Secure GPU Copy Engine Work Submission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In secure computing environments, launching new work on a GPU operating in secure mode is bottlenecked by secure processors, which are not designed for bulk data movement, leading to reduced performance and increased latency due to their limited capacity and the introduction of additional indirection levels.
Innovation Solution
The method involves reading and decrypting encrypted copy tasks from unsecure memory, executing them to copy encrypted secure tasks to secure memory, and scheduling the decrypted tasks for execution, with copy engines handling the data movement instead of secure processors, thus bypassing the secure processor bottleneck and reducing latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure processors are used to copy and decrypt data for work submission in secure mode, then security is maintained, but processing speed and throughput deteriorate due to the secure processors not being designed for bulk data movement
Solution Approach 1:
The patent introduces copy engines as intermediary components that handle bulk data movement and decryption operations between unsecure memory and the secure workspace. These copy engines act as mediators that offload the data transfer burden from secure processors, enabling high-throughput data movement while maintaining security through authenticated encryption/decryption operations performed by the specialized copy engine hardware.
2Reliability
If secure processors handle all data copying and decryption tasks, then security protocols are followed, but latency increases due to the additional indirection levels and limited secure processor capacity
Solution Approach 1:
The patent implements self-service mechanisms where copy engines autonomously perform data copying, decryption, and authentication operations without requiring secure processor intervention for each task. The copy engines maintain their own execution contexts and can independently manage work submission pipelines, reducing the indirection overhead and enabling parallel processing of multiple work submission streams simultaneously.
3Device complexity
If only one or two secure processors are available to serve tens of thousands of channels, then device complexity is limited, but the bottleneck reduces overall system performance when large numbers of compute tasks are submitted
Solution Approach 1:
The patent segments the work submission functionality by separating secure processor responsibilities from bulk data movement tasks. Secure processors are reserved for high-level security management and authentication, while copy engines handle the segmented bulk data transfer operations. This segmentation allows multiple copy engines to operate in parallel, each serving portions of the tens of thousands of channels, thereby scaling system performance without increasing secure processor count.
Data Source
AI summary
Various embodiments include a system for launching tasks in a computing system operating in a secure mode. The system includes a central processing unit (CPU) that has access to an unsecure memory and does not have access to a secure memory. The system further includes an accelerator (e.g., GPU) that has access to the unsecure memory and the secure memory. The CPU encrypts copy tasks and secure tasks for the accelerator and stores the copy tasks and secure tasks in the unsecure memory. Copy engines in the accelerator read, decrypt, and authenticate the copy tasks and store the decrypted copy tasks in the secure memory. The copy engines execute the decrypted copy tasks to read, decrypt, and authenticate the secure tasks and store the decrypted secure tasks in the secure memory. The accelerator schedules the decrypted secure tasks for execution in the secure mode.