The surging demand for generative AI has accelerated the trend of offloading workloads to dedicated accelerators, giving rise to heterogeneous compute systems that combine custom accelerators with general-purpose cores.
Microarchitectural side-channel attacks like Meltdown and Spectre expose the risks of increasingly complex hardware, and each new accelerator expands the attack surface. Conventional security architectures often fail here by assuming all hardware components are trustworthy.
The M³ hardware/operating-system co-design addresses these challenges through a tiled architecture, which incorporates heterogeneous processing elements within isolated tiles. Tiles communicate exclusively via a per-tile trusted communication unit (TCU), which unifies the communication interface between general-purpose cores and accelerators.
The TCU further restricts communication to designated partners and limits memory access to selected regions.
This isolation holds even when bugs are present in the potentially complex processing elements.
Managing TCU communication channels requires an operating system (OS), and the M³ OS has been specifically designed for this task.
It configures TCU restrictions and exposes access control through capability-based permission management, following the principle of least privilege.
The M³ OS also provides a unified programming interface that treats accelerators as first-class citizens.
In this tutorial, participants will learn to program applications for the M³ OS. We will cover TCU interfaces, hardware-accelerated inter-process communication, accelerator integration, and the capability system governing communication rights. By the end, participants will understand the challenges of managing tiled manycores with accelerators and how M³ addresses them through hardware-enforced secure communication.