Note: You can see difference between few in real security on HW side. Mainstream, faux security immediately says IOMMU, stateless, whatever. High-assurance, real security is concerned with segmentation, pointer protection, making memory untrusted, TCB effects, optionally timing of ISA operations, and so on. Apps + their CPUs get hit all over. Securing one takes more than a mere IOMMU or something. ;)
https://www.schneier.com/blog/archives/2014/09/identifying_d...
Here's one write-up of similar methods applied to mobile:
https://www.schneier.com/blog/archives/2014/06/blackphone.ht...
Here's some links to HW and SW techniques that might be used in SOC to knock out the 0-days:
https://news.ycombinator.com/item?id=11848132
Note: You can see difference between few in real security on HW side. Mainstream, faux security immediately says IOMMU, stateless, whatever. High-assurance, real security is concerned with segmentation, pointer protection, making memory untrusted, TCB effects, optionally timing of ISA operations, and so on. Apps + their CPUs get hit all over. Securing one takes more than a mere IOMMU or something. ;)