Here's my write-up on securing Tor that shows issues and mitigations from high-assurance security in action with my own style:

https://www.schneier.com/blog/archives/2014/09/identifying_d...

Here's one write-up of similar methods applied to mobile:

https://www.schneier.com/blog/archives/2014/06/blackphone.ht...

Here's some links to HW and SW techniques that might be used in SOC to knock out the 0-days:

https://news.ycombinator.com/item?id=11848132

Note: You can see difference between few in real security on HW side. Mainstream, faux security immediately says IOMMU, stateless, whatever. High-assurance, real security is concerned with segmentation, pointer protection, making memory untrusted, TCB effects, optionally timing of ISA operations, and so on. Apps + their CPUs get hit all over. Securing one takes more than a mere IOMMU or something. ;)