  Graphics Processing Units (GPUs) are a ubiquitous component across the range
of today's computing platforms, from phones and tablets, through personal
computers, to high-end server class platforms. With the increasing importance
of graphics and video workloads, recent processors are shipped with GPU devices
that are integrated on the same chip. Integrated GPUs share some resources with
the CPU and as a result, there is a potential for microarchitectural attacks
from the GPU to the CPU or vice versa. We believe this type of attack, crossing
the component boundary (GPU to CPU or vice versa) is novel, introducing unique
challenges, but also providing the attacker with new capabilities that must be
considered when we design defenses against microarchitectrual attacks in these
environments. Specifically, we consider the potential for covert channel
attacks that arise either from shared microarchitectural components (such as
caches) or through shared contention domains (e.g., shared buses). We
illustrate these two types of channels by developing two reliable covert
channel attacks. The first covert channel uses the shared LLC cache in Intel's
integrated GPU architectures. The second is a contention based channel
targeting the ring bus connecting the CPU and GPU to the LLC. Cross component
channels introduce a number of new challenges that we had to overcome since
they occur across heterogeneous components that use different computation
models and are interconnected using asymmetric memory hierarchies. We also
exploit GPU parallelism to increase the bandwidth of the communication, even
without relying on a common clock. The LLC based channel achieves a bandwidth
of 120 kbps with a low error rate of 2%, while the contention based channel
delivers up to 400 kbps with a 0.8% error rate.
