An apparatus for graphics processing comprising: a graphics processing unit, GPU configured to access a first memory unit according to one of an unsecure mode and a secure mode and a respective resource descriptor associated with each of a plurality of memory resources, wherein the GPU is switchable by a GPU driver between the secure mode and the unsecure mode, wherein each respective resource descriptor comprises information indicating how each respective memory resource of the plurality of resources is to be used, the GPU comprising a memory access controller configured to: a) read the respective resource descriptor associated with each of the plurality of memory resources, b) receive a request for a memory transaction to the first memory unit, c) in response to the request, direct all read and write memory transactions relating to memory resources of the plurality of memory resources for which the respective resource descriptor is a secure resource descriptor to a secure portion of the first memory unit when the GPU is operating according to the secure mode, d) in response to the request, direct all read memory transactions relating to memory resources of the plurality of memory resources for which the respective resource descriptor is an unsecure resource descriptor to an unsecure portion of the first memory unit when the GPU is operating according to the secure mode, and e) in response to the request, drop all write memory transactions relating to memory resources of the plurality of memory resources for which the respective resource descriptor is the unsecure resource descriptor when the GPU is operating according to the secure mode, wherein the GPU further comprises one or more hardware blocks configured to write data to the unsecure portion of the first memory regardless of whether the GPU is in the unsecure mode or the secure mode, wherein the one or more hardware blocks do not have read access to the secure portion of the first memory unit, and wherein the one or more hardware blocks include a front end command processor for sending messages via unsecure memory to the GPU driver. a graphics processing unit, GPU configured to access a first memory unit according to one of an unsecure mode and a secure mode and a respective resource descriptor associated with each of a plurality of memory resources, wherein the GPU is switchable by a GPU driver between the secure mode and the unsecure mode, wherein each respective resource descriptor comprises information indicating how each respective memory resource of the plurality of resources is to be used, the GPU comprising a memory access controller configured to: a) read the respective resource descriptor associated with each of the plurality of memory resources, b) receive a request for a memory transaction to the first memory unit, c) in response to the request, direct all read and write memory transactions relating to memory resources of the plurality of memory resources for which the respective resource descriptor is a secure resource descriptor to a secure portion of the first memory unit when the GPU is operating according to the secure mode, d) in response to the request, direct all read memory transactions relating to memory resources of the plurality of memory resources for which the respective resource descriptor is an unsecure resource descriptor to an unsecure portion of the first memory unit when the GPU is operating according to the secure mode, and e) in response to the request, drop all write memory transactions relating to memory resources of the plurality of memory resources for which the respective resource descriptor is the unsecure resource descriptor when the GPU is operating according to the secure mode, a) read the respective resource descriptor associated with each of the plurality of memory resources, b) receive a request for a memory transaction to the first memory unit, c) in response to the request, direct all read and write memory transactions relating to memory resources of the plurality of memory resources for which the respective resource descriptor is a secure resource descriptor to a secure portion of the first memory unit when the GPU is operating according to the secure mode, d) in response to the request, direct all read memory transactions relating to memory resources of the plurality of memory resources for which the respective resource descriptor is an unsecure resource descriptor to an unsecure portion of the first memory unit when the GPU is operating according to the secure mode, and e) in response to the request, drop all write memory transactions relating to memory resources of the plurality of memory resources for which the respective resource descriptor is the unsecure resource descriptor when the GPU is operating according to the secure mode, wherein the GPU further comprises one or more hardware blocks configured to write data to the unsecure portion of the first memory regardless of whether the GPU is in the unsecure mode or the secure mode, wherein the one or more hardware blocks do not have read access to the secure portion of the first memory unit, and wherein the one or more hardware blocks include a front end command processor for sending messages via unsecure memory to the GPU driver.