate a Cyclic Redundancy Check (CRC) value for each region of interest within the region of interest; and transmit the CRC value to an external component of the processing system for comparison with a reference value.

[0009] In another embodiment, a display system includes a parallel processor configured to: calculate a configurable number of regions of interest (ROIs) for a frame; and, at a shader engine, perform a first data integrity check on each ROI using a configurable algorithm. The parallel processor may also be configured to: overlay the ROIs onto a dynamic background. In some embodiments, the parallel processor performs the first data integrity check by: calculating a first cyclic redundancy check (CRC) value for each ROI at the shader engine; and transmitting the first CRC value to an external component of the display system for comparison with a reference value.

[0010] The parallel processor can also be configured to: calculate a second CRC value for each region of interest in the shader engine; and compare the first CRC value with the second CRC value, wherein the first CRC value is transmitted to the external component in response to a match between the first CRC value and the second CRC value.

[0011] In some implementations, the display system further includes: a display controller configured to receive the frame from the parallel processor; and a serializer / deserializer configured to receive the frame from the display controller and transmit the frame to a display. The serializer / deserializer may also be configured to: calculate a Cyclic Redundancy Check (CRC) value for each region of interest within the region of interest; and transmit the CRC value to an external component of the display system for comparison with a reference value. Attached Figure Description

[0012] This disclosure can be better understood by referring to the accompanying drawings, and its many features and advantages will be apparent to those skilled in the art. The same reference numerals are used in different drawings to denote similar or identical items.

[0013] Figure 1 It is a block diagram of a display system based on some implementation schemes, in which data integrity checks of the region of interest are processed at a parallel processor.

[0014] Figure 2 This is an example of a display image with multiple regions of interest, based on some implementation schemes.

[0015] Figure 3 This is a block diagram illustrating how, according to some implementation schemes, the availability of the display controller pipeline can be improved by offloading the functionality of the region of interest to a parallel processor.

[0016] Figure 4 This is a block diagram illustrating data integrity checks on a region of interest at a parallel processor, according to some implementation schemes.

[0017] Figure 5 This is a block diagram illustrating redundant data integrity checks performed at a parallel processor according to some implementation schemes.

[0018] Figure 6 This is a flowchart illustrating a method for checking the integrity of safety-critical data at a parallel processor of a display system, according to some implementation schemes. Detailed Implementation

[0019] Regions of Interest (ROIs) are parts of an image that are of relatively high importance, such as safety-critical warning indicators (e.g., tire pressure, brake light activation, collision warning, etc.). Typically, the number of ROIs that can be displayed on a display device (also referred to herein as a monitor) is limited by fixed-function hardware in the display pipeline of the display controller driving the display device, and the number of display devices that can receive image data from the display controller is limited by the number of display pipelines of the display controller driving the display device. Furthermore, the display controller is typically responsible for ensuring the data integrity of ROIs by, for example, calculating a Cyclic Redundancy Check (CRC) and comparing that CRC with a reference CRC, or performing checksums, hashes, or other data integrity checks on each ROI.

[0020] Display controllers typically include fixed-function hardware to perform data integrity checks. This means that increasing the number of Areas of Interest (ROIs) requires a corresponding increase in the amount of fixed-function hardware included in the display controller, thus increasing the area and complexity of the display controller for each additional supported ROI. Furthermore, implementing data integrity checks in fixed-function hardware limits the flexibility to change the data integrity check algorithm, as any changes would require hardware updates.

[0021] Furthermore, the display background image is typically rendered separately from the ROI and then composited (blended) with the ROI at the display controller. If safety-critical information at the ROI is overlaid on a dynamic background (such as a map that changes as vehicles in which the display system is installed move through the environment), data integrity checks on the composite image may result in incorrect results.

[0022] Figures 1 to 6This paper illustrates a technique for increasing the number of supported regions of interest (ROIs) and implementing dynamic background images by offloading ROI calculation and data integrity checks from the display controller of a display system to a parallel processor. In some implementations, the parallel processor calculates a configurable number of ROIs for a frame and performs error checks on each of these ROIs before sending the frame to the display controller. The display controller receives the frame from the parallel processor and sends it to the display device for display. In some implementations, the parallel processor overlays the ROIs onto a dynamic background to generate a hybrid frame that includes both the dynamic background and the ROIs. In some implementations, the parallel processor performs a first cyclic redundancy check (CRC) on each of these ROIs at a first shader engine and a second CRC on each of these ROIs at a second shader engine to redundantly check the integrity of safety-critical data at the ROIs. In some implementations, the parallel processor performs the CRC by calculating a CRC value for each of these ROIs and transmitting that CRC value to an external component of the display system for comparison with a reference value. To further enhance the robustness of safety-critical data integrity checks, in some cases, the display system includes a serializer / deserializer (SERDES) that receives frames from the display controller and sends them to the display, which is configured to perform a third CRC for each of these ROIs.

[0023] Implementing ROI calculation and data integrity checks at a parallel processor increases the number of ROIs supported by the display system, increases the number of display pipelines available to drive the display, allows for simplified updates to the data integrity check algorithm, and improves the robustness of data integrity checks by increasing redundancy both within the parallel processor and across components of the display system. Furthermore, offloading ROI calculation and data integrity checks from the fixed-function hardware of the display controller simplifies the display controller itself, thereby reducing cost, die area, and complexity.

[0024] Figure 1A block diagram of a display system 100 according to some specific embodiments is illustrated, wherein region-of-interest data integrity checks are offloaded from the display controller to a parallel processor. In at least some embodiments, the display system 100 includes at least one or more processing devices (such as a host processor 102 and a parallel processor 104), an architecture 106, a memory 108, an input / output (I / O) interface 110, a display controller 112, an audio processing device 114, a power controller 116, etc. In at least some embodiments, the display system 100 is any type of computing system or device, such as a computer, a laptop computer, a mobile device, a server, a vehicle human-machine interface, or various other types of computing systems or devices. It should be noted that the number of components in the display system 100 may vary. It should also be noted that, in some embodiments, the display system 100 includes... Figure 1 Other components not shown, and in at least some specific embodiments, the structure of system 100 is shown to be similar to... Figure 1 The structures shown are different.

[0025] Architecture 106 represents any communication interconnect conforming to any type of protocol among various types of protocols used for communication between the components of display system 100. Architecture 106 provides data paths, switches, routers, and other logic connecting host processor 102, parallel processor 104, memory 108, input / output (I / O) interface 110, display controller 112, audio processing device 114, power controller 116, and other devices to each other. Architecture 106 handles request, response, and data traffic, as well as probe traffic to facilitate consistency. Architecture 106 also handles interrupt request routing and access path configuration to the various components of display system 100. Additionally, architecture 106 handles configuration request, response, and configuration data traffic. In at least some embodiments, architecture 106 is bus-based, including shared bus configurations, crossbar configurations, and hierarchical buses with bridges. In other embodiments, architecture 106 is packet-based and is a hierarchical structure with bridges, crossbars, point-to-point, or other interconnects. From the perspective of architecture 106, other components of display system 100 are referred to as "clients." Architecture 106 is configured to handle requests generated by various clients and pass these requests to other clients.

[0026] Memory 108 includes system memory or another storage component implemented using a non-transitory computer-readable medium, such as dynamic random access memory (DRAM), static random access memory (SRAM), NAND flash memory, NOR flash memory, ferroelectric random access memory (FeRAM), or other memory. I / O interface 110 represents any number and type of I / O interface (e.g., Peripheral Component Interconnect (PCI) bus, PCI-Extended (PCI-X), PCIE (PCI High Speed) bus, Gigabit Ethernet (GBE) bus, Universal Serial Bus (USB)). Various types of peripheral devices are coupled to I / O interface 110. Such peripheral devices include (but are not limited to) monitors, keyboards, mice, printers, scanners, joysticks or other types of game controllers, media recording devices, external storage devices, network interface cards, etc.

[0027] Audio processing device 114 (such as an audio controller) generates audio signals that can be output by audio processing device 114 or another component of display system 100. Power controller 116 (such as a system management unit (SMU) or another type of power controller) includes hardware and firmware for managing and accessing system configuration / status registers and memory for display system 100, generating clock signals, controlling power rail voltages, etc. Power controller 116 also controls the power supplied to the various components and sub-components of display system 100, such as the cores of host processor 102, parallel processor 104, I / O interface 110, display controller 112, etc.

[0028] In at least some embodiments, the host processor 102 is a processor such as a central processing unit (CPU) and supports the execution of instructions for graphics and other types of workloads. For example, the host processor 102 executes instructions (such as program code 118) stored in memory 108 and stores information (such as the results of the executed instructions) in memory 108. In another example, the host processor 102 prepares one or more operations and distributes the one or more operations to a parallel processor 104 (or other computing resources), and then retrieves the results of the one or more operations from the parallel processor 104. The host processor 102 is also capable of initiating graphics processing by issuing a drawing call. In at least some embodiments, the host processor 102 includes multiple processing elements that execute instructions concurrently or in parallel (for clarity, ...). Figure 1 (Not shown in the image). The processing element is referred to as a processor core, computing unit, or other terms.

[0029] In at least some embodiments, the parallel processor 104 is a processor such as a vector processor, graphics processing unit (GPU), general-purpose GPU (GPGPU), nonscalar processor, highly parallel processor, artificial intelligence (AI) processor, inference engine, machine learning processor, another multi-threaded processing unit, digital signal processor (DSP), field-programmable gate array (FPGA), application-specific integrated circuit (ASIC), etc. In at least some embodiments, the parallel processor 104 is configured as a multi-chip module (e.g., a semiconductor die package) comprising two or more basic integrated circuit (IC) dies communicatively coupled to a bridge chip or other coupling circuitry or connector, such that the parallel processor is available (e.g., addressable) like a single semiconductor integrated circuit. As used herein, the terms "die" and "chip" are used interchangeably. Those skilled in the art will recognize that conventional (e.g., non-multi-chip) semiconductor integrated circuits are manufactured as wafers, or as dies (e.g., single-chip ICs) formed in a wafer and later (e.g., separated from the wafer when it is diced); typically, multiple ICs are manufactured simultaneously in a wafer. ICs and possible discrete circuits, as well as other possible components (such as non-semiconductor packaging substrates, including printed circuit boards, interposers, and other possible components), are assembled in a multi-die parallel processor.

[0030] In at least some embodiments, the parallel processor 104 is, for example, an accelerated processor (AP) combining a general-purpose CPU and a GPU. The AP receives both computation commands and graphics rendering commands from the host processor 102 or another processor. The AP comprises any collaborative set of hardware, software, or combinations thereof, which, relative to resources such as a conventional CPU, a conventional GPU, or combinations thereof, performs functions and computations associated with accelerated graphics processing tasks, data-parallel tasks, and nested data-parallel tasks in an accelerated manner. In at least some embodiments, the AP and the host processor 102 are formed and combined on a single silicon die or package to provide a unified programming and execution environment. In other embodiments, the AP and the host processor 102 are formed separately and mounted on the same or different substrates.

[0031] Parallel processor 104 includes one or more processing elements, such as an array of computing units that execute instructions simultaneously or in parallel (for clarity, Figure 1(Not shown). The shader engine (not shown) of the parallel processor 104 is implemented using shared hardware resources (such as compute units) of the parallel processor 104. In some implementations, the shader engine is used to implement shaders, such as geometry shaders, pixel shaders, etc. Some implementations of the parallel processor 104 are used for general-purpose computing. The parallel processor 104 executes instructions stored in memory 108 and stores information (such as the results of the executed instructions) in memory 108. For example, memory 108 stores a copy of the instructions representing the program code of application 120, which includes a synthesizer (not shown) to be executed by the parallel processor 104. The parallel processor 104 also includes a timing base / generator 122.

[0032] In addition, the parallel processor 104 renders images and generates frame streams for presentation by one or more display devices 124 (e.g., display devices 124-1 and 124-2), which may include, for example, screens, monitors, televisions, etc. For example, the parallel processor 104 renders objects to generate pixel values ​​provided by the display controller 112 to one or more display devices 124, which use these pixel values ​​to display an image representing the rendered object. In a specific implementation where multiple display devices 124 are coupled to the display system 100, the parallel processor 104 generates the same image to be presented on each display device 124 or generates different images to be presented on two or more of the display devices 124.

[0033] Display controller 112 reads pixel values ​​from an output buffer / memory and uses these values ​​to generate one or more signals for displaying (or presenting) an image on display device 124. Display controller 112 provides video signals representing frames via a physical interface coupled to display device 124, such as a High Definition Multimedia Interface (HDMI) or DisplayPort interface. Display controller 112 includes one or more timing bases 126 that generate control signals, synchronization signals, clock signals (independently or in combination with other circuitry or devices), combinations thereof, etc., required to interface with display device 124. In at least some embodiments, one or more timing bases 126 are synchronized during normal operation to, for example, a parallel processor timing base 122 (or another timing base). Some embodiments of timing base 126 are implemented in timing controller (TCON) chip 128 as, for example, an ASIC or other circuitry that also performs timing and synchronization operations for display device 124. Although display controller 112 in Figure 1The display controller 112 is illustrated as separate from other components of the display system 100, but in other examples, the display controller 112 is part of another component such as the parallel processor 104, the I / O interface 110, etc.

[0034] In some instances, visual content within a frame output by a parallel processor or another processor may fail to display correctly on the display device. The visual content, or a portion thereof, may be corrupted, misrepresented, omitted, etc. From a functional safety perspective, software (including applications and operating systems) running on host processor 102 is generally considered untrusted. Because this software is involved in the composition of content and the distribution of content to display device 124, it is difficult to prevent the software from potentially interfering with the output of the intended visual content of interest. Such interference may be caused by a combination of malware or unintentional software vulnerabilities. Consider an example where display system 100 is implemented within a vehicle such as a car or airplane. In this example, visual content such as an engine malfunction indicator light is to be presented on one of the display devices 124 of the vehicle. However, due to malware executing on host processor 102, the engine malfunction indicator light is omitted or presented in a corrupted form from display device 124. In another example, display system 100 is a gaming system, and the visual content to be presented on display device 124 is a minimap within a video game. However, due to malware or software vulnerabilities executed on the host processor 102, the minimap may not display or may display incorrect information in video games.

[0035] To facilitate data integrity checks for a configurable number of Regions of Interest (ROIs), data integrity checks for ROIs overlaid on a dynamic background, and the use of configurable data integrity check algorithms, parallel processor 104 is configured to perform data integrity check 132 to verify that visual content is rendered as expected on display device 124. As described in more detail below, data integrity check 132 calculates derived values ​​(e.g., cyclic redundancy check sums) representing pixel data regions (e.g., defining visual COIs) corresponding to a region of interest (ROI) specified by a compositor implemented in the program code of application 120 when a frame is scanned and output to the display interface. Data integrity check 132 transmits the ROI coordinates and the calculated derived values ​​to secure operating system (OS) 130, for example, on a per-frame basis or according to another timing interval. In at least some specific implementations, data integrity check 132 uses an internal integrated circuit (I2C) communication protocol or another communication protocol to send the ROI coordinates and the calculated derived values ​​to secure OS 130.

[0036] In some implementations, the secure OS 130 is a real-time operating system that ensures the precise execution of time-dependent tasks. For example, a real-time operating system typically includes a clock that starts and stops tasks at fixed intervals. The secure OS 130 can implement interrupts that are set to start and stop tasks. Tasks typically include a specified execution rate and a specified maximum duration. In some implementations, the secure OS 130 starts a task at the specified rate and expects the task to complete within the specified maximum duration, allowing new tasks to be started. In some implementations, the secure OS 130 receives ROI coordinates and calculated derived values ​​from the parallel processor 104 and uses this information to determine, based on signals received from the display controller 112, whether the visual COI will be correctly rendered on one or more display devices in the display device 124 (e.g., the visual content will be rendered without modification, corruption, or misrepresentation). In other words, the secure OS 130 determines whether a designated area of ​​the display device 124 will display the expected pixel content (e.g., the visual COI). For example, in at least some implementations, the security OS 130 compares the received derived values ​​with reference values ​​(i.e., the expected derived values ​​of the ROI coordinates received from the parallel processor 104). If the derived values ​​and reference values ​​match, the security OS 130 determines that the visual COI will be displayed correctly. However, in some implementations, if the derived values ​​and reference values ​​do not match, the security OS 130 determines that the visual COI will be displayed incorrectly and generates a fault or error notification to initiate a restart process or restart the display system 100.

[0037] Figure 2 This is an example of a display image 200 having multiple regions of interest 210 according to some embodiments. In the illustrated example, the display image 200 includes a dynamic background 205 indicating the vehicle's speed, odometer reading, playing entertainment media, and one or more warning indicators at the regions of interest 210. Examples of warning indicators are engine malfunction indicators, tire pressure warning indicators, and anti-lock braking system (ABS) indicators. Because warning indicators involve safety-critical information that may affect driver behavior, their accuracy is rigorously checked to ensure timely and appropriate warnings are displayed.

[0038] Figure 3 Two block diagrams 300 and 330, according to some embodiments, are shown, illustrating how to improve the availability of the display controller pipeline by offloading the region of interest functionality to a parallel processor. The display controller 112 includes N display pipelines, which in... Figure 3The example is illustrated with four display pipelines 306, 308, 310, and 312. Each display pipeline includes, for example, screen data transfer logic and a buffer (not shown). The screen data transfer logic transfers data from the buffer to the associated display 324. The buffer stores pixel data for the screen data transfer logic to send to the display 324. Each display pipeline 306, 308, 310, and 312 is configured to send pixel data to such display 324 when different displays 324 are connected to the display controller 112. In one example, the operating system is configured to distribute the same or different image frames to multiple display devices 324. Each display pipeline 306, 308, 310, and 312 provides pixel data for the portion of the image frame applicable to that display 324. In this operating mode, the display pipelines 306, 308, 310, and 312 operate concurrently, with each display pipeline sending data to the associated display 324 during the appropriate display cycle.

[0039] Block diagram 300 illustrates a portion of a conventional display system, wherein a display controller 112 receives a background image 302 of a frame at a first pipeline 306 and receives one or more Regions of Interest (ROIs) 304 to be displayed together with the first frame at a second pipeline 308. The display controller 112 includes a mixing circuit 320 that implements fixed-function hardware to combine one or more ROIs 304 with the background image 302 to form a mixed image 322. However, because the background image 302 and the one or more ROIs 304 are each sent along separate display pipelines 306, 308 of the display controller 112, two of these display pipelines are used for a single merged image frame, reducing the maximum number of display devices that the display controller 112 can drive to N-1.

[0040] Block diagram 330 illustrates a portion of a display system in which the merging function of the display controller's mixing circuit 320 is offloaded to a parallel processor 104, such that the output of the parallel processor 104 is a mixed image 322. The mixed image 322 is input to the display controller 112 at a single display pipeline 306, allowing the remaining display pipelines 308, 310, and 312 to be used to drive additional (up to N) display devices. Therefore, by offloading the merging function from the display controller 112 to the parallel processor 104, the display system increases the number of displays that can be driven by the display controller 112 and reduces the amount of fixed-function hardware in the display controller 112.

[0041] Figure 4This is a block diagram of a portion 400 of a display system according to some embodiments, illustrating redundant data integrity checks for regions of interest at a parallel processor 104, a serializer / deserializer (SERDES) 412, and a display 424. In some specific embodiments, the parallel processor 104, display controller 112, and secure OS 130 are included in a system-on-a-chip (SOC) 430, while SERDES 412 and display device 424 are external components of the SOC 430. In the illustrated example, application 120 executing at display system 100 includes a compositor 420 that determines, on a frame-by-frame basis, the number of ROIs 402 (if any) to be included in a frame, and an algorithm 404 to be used to check the data integrity of frames and any ROIs 402.

[0042] Compared to the display controller 112, which conventionally uses fixed-function hardware to calculate CRC for a fixed number of ROIs (limited by the number of display pipelines in the display controller 112) using a fixed algorithm, the parallel processor 104 is capable of calculating CRC for a larger (configurable) number of ROIs using a programmable algorithm without additional hardware. Furthermore, by offloading data integrity checks for ROIs from the display controller 112 to the parallel processor 104, the display controller 112 can omit the fixed-function hardware originally used for data integrity checks.

[0043] The programmability and parallelism of the parallel processor 104 enable it to perform data integrity checks 132 on a configurable number of ROIs 402 indicated by the compositor 420 for each frame using an algorithm 404 specified by the compositor 420 for the frame. For example, if the compositor 420 does not indicate any security warnings for the frame, the parallel processor 104 does not compute any data integrity checks for that frame. However, if, for example, the frame contains multiple security-critical pixel regions, the compositor 420 may indicate up to M ROIs 402 for the frame. The parallel processor 104 uses the algorithm 404 indicated by the compositor 420 to perform data integrity checks 132 on each of the indicated ROIs 402. In the illustrated example, the parallel processor 104 computes a CRC 406 for each ROI 402 of the frame and transmits the computed CRC 406 to the security OS 130 for comparison with a reference value for each ROI 402. In other specific implementations, the parallel processor 104 transmits the CRC 406 calculated for each ROI 402 of the frame via the I2C communication protocol to a secure OS (not shown) running in an external microcontroller (not shown) for comparison with a reference value for each ROI 402.

[0044] The parallel processor 104 also transmits a blended image 322, including the ROI 402 and a background image, to the display controller 112. The display controller 112 provides the blended image 322 to the SERDES 412 for serialization and deserialization before input to the display device 424. In some implementations, the integrity of the blended image 322 is redundantly checked by components outside the SOC 430 to further ensure that the safety-critical ROI is displayed correctly. For this purpose, the SERDES 412 also calculates a CRC 408 for the blended image 322. The SERDES 412 sends the calculated CRC 408 to the security OS 130 for comparison with a reference value for the blended image 322 as an additional data integrity check.

[0045] In some implementations, to ensure that the blended image 322 is not corrupted at the display device 424, the display device 424 performs additional data integrity checks on the blended image 322. For example, in some implementations, the display device 424 calculates a CRC 410 for the blended image 322 and sends the calculated CRC 410 to the security OS 130 for comparison with a reference value for the blended image 322. If the calculated CRCs 406, 408, and 410 match the corresponding reference values, the security OS 130 determines that the ROI 402 will be displayed correctly. However, in some implementations, if any of the calculated CRCs 406, 408, and 410 do not match the corresponding reference value, the security OS 130 determines that the ROI 402 will not be displayed correctly and generates a fault or error notification to initiate, for example, a restart process or a restart of the display system 100.

[0046] Figure 5This is a block diagram illustrating redundant data integrity checks 500 performed within a parallel processor 104 according to some implementation schemes. To further improve the reliability of the data integrity checks 132 performed at the parallel processor 104, in some specific implementations, the parallel processor 104 redundantly calculates the CRC for each ROI. In the illustrated example, a first input such as an ROI (exemplified as ROI-1 510) and a second input such as ROI-2 512 are fed into the shader engine of the parallel processor for a first instance (shader-1 502), which calculates a first CRC (calculated CRC-1 520) and generates a second thread, which is fed into the shader engine for a second instance (shader-2 504) to redundantly calculate a second calculated CRC-2 522. The calculated CRC-1 520 and the calculated CRC-2 522 are compared at comparator 530 to determine if the two outputs match. If the calculated CRC-1 520 and the calculated CRC-2 522 match, the calculated CRC is determined to be reliable. In some implementations, the parallel processor 104 only transmits the calculated CRC to the secure OS 130 for comparison with a reference value for each ROI if the calculated CRC is determined to be reliable (i.e., only if the calculated CRCs match). If the calculated CRC-1 520 and the calculated CRC-2 522 do not match, the calculated CRC is determined to be unreliable. In some implementations, the comparator 530 is implemented in hardware, software, or a combination thereof. In the illustrated example, the comparator 530 is incorporated into the parallel processor 104, but in other implementations, the comparator 530 is included in another component of the display system 100 outside the parallel processor 104.

[0047] Figure 6 This is a flowchart illustrating a method 600 for checking the integrity of safety-critical data at a parallel processor of a display system, according to some implementation schemes. For descriptive purposes, relative to... Figure 1 The method 600 is described using an example implementation at display system 100, but it should be understood that in other implementations, method 600 is implemented at processing systems with different configurations. Furthermore, method 600 is not limited to... Figure 6 The operation sequence shown is because at least some operations can be executed in parallel or in different sequences. Furthermore, in at least some specific implementations, method 600 may include... Figure 6 The operations shown are different from one or more operations.

[0048] At block 602, compositor 420 determines whether the current frame requires ROI 402. In some implementations, compositor 420 receives information from one or more sensors indicating whether safety-critical information should be conveyed to the user via one or more ROIs 402. If at block 602, compositor 420 determines that the current frame does not require any ROI 402, the method flow continues to block 604. At block 604, data integrity checks for ROIs are not enabled at parallel processor 104. If at block 602, compositor 420 determines that one or more ROIs 402 should be included in the current frame, the method flow continues to block 606.

[0049] At block 606, compositor 420 determines the number of ROIs 402 to be included in the current frame, and an algorithm 404 applied to check the integrity of the data associated with each ROI 402. Compositor 420 transmits a configurable number of ROIs 402 and algorithm 404 to parallel processor 104. At block 608, parallel processor 104 uses the indicated algorithm 404 to perform a data integrity check 132 on each ROI 402 indicated by compositor 420. For example, in some implementations, parallel processor 104 uses algorithm 404 to calculate a CRC 406 for each ROI 402. Furthermore, parallel processor 104 generates a blended image 322 by merging one or more ROIs 402 with a background image 302. Parallel processor 104 provides the CRC 406 to security OS 130 and the blended image 322 to display controller 112.

[0050] At block 610, the security OS 130 compares the CRC 406 calculated for each ROI 402 with a reference value and determines whether they match. If, at block 610, the security OS 130 determines that the CRC 406 calculated for one or more ROIs 402 does not match the reference value, the process flow continues to block 612. At block 612, in some implementations, the security OS 130 signals the parallel processor 104 to indicate a fault or error and initiates a restart process or restarts the display system 100. In other implementations, the security OS 130 signals the parallel processor 104 to enter a safe state.

[0051] If at block 610, the security OS 130 determines that the CRC 406 calculated for each ROI 402 matches the corresponding reference value for ROI 402, the process continues to block 614. At block 614, after the display controller 112 has provided the blended image 322 to SERDES 412, SERDES 412 performs a data integrity check on the blended image 322. For example, in some implementations, SERDES 412 calculates a CRC 408 for the blended image 322 and provides the calculated CRC 408 to the security OS 130.

[0052] At box 616, the security OS 130 compares the calculated CRC 408 with a reference value for the mixed image 322 and determines whether these values ​​match. If, at box 616, the security OS 130 determines that the calculated CRC 408 does not match the reference value for the mixed image 322, the method flow continues back to box 612. If, at box 616, the security OS 130 determines that the calculated CRC 408 matches the reference value for the mixed image 322, the method flow continues to box 618.

[0053] At box 618, after SERDES 412 provides the mixed image 322 to the display device 424, the display device 424 calculates a CRC 410 for the mixed image 322 and provides the calculated CRC 410 to the security OS 130 for additional data integrity checks on the mixed image 322. At box 620, the security OS 130 compares the calculated CRC 410 with a reference value for the mixed image 322 and determines whether these values ​​match. If at box 620, the security OS 130 determines that the calculated CRC 410 does not match the reference value for the mixed image 322, the method flow continues back to box 612. If the security OS 130 determines at box 620 that the calculated CRC 410 matches the reference value for the mixed image 322, the method flow continues to box 622. At frame 622, after the individual ROIs 402 and the blended image 322 have passed redundancy data integrity checks at multiple points in the graphics pipeline, the display device displays the blended image 322.

[0054] In some implementations, the apparatus and techniques described above are used in systems including one or more integrated circuit (IC) devices (also referred to as integrated circuit packages or microchips) (such as those described in the above references). Figures 1 to 6Implemented in the described display system. Electronic design automation (EDA) and computer-aided design (CAD) software tools can be used in the design and manufacture of these IC devices. These design tools are typically represented as one or more software programs. One or more software programs include code executable by a computer system to manipulate the computer system to operate on code representing one or more IC devices to perform at least a portion of a process for designing or adapting a manufacturing system to manufacture the circuit. The code may include instructions, data, or a combination of instructions and data. Software instructions representing design tools or manufacturing tools are typically stored in a computer-readable storage medium accessible to the computing system. Similarly, code representing one or more stages of the design or manufacture of the IC device may be stored in and accessed from the same computer-readable storage medium or different computer-readable storage media.

[0055] Computer-readable storage media may include any non-transitory storage medium or a combination of non-transitory storage media that can be accessed by a computer system during use to provide instructions and / or data to the computer system. Such storage media may include, but are not limited to, optical media (e.g., optical discs (CDs), digital versatile optical discs (DVDs), Blu-ray discs), magnetic media (e.g., floppy disks, magnetic tapes, or magnetic hard disks), volatile memory (e.g., random access memory (RAM) or cache), non-volatile memory (e.g., read-only memory (ROM) or flash memory), or microelectromechanical systems (MEMS) based storage media. Computer-readable storage media may be embedded in a computing system (e.g., system RAM or ROM), fixedly attached to a computing system (e.g., a magnetic hard disk drive), removably attached to a computing system (e.g., an optical disc or a USB-based flash memory), or coupled to a computer system via a wired or wireless network (e.g., a network-accessible storage device (NAS)).

[0056] One or more of the aforementioned elements are circuits designed and configured to perform the corresponding operations described above. In at least some embodiments, such circuitry is any one or a combination of the following: hard-coded circuitry (e.g., a corresponding portion of an Application-Specific Integrated Circuit (ASIC) or a set of logic gates, memory elements, and other components selected and arranged to perform the operations), programmable circuitry (e.g., a corresponding portion of a Field-Programmable Gate Array (FPGA) or Programmable Logic Device (PLD), or one or more processors executing software instructions that cause one or more processors to perform the actions. In some embodiments, the circuitry of a particular element is selected, arranged, and configured by one or more computer-implemented design tools. For example, in some embodiments, the sequence of operations for a particular element is defined in a specified computer language (such as register-transfer language), and the computer-implemented design tools select, configure, and arrange the circuitry based on the defined sequence of operations.

[0057] Within this disclosure, in some instances, different entities (which are referred to differently as “components,” “units,” “devices,” “circuits,” etc.) are described or claimed to be “configured” to perform one or more tasks or operations. This way of describing (i.e., an [entity] configured to [perform one or more tasks]) is used herein to refer to a structure (i.e., a physical structure, such as an electronic circuit). More specifically, this way of describing indicates that the physical structure is arranged to perform the one or more tasks during operation. A structure may be referred to as being “configured” to perform a task even if the structure is not currently operating. “Memory device configured to store data” is intended to cover, for example, an integrated circuit having circuitry for storing data during operation, even if the integrated circuit in question is not currently in use (e.g., power is not connected to the integrated circuit). Therefore, an entity described or stated as being “configured” to perform a task refers to a physical structure, such as a device, circuit, memory storing program instructions that can be executed to perform the task, etc. This phrase is not used herein to refer to an intangible structure. Furthermore, the term “configured to” is not intended to mean “configurable as.” For example, an unprogrammed field-programmable gate array will not be considered "configured" to perform a particular function, but it may be "configurable" to perform that function after programming. Additionally, the statement in the appended claims that a structure is "configured" to perform one or more tasks is not expressly intended to be interpreted as having components plus functional elements.

[0058] In some implementations, certain aspects of the above-described techniques may be implemented by one or more processors of a processing system executing the software. The software includes one or more sets of executable instructions stored or otherwise tangibly embodied on a non-transitory computer-readable storage medium. The software may include instructions and certain data that, when executed by one or more processors, manipulate one or more processors to perform one or more aspects of the above-described techniques. The non-transitory computer-readable storage medium may include, for example, disk or optical disc storage devices, solid-state storage devices such as flash memory, cache, random access memory (RAM), or one or more other non-volatile memory devices. The executable instructions stored on the non-transitory computer-readable storage medium may be source code, assembly language code, object code, or other instruction formats that are interpreted or otherwise executed by one or more processors.

[0059] It should be noted that not all activities or elements described above in the general description are essential. A particular activity or part of the apparatus may not be essential, and one or more additional activities may be performed, or elements may be included in addition to those described. Furthermore, the order in which the activities are listed is not necessarily the order in which they are performed. Additionally, these concepts have been described with reference to specific embodiments. However, those skilled in the art will understand that various modifications and changes can be made without departing from the scope of this disclosure as set forth in the following claims. Therefore, the specification and drawings are to be considered illustrative rather than restrictive, and all such modifications are intended to be included within the scope of this disclosure.

[0060] The benefits, other advantages, and solutions to problems have been described above with respect to specific embodiments. However, the benefits, advantages, solutions to problems, and any features that may lead to or make any benefit, advantage, or solution appear or become more significant should not be construed as key, essential, or fundamental features of any or all claims. Furthermore, the specific embodiments disclosed above are merely illustrative, as the disclosed subject matter can be modified and practiced in different but equivalent ways that will be apparent to those skilled in the art who benefit from the teachings herein. No limitation is intended on the details of the constructions or designs shown herein, except as described in the following claims. Therefore, it will be apparent that the specific embodiments disclosed above can be changed or modified, and all such changes are considered to be within the scope of the disclosed subject matter. Therefore, the protection sought herein is as set forth in the following claims.

Claims

1. A method, the method comprising: At the parallel processor of the display system, the configurable number of regions of interest for a frame is calculated; Error checking is performed on each region of interest within the parallel processor. as well as The frame is sent to the display controller of the display system for display.

2. The method according to claim 1, further comprising: The region of interest is overlaid on the dynamic background.

3. The method according to claim 1 or claim 2, wherein the error checking comprises: At the shader engine of the parallel processor, a first data integrity check is performed on each region of interest.

4. The method of claim 3, wherein performing the first data integrity check comprises: Calculate a first Cyclic Redundancy Check (CRC) value for each region of interest within the region of interest; as well as At an external component of the display system, the first CRC value is compared with a reference value.

5. The method according to claim 4, further comprising: Calculate a second CRC value for each region of interest within the region of interest; as well as The second CRC value is compared with the first CRC value, wherein comparing the first CRC value with the reference value is in response to the second CRC value matching the first CRC value.

6. The method according to any one of claims 1 to 5, further comprising: The frame is sent from the display controller to the display via a serializer / deserializer.

7. The method according to claim 6, further comprising: At the serializer / deserializer, a Cyclic Redundancy Check (CRC) value is calculated for each region of interest within the region of interest; as well as The CRC value is transmitted to an external component of the display system for comparison with a reference value.

8. A processing system, the processing system comprising: Parallel processor, the parallel processor being configured to: Calculate the configurable number of regions of interest in a frame; as well as Perform error checking on each region of interest within the stated regions of interest; and A display controller is configured to receive the frame from the parallel processor and send the frame to the display.

9. The processing system of claim 8, wherein the parallel processor is further configured to: The region of interest is overlaid on the dynamic background.

10. The processing system according to claim 8 or claim 9, wherein the parallel processor is further configured to: At the shader engine, a first data integrity check is performed on each region of interest.

11. The processing system of claim 10, wherein the parallel processor performs the first data integrity check by: For each region of interest, a first cyclic redundancy check (CRC) value is calculated; and The first CRC value is transmitted to an external component of the processing system for comparison with a reference value.

12. The processing system of claim 11, wherein the parallel processor is further configured to: Calculate a second CRC value for each region of interest within the region of interest; and The second CRC value is compared with the first CRC value, wherein the first CRC value is transmitted to the external component in response to the second CRC value matching the first CRC value.

13. The processing system according to any one of claims 8 to 12, further comprising: A serializer / deserializer is configured to receive the frame from the display controller and send the frame to the display.

14. The processing system of claim 13, wherein the serializer / deserializer is further configured to: Calculate the Cyclic Redundancy Check (CRC) value for each region of interest; and The CRC value is transmitted to an external component of the processing system for comparison with a reference value.

15. A display system, the display system comprising: Parallel processor, the parallel processor being configured to: Calculate the configurable number of regions of interest in a frame; as well as At the shader engine, a configurable algorithm is used to perform a first data integrity check on each region of interest.

16. The display system of claim 15, wherein the parallel processor is further configured to: The region of interest is overlaid on the dynamic background.

17. The display system of claim 15 or claim 16, wherein the parallel processor performs the first data integrity check by: At the shader engine, a first cyclic redundancy check (CRC) value is calculated for each region of interest; and The first CRC value is transmitted to an external component of the display system for comparison with a reference value.

18. The display system of claim 17, wherein the parallel processor is further configured to: At the shader engine, a second CRC value is calculated for each region of interest; and The first CRC value is compared with the second CRC value, wherein the first CRC value is transmitted to the external component in response to the first CRC value matching the second CRC value.

19. The display system according to any one of claims 15 to 18, the display system further comprising: A display controller, configured to receive the frame from the parallel processor; and A serializer / deserializer is configured to receive the frame from the display controller and send the frame to the display.

20. The display system of claim 19, wherein the serializer / deserializer is further configured to: Calculate the Cyclic Redundancy Check (CRC) value for each region of interest; and The CRC value is transmitted to an external component of the display system for comparison with a reference value.

Images