Hector Martin

Your posts just reminded me of it, so maybe it'll provide some new viewpoints for you?

i mean, I used to do silicon-level circuit design and layout, and architecture design. both at separate points, mind you, but i know the problem pretty well. the issue is that simple hardware is slow hardware, and asking for a complete architecture redesign is no small thing.

Like, it's hard to overstate the benefit of modern architecture changes. pipeline improvements, specex, etc, have made hardware /drastically/ faster by reducing fundamental bottlenecks. It's a tall order to ask people to go back to that level of simplicity.

That being said, my "ideal" solution to architecture problems in general isn't to fix architecture problems, its to have a physically separate introspection processor. One which is cheap, simple, open source, and replacable, which runs a watchdog firmware that monitors the CPU.

It's the easiest way to fix these flaws: have a fundamentally separate SoC with a small attack surface in a purely management role, which is responsible for confirming main CPU's behavior is in line with expectations. Like ME, but external and auditable.

How would this work? If it has to monitor everything the main CPU does, it has to be as powerful as the main CPU. If it doesn't, then you could make the main CPU do evil things that it wouldn't catch.

I'm not thinking of a full monitoring role, was juggling a million notifications when I saw this. My main motivation for this is the thought of ME/other management coprocessors which are unaudited attack surfaces.

I guess my main thought is that a separate, replacable, open source, simple processor for handling trusted execution tasks adds a level of security and peace of mind. It doesn't fix side-channels, but it does allow for verification of no sidechannels in trusted environments