\begin{thebibliography}{88}
\providecommand{\natexlab}[1]{#1}
\providecommand{\url}[1]{\texttt{#1}}
\expandafter\ifx\csname urlstyle\endcsname\relax
  \providecommand{\doi}[1]{doi: #1}\else
  \providecommand{\doi}{doi: \begingroup \urlstyle{rm}\Url}\fi

\bibitem[cve(2014{\natexlab{a}})]{cvedetails2014linux}
{Linux} kernel: {CVE} security vulnerabilities, versions and detailed reports.
\newblock
  \url{http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33},
  2014{\natexlab{a}}.
\newblock [Online; accessed 27-April-2015].

\bibitem[cve(2014{\natexlab{b}})]{cvedetails2014xen}
{XEN}: {CVE} security vulnerabilities, versions and detailed reports.
\newblock
  \url{http://www.cvedetails.com/product/23463/XEN-XEN.html?vendor_id=6276},
  2014{\natexlab{b}}.
\newblock [Online; accessed 27-April-2015].

\bibitem[xen(2015)]{xen2015loc}
{Xen} project software overview.
\newblock \url{http://wiki.xen.org/wiki/Xen_Project_Software_Overview}, 2015.
\newblock [Online; accessed 27-April-2015].

\bibitem[Anati et~al.(2013)Anati, Gueron, Johnson, and Scarlata]{anati2013sgx}
Ittai Anati, Shay Gueron, Simon~P. Johnson, and Vincent~R. Scarlata.
\newblock Innovative technology for {CPU} based attestation and sealing.
\newblock In \emph{Proceedings of the 2nd International Workshop on Hardware
  and Architectural Support for Security and Privacy, HASP}, volume~13, 2013.

\bibitem[Anthony(2014)]{anthony2014linuxsize}
Sebastian Anthony.
\newblock Who actually develops {Linux}? the answer might surprise you.
\newblock
  \url{http://www.extremetech.com/computing/175919-who-actually-develops-linux},
  2014.
\newblock [Online; accessed 27-April-2015].

\bibitem[Apecechea et~al.(2014)Apecechea, Inci, Eisenbarth, and
  Sunar]{groka14crossvm}
Gorka~Irazoqui Apecechea, Mehmet~Sinan Inci, Thomas Eisenbarth, and Berk Sunar.
\newblock Fine grain cross-{VM} attacks on {Xen} and {VMware} are possible!
\newblock Cryptology ePrint Archive, Report 2014/248, 2014.
\newblock \url{http://eprint.iacr.org/}.

\bibitem[Banescu(2011)]{banescu2011cache}
Sebastian Banescu.
\newblock Cache timing attacks.
\newblock 2011.
\newblock [Online; accessed 26-January-2014].

\bibitem[Bonneau and Mironov(2006)]{bonneau2006aes}
Joseph Bonneau and Ilya Mironov.
\newblock Cache-collision timing attacks against {AES}.
\newblock In \emph{Cryptographic Hardware and Embedded Systems-CHES 2006},
  pages 201--215. Springer, 2006.

\bibitem[Brickell and Li(2014)]{brickell2014hardening}
E.~Brickell and J.~Li.
\newblock Hardening inter-device secure communication using physically
  unclonable functions, 2014.
\newblock US Patent App. 13/844,559.

\bibitem[Brickell and Li(2009)]{brickell2009epid}
Ernie Brickell and Jiangtao Li.
\newblock Enhanced privacy {ID} from bilinear pairing.
\newblock \emph{IACR Cryptology ePrint Archive}, 2009.

\bibitem[Brumley and Tuveri(2011)]{brumley2011ecc}
Billy~Bob Brumley and Nicola Tuveri.
\newblock Remote timing attacks are still practical.
\newblock In \emph{Computer Security--ESORICS 2011}, pages 355--371. Springer,
  2011.

\bibitem[Brumley and Boneh(2005)]{brumley2005rsa}
David Brumley and Dan Boneh.
\newblock Remote timing attacks are practical.
\newblock \emph{Computer Networks}, 48\penalty0 (5):\penalty0 701--716, 2005.

\bibitem[Carter and Wegman(1977)]{carter1977mac}
J.~Lawrence Carter and Mark~N. Wegman.
\newblock Universal classes of hash functions.
\newblock In \emph{Proceedings of the 9th annual ACM Symposium on Theory of
  Computing}, pages 106--112. ACM, 1977.

\bibitem[Chen et~al.(2011)Chen, Mao, Wang, Zhou, Zeldovich, and
  Kaashoek]{chen2011linux}
Haogang Chen, Yandong Mao, Xi~Wang, Dong Zhou, Nickolai Zeldovich, and M.~Frans
  Kaashoek.
\newblock {Linux} kernel vulnerabilities: State-of-the-art defenses and open
  problems.
\newblock In \emph{Proceedings of the Second Asia-Pacific Workshop on Systems},
  page~5. ACM, 2011.

\bibitem[Costan and Devadas(2011)]{costan2011spchip}
Victor Costan and Srinivas Devadas.
\newblock Security challenges and opportunities in adaptive and reconfigurable
  hardware.
\newblock In \emph{2011 IEEE International Symposium on Hardware-Oriented
  Security and Trust (HOST)}, pages 1--5. IEEE, 2011.

\bibitem[Costan and Devadas(2016)]{costan2016sgxexplained}
Victor Costan and Srinivas Devadas.
\newblock {Intel} {SGX} explained.
\newblock Cryptology ePrint Archive, Report 2016/086, Feb 2016.

\bibitem[Costan et~al.(2017)Costan, Lebedev, and Devadas]{part1}
Victor Costan, Ilia Lebedev, and Srinivas Devadas.
\newblock Secure processors part {I}: Background, taxonomy for secure enclaves
  and {Intel} {SGX} architecture.
\newblock In \emph{FnTEDA}, 2017.

\bibitem[Davenport(2014)]{davenport2014sgx}
Shaun Davenport.
\newblock {SGX}: the good, the bad and the downright ugly.
\newblock \emph{Virus Bulletin}, 2014.

\bibitem[Diffie and Hellman(1976)]{diffie1976keyexchange}
Whitfield Diffie and Martin~E. Hellman.
\newblock New directions in cryptography.
\newblock \emph{Information Theory, IEEE Transactions on}, 22\penalty0
  (6):\penalty0 644--654, 1976.

\bibitem[Domnitser et~al.(2012)Domnitser, Jaleel, Loew, Abu-Ghazaleh, and
  Ponomarev]{domnitser2012nomo}
Leonid Domnitser, Aamer Jaleel, Jason Loew, Nael Abu-Ghazaleh, and Dmitry
  Ponomarev.
\newblock Non-monopolizable caches: Low-complexity mitigation of cache side
  channel attacks.
\newblock \emph{ACM Transactions on Architecture and Code Optimization (TACO)},
  8\penalty0 (4):\penalty0 35, 2012.

\bibitem[Duflot et~al.(2006)Duflot, Etiemble, and Grumelard]{duflot2006smm}
Lo{\"\i}c Duflot, Daniel Etiemble, and Olivier Grumelard.
\newblock Using {CPU} system management mode to circumvent operating system
  security functions.
\newblock \emph{CanSecWest/core06}, 2006.

\bibitem[Dunn et~al.(2011)Dunn, Hofmann, Waters, and Witchel]{dunn2011cloaking}
Alan Dunn, Owen Hofmann, Brent Waters, and Emmett Witchel.
\newblock Cloaking malware with the trusted platform module.
\newblock In \emph{USENIX Security Symposium}, 2011.

\bibitem[Embleton et~al.(2010)Embleton, Sparks, and Zou]{embleton2010smm}
Shawn Embleton, Sherri Sparks, and Cliff~C. Zou.
\newblock {SMM} rootkit: a new breed of {OS} independent malware.
\newblock \emph{Security and Communication Networks}, 2010.

\bibitem[Evtyushkin et~al.(2014)Evtyushkin, Elwell, Ozsoy, Ponomarev,
  Abu~Ghazaleh, and Riley]{evtyushkin2014isox}
Dmitry Evtyushkin, Jesse Elwell, Meltem Ozsoy, Dmitry Ponomarev, Nael
  Abu~Ghazaleh, and Ryan Riley.
\newblock {Iso-X}: A flexible architecture for hardware-managed isolated
  execution.
\newblock In \emph{Microarchitecture (MICRO), 2014 47th annual IEEE/ACM
  International Symposium on}, pages 190--202. IEEE, 2014.

\bibitem[Fletcher et~al.(2012)Fletcher, Dijk, and Devadas]{fletcher2012ascend}
Christopher~W. Fletcher, Marten~van Dijk, and Srinivas Devadas.
\newblock A secure processor architecture for encrypted computation on
  untrusted programs.
\newblock In \emph{Proceedings of the Seventh ACM Workshop on Scalable Trusted
  Computing}, pages 3--8. ACM, 2012.

\bibitem[Gassend et~al.(2002)Gassend, Clarke, Van~Dijk, and
  Devadas]{gassend2002puf}
Blaise Gassend, Dwaine Clarke, Marten Van~Dijk, and Srinivas Devadas.
\newblock Silicon physical random functions.
\newblock In \emph{Proceedings of the 9th ACM Conference on Computer and
  Communications Security}, pages 148--160. ACM, 2002.

\bibitem[Goldreich(1987)]{goldreich1987oram}
Oded Goldreich.
\newblock Towards a theory of software protection and simulation by oblivious
  {RAMs}.
\newblock In \emph{Proceedings of the 19th annual ACM symposium on Theory of
  Computing}, pages 182--194. ACM, 1987.

\bibitem[Gotze et~al.(2014{\natexlab{a}})Gotze, Iovino, and
  Li]{gotze2014provisioning}
K.~C. Gotze, G.~M. Iovino, and J.~Li.
\newblock Secure provisioning of secret keys during integrated circuit
  manufacturing, 2014{\natexlab{a}}.
\newblock US Patent App. 13/631,512.

\bibitem[Gotze et~al.(2014{\natexlab{b}})Gotze, Li, and
  Iovino]{gotze2014provisioning2}
K.~C. Gotze, J.~Li, and G.~M. Iovino.
\newblock Fuse attestation to secure the provisioning of secret keys during
  integrated circuit manufacturing, 2014{\natexlab{b}}.
\newblock US Patent 8,885,819.

\bibitem[Grawrock(2009)]{grawrock2009txt}
David Grawrock.
\newblock \emph{Dynamics of a Trusted Platform: A building block approach}.
\newblock Intel Press, 2009.

\bibitem[Gueron(2011)]{gueron2011rsasig}
Shay Gueron.
\newblock Quick verification of {RSA} signatures.
\newblock In \emph{8th International Conference on Information Technology: New
  Generations (ITNG)}, pages 382--386. IEEE, 2011.

\bibitem[Gueron(2016)]{gueron2016sgxmee}
Shay Gueron.
\newblock A memory encryption engine suitable for general purpose processors.
\newblock Cryptology ePrint Archive, Report 2016/204, 2016.

\bibitem[Hoekstra et~al.(2013)Hoekstra, Lal, Pappachan, Phegade, and
  Del~Cuvillo]{hoekstra2013sgx}
Matthew Hoekstra, Reshma Lal, Pradeep Pappachan, Vinay Phegade, and Juan
  Del~Cuvillo.
\newblock Using innovative instructions to create trustworthy software
  solutions.
\newblock In \emph{Proceedings of the 2nd International Workshop on Hardware
  and Architectural Support for Security and Privacy, HASP}, volume~13, 2013.

\bibitem[Inci et~al.(2015)Inci, Gulmezoglu, Irazoqui, Eisenbarth, and
  Sunar]{inci2015rsachannel}
Mehmet~Sinan Inci, Berk Gulmezoglu, Gorka Irazoqui, Thomas Eisenbarth, and Berk
  Sunar.
\newblock Seriously, get off my cloud! cross-{VM} {RSA} key recovery in a
  public cloud.
\newblock Cryptology ePrint Archive, Report 2015/898, 2015.

\bibitem[Int(2013)]{intel2013sgxmanual}
\emph{Software Guard Extensions Programming Reference}.
\newblock Intel Corporation, 2013.
\newblock Reference no. 329298-001US.

\bibitem[Int(2014)]{intel2014sgx2manual}
\emph{Software Guard Extensions Programming Reference}.
\newblock Intel Corporation, 2014.
\newblock Reference no. 329298-002US.

\bibitem[Int(2015{\natexlab{a}})]{intel2015iscasgx}
\emph{Intel{\textregistered} Software Guard Extensions (Intel{\textregistered}
  {SGX})}.
\newblock Intel Corporation, Jun 2015{\natexlab{a}}.
\newblock Reference no. 332680-002.

\bibitem[Int(2015{\natexlab{b}})]{intel2015sdm}
\emph{{Intel}{\textregistered} 64 and {IA-32} Architectures Software
  Developer's Manual}.
\newblock Intel Corporation, Sep 2015{\natexlab{b}}.
\newblock Reference no. 325462-056US.

\bibitem[Johnson et~al.(2016)Johnson, Scarlata, Rozas, Brickell, and
  Mckeen]{johnson2016sgxprovisioning}
Simon Johnson, Vinnie Scarlata, Carlos Rozas, Ernie Brickell, and Frank Mckeen.
\newblock {Intel}{\textregistered} software guard extensions: {EPID}
  provisioning and attestation services.
\newblock
  \url{https://software.intel.com/en-us/blogs/2016/03/09/intel-sgx-epid-provisioning-and-attestation-services},
  Mar 2016.
\newblock [Online; accessed 21-Mar-2016].

\bibitem[Johnson et~al.(2010)Johnson, Savagaonkar, Scarlata, McKeen, and
  Rozas]{intel2013patent2}
Simon~P. Johnson, Uday~R. Savagaonkar, Vincent~R. Scarlata, Francis~X. McKeen,
  and Carlos~V. Rozas.
\newblock Technique for supporting multiple secure enclaves, Dec 2010.
\newblock US Patent 8,972,746.

\bibitem[Kessler and Hill(1992)]{kessler1992coloring}
Richard~E. Kessler and Mark~D. Hill.
\newblock Page placement algorithms for large real-indexed caches.
\newblock \emph{ACM Transactions on Computer Systems (TOCS)}, 10\penalty0
  (4):\penalty0 338--359, 1992.

\bibitem[Kim et~al.(2014)Kim, Daly, Kim, Fallin, Lee, Lee, Wilkerson, Lai, and
  Mutlu]{kim2014rowhammer}
Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji~Hye Lee, Donghyuk Lee,
  Chris Wilkerson, Konrad Lai, and Onur Mutlu.
\newblock Flipping bits in memory without accessing them: An experimental study
  of {DRAM} disturbance errors.
\newblock In \emph{Proceeding of the 41st annual International Symposium on
  Computer Architecuture}, pages 361--372. IEEE Press, 2014.

\bibitem[Klein et~al.(2009)Klein, Elphinstone, Heiser, Andronick, Cock, Derrin,
  Elkaduwe, Engelhardt, Kolanski, Norrish, et~al.]{klein2009sel4}
Gerwin Klein, Kevin Elphinstone, Gernot Heiser, June Andronick, David Cock,
  Philip Derrin, Dhammika Elkaduwe, Kai Engelhardt, Rafal Kolanski, Michael
  Norrish, et~al.
\newblock {seL4}: Formal verification of an {OS} kernel.
\newblock In \emph{Proceedings of the ACM SIGOPS 22nd symposium on Operating
  systems principles}, pages 207--220. ACM, 2009.

\bibitem[Kocher(1996)]{kocher1996timing}
Paul~C. Kocher.
\newblock Timing attacks on implementations of {Diffie-Hellman}, {RSA}, {DSS},
  and other systems.
\newblock In \emph{Advances in Cryptology--CRYPTO'96}, pages 104--113.
  Springer, 1996.

\bibitem[Kong et~al.(2008)Kong, Aciicmez, Seifert, and Zhou]{kong2008nobscache}
Jingfei Kong, Onur Aciicmez, Jean-Pierre Seifert, and Huiyang Zhou.
\newblock Deconstructing new cache designs for thwarting software cache-based
  side channel attacks.
\newblock In \emph{Proceedings of the 2nd ACM workshop on Computer security
  architectures}, pages 25--34. ACM, 2008.

\bibitem[Kurts et~al.(2011)Kurts, Savransky, Ratner, Hazan, Skaba, Elmosnino,
  and Santhanakrishnan]{intel2011gdxc}
Tsvika Kurts, Guillermo Savransky, Jason Ratner, Eilon Hazan, Daniel Skaba,
  Sharon Elmosnino, and Geeyarpuram~N. Santhanakrishnan.
\newblock Generic debug {eXternal} connection ({GDXC}) for high integration
  integrated circuits, 2011.
\newblock US Patent 8,074,131.

\bibitem[Lee et~al.(2016)Lee, Shih, Gera, Kim, Kim, and
  Peinado]{branch_history_attack}
Sangho Lee, Ming{-}Wei Shih, Prasun Gera, Taesoo Kim, Hyesoon Kim, and Marcus
  Peinado.
\newblock Inferring fine-grained control flow inside {SGX} enclaves with branch
  shadowing.
\newblock \emph{CoRR}, abs/1611.06952, 2016.
\newblock URL \url{http://arxiv.org/abs/1611.06952}.

\bibitem[Lee et~al.(2014)Lee, Waterman, Avizienis, Cook, Sun, Stojanovic, and
  Asanovic]{lee2014rocket}
Yunsup Lee, Andrew Waterman, Rimas Avizienis, Henry Cook, Chen Sun, Vladimir
  Stojanovic, and Krste Asanovic.
\newblock A 45nm 1.3 {GHz} 16.7 double-precision {GFLOPS}/w {RISC-V} processor
  with vector accelerators.
\newblock In \emph{European Solid State Circuits Conference (ESSCIRC), ESSCIRC
  2014-40th}, pages 199--202. IEEE, 2014.

\bibitem[Lin et~al.(2008)Lin, Lu, Ding, Zhang, Zhang, and
  Sadayappan]{lin2008coloring}
Jiang Lin, Qingda Lu, Xiaoning Ding, Zhao Zhang, Xiaodong Zhang, and
  P.~Sadayappan.
\newblock Gaining insights into multicore cache partitioning: Bridging the gap
  between simulation and real systems.
\newblock In \emph{14th International IEEE Symposium on High Performance
  Computer Architecture (HPCA)}, pages 367--378. IEEE, 2008.

\bibitem[Liu and Lee(2014)]{liu2014randomfill}
Fangfei Liu and Ruby~B. Lee.
\newblock Random fill cache architecture.
\newblock In \emph{Microarchitecture (MICRO), 2014 47th annual IEEE/ACM
  International Symposium on}, pages 203--215. IEEE, 2014.

\bibitem[Liu et~al.(2015)Liu, Yarom, Ge, Heiser, and Lee]{liu2015llctiming}
Fangfei Liu, Yuval Yarom, Qian Ge, Gernot Heiser, and Ruby~B. Lee.
\newblock Last-level cache side-channel attacks are practical.
\newblock In \emph{Security and Privacy (SP), 2015 IEEE Symposium on}, pages
  143--158. IEEE, 2015.

\bibitem[Liu et~al.(2016)Liu, Ge, Yarom, Mckeen, Rozas, Heiser, and
  Lee]{liu2016catalyst}
Fangfei Liu, Qian Ge, Yuval Yarom, Frank Mckeen, Carlos Rozas, Gernot Heiser,
  and Ruby~B. Lee.
\newblock {CATalyst}: Defeating last-level cache side channel attacks in cloud
  computing.
\newblock In \emph{HPCA}, Mar 2016.

\bibitem[Maes et~al.(2009)Maes, Tuyls, and Verbauwhede]{maes2009puf}
R.~Maes, P.~Tuyls, and I.~Verbauwhede.
\newblock {Low-Overhead Implementation of a Soft Decision Helper Data Algorithm
  for \textsc{SRAM PUF}s}.
\newblock In \emph{Cryptographic Hardware and Embedded Systems (CHES)}, pages
  332--347, 2009.

\bibitem[Maurice et~al.(2015)Maurice, Le~Scouarnec, Neumann, Heen, and
  Francillon]{maurice2015intelhash}
Cl{\'e}mentine Maurice, Nicolas Le~Scouarnec, Christoph Neumann, Olivier Heen,
  and Aur{\'e}lien Francillon.
\newblock Reverse engineering {Intel} last-level cache complex addressing using
  performance counters.
\newblock In \emph{Proceedings of the 18th International Symposium on Research
  in Attacks, Intrusions and Defenses (RAID)}, 2015.

\bibitem[McKeen et~al.(2009)McKeen, Rozas, Savagaonkar, Johnson, Scarlata,
  Goldsmith, Brickell, Li, Herbert, Dewan, Tolopka, Neiger, Durham, Graunke,
  Lint, Van~Dyke, Cihula, Jeyasingh, Van~Doren, Rodgers, Garney, and
  Altman]{intel2013patent1}
Francis~X. McKeen, Carlos~V. Rozas, Uday~R. Savagaonkar, Simon~P. Johnson,
  Vincent Scarlata, Michael~A. Goldsmith, Ernie Brickell, Jiang~Tao Li,
  Howard~C. Herbert, Prashant Dewan, Stephen~J. Tolopka, Gilbert Neiger, David
  Durham, Gary Graunke, Bernard Lint, Don~A. Van~Dyke, Joseph Cihula,
  Stalinselvaraj Jeyasingh, Stephen~R. Van~Doren, Dion Rodgers, John Garney,
  and Asher Altman.
\newblock Method and apparatus to provide secure application execution, Dec
  2009.
\newblock US Patent 9,087,200.

\bibitem[McKeen et~al.(2013)McKeen, Alexandrovich, Berenzon, Rozas, Shafi,
  Shanbhogue, and Savagaonkar]{mckeen2013sgx}
Frank McKeen, Ilya Alexandrovich, Alex Berenzon, Carlos~V. Rozas, Hisham Shafi,
  Vedvyas Shanbhogue, and Uday~R. Savagaonkar.
\newblock Innovative instructions and software model for isolated execution.
\newblock \emph{HASP}, 13:\penalty0 10, 2013.

\bibitem[MIT(2017)]{sanctumsource}
MIT.
\newblock Reference implementation of a {Sanctum} security monitor.
\newblock \url{https://github.com/pwnall/sanctum}, 2017.
\newblock [Online; accessed 1-Jan-2017].

\bibitem[Oren et~al.(2015)Oren, Kemerlis, Sethumadhavan, and
  Keromytis]{oren2015jstiming}
Yossef Oren, Vasileios~P. Kemerlis, Simha Sethumadhavan, and Angelos~D.
  Keromytis.
\newblock The spy in the sandbox -- practical cache attacks in {JavaScript}.
\newblock \emph{arXiv preprint arXiv:1502.07373}, 2015.

\bibitem[Pessl et~al.(2015)Pessl, Gruss, Maurice, and
  Mangard]{dram_timing_attack}
Peter Pessl, Daniel Gruss, Cl{\'{e}}mentine Maurice, and Stefan Mangard.
\newblock Reverse engineering intel {DRAM} addressing and exploitation.
\newblock \emph{CoRR}, abs/1511.08756, 2015.

\bibitem[Petters and Farber(1999)]{petters1999making}
Stefan~M. Petters and Georg Farber.
\newblock Making worst case execution time analysis for hard real-time tasks on
  state of the art processors feasible.
\newblock In \emph{Sixth International Conference on Real-Time Computing
  Systems and Applications}, pages 442--449. IEEE, 1999.

\bibitem[Ristenpart et~al.(2009)Ristenpart, Tromer, Shacham, and
  Savage]{ristenpart2009colocation}
Thomas Ristenpart, Eran Tromer, Hovav Shacham, and Stefan Savage.
\newblock Hey, you, get off of my cloud: Exploring information leakage in
  third-party compute clouds.
\newblock In \emph{Proceedings of the 16th ACM Conference on Computer and
  Communications Security}, pages 199--212. ACM, 2009.

\bibitem[Ruan(2014)]{ruan2014intelme}
Xiaoyu Ruan.
\newblock \emph{Platform Embedded Security Technology Revealed}.
\newblock Apress, 2014.
\newblock ISBN 978-1-4302-6571-9.

\bibitem[Rutkowska(2013)]{wojtczuk2013sgx2}
Joanna Rutkowska.
\newblock Thoughts on {Intel}'s upcoming software guard extensions (part 2).
\newblock \emph{Invisible Things Lab}, 2013.

\bibitem[Rutkowska and Wojtczuk(2008)]{rutkowska2008remap}
Joanna Rutkowska and Rafa{\l} Wojtczuk.
\newblock Preventing and detecting {Xen} hypervisor subversions.
\newblock \emph{Blackhat Briefings USA}, 2008.

\bibitem[Sanchez and Kozyrakis(2010)]{sanchez2010zcache}
Daniel Sanchez and Christos Kozyrakis.
\newblock The {ZCache}: Decoupling ways and associativity.
\newblock In \emph{Microarchitecture (MICRO), 2010 43rd annual IEEE/ACM
  International Symposium on}, pages 187--198. IEEE, 2010.

\bibitem[Sanchez and Kozyrakis(2011)]{sanchez2011vantage}
Daniel Sanchez and Christos Kozyrakis.
\newblock {Vantage}: scalable and efficient fine-grain cache partitioning.
\newblock In \emph{ACM SIGARCH Computer Architecture News}, volume~39, pages
  57--68. ACM, 2011.

\bibitem[Seaborn and Dullien(2015)]{google2015rowhammer}
Mark Seaborn and Thomas Dullien.
\newblock Exploiting the {DRAM} rowhammer bug to gain kernel privileges.
\newblock
  \url{http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html},
  Mar 2015.
\newblock [Online; accessed 9-March-2015].

\bibitem[Shanbhogue et~al.(2015)Shanbhogue, Brandt, and
  Wiedemeier]{shanbhogue2015gdxcsgx}
V.~Shanbhogue, J.~W. Brandt, and J.~Wiedemeier.
\newblock Protecting information processing system secrets from debug attacks,
  2015.
\newblock US Patent 8,955,144.

\bibitem[Stefanov et~al.(2013)Stefanov, Van~Dijk, Shi, Fletcher, Ren, Yu, and
  Devadas]{stefanov2013path}
Emil Stefanov, Marten Van~Dijk, Elaine Shi, Christopher Fletcher, Ling Ren,
  Xiangyao Yu, and Srinivas Devadas.
\newblock Path {ORAM}: An extremely simple oblivious ram protocol.
\newblock In \emph{Proceedings of the 2013 ACM SIGSAC conference on Computer \&
  communications security}, pages 299--310. ACM, 2013.

\bibitem[Suh and Devadas(2007)]{suh2007puf}
G.~Edward Suh and Srinivas Devadas.
\newblock Physical unclonable functions for device authentication and secret
  key generation.
\newblock In \emph{Proceedings of the 44th annual Design Automation
  Conference}, pages 9--14. ACM, 2007.

\bibitem[Suh et~al.(2003)Suh, Clarke, Gassend, Van~Dijk, and
  Devadas]{suh2003aegis}
G.~Edward Suh, Dwaine Clarke, Blaise Gassend, Marten Van~Dijk, and Srinivas
  Devadas.
\newblock {AEGIS}: architecture for tamper-evident and tamper-resistant
  processing.
\newblock In \emph{Proceedings of the 17th annual international conference on
  Supercomputing}, pages 160--171. ACM, 2003.

\bibitem[Suh et~al.(2005)Suh, O'Donnell, Sachdev, and Devadas]{aegis_impl}
G.~Edward Suh, Charles~W. O'Donnell, Ishan Sachdev, and Srinivas Devadas.
\newblock {Design and Implementation of the {\sc aegis} Single-Chip Secure
  Processor Using Physical Random Functions}.
\newblock In \emph{Proceedings of the $32^{nd}$ ISCA'05}. ACM, June 2005.

\bibitem[Taylor et~al.(1990)Taylor, Davies, and Farmwald]{taylor1990coloring}
George Taylor, Peter Davies, and Michael Farmwald.
\newblock The {TLB} slice - a low-cost high-speed address translation
  mechanism.
\newblock \emph{SIGARCH Computer Architecture News}, 18\penalty0
  (2SI):\penalty0 355--363, 1990.

\bibitem[Wang et~al.(2017)Wang, Chen, Pan, Zhang, Wang, Bindschaedler, Tang,
  and Gunter]{dram_timing_attack_sgx}
Wenhao Wang, Guoxing Chen, Xiaorui Pan, Yinqian Zhang, XiaoFeng Wang, Vincent
  Bindschaedler, Haixu Tang, and Carl~A. Gunter.
\newblock Leaky cauldron on the dark land: Understanding memory side-channel
  hazards in {SGX}.
\newblock \emph{CoRR}, abs/1705.07289, 2017.

\bibitem[Wang and Lee(2007)]{wang2007bscache}
Zhenghong Wang and Ruby~B. Lee.
\newblock New cache designs for thwarting software cache-based side channel
  attacks.
\newblock In \emph{Proceedings of the 34th annual International Symposium on
  Computer Architecture}, ISCA '07, pages 494--505, 2007.
\newblock ISBN 978-1-59593-706-3.

\bibitem[Waterman et~al.(2014)Waterman, Lee, Patterson, and
  Asanovic]{waterman2014riscv}
Andrew Waterman, Yunsup Lee, David~A. Patterson, and Krste Asanovic.
\newblock The {RISC-V} instruction set manual, volume {I}: User-level {ISA},
  version {2.0}.
\newblock Technical Report UCB/EECS-2014-54, EECS Department, University of
  California, Berkeley, May 2014.
\newblock URL
  \url{http://www.eecs.berkeley.edu/Pubs/TechRpts/2014/EECS-2014-54.html}.

\bibitem[Waterman et~al.(2015)Waterman, Lee, Avizienis, Patterson, and
  Asanovic]{waterman2015riscvsystem}
Andrew Waterman, Yunsup Lee, Rimas Avizienis, David~A. Patterson, and Krste
  Asanovic.
\newblock The {RISC-V} instruction set manual volume {II}: Privileged
  architecture version {1.7}.
\newblock Technical Report UCB/EECS-2015-49, EECS Department, University of
  California, Berkeley, May 2015.
\newblock URL
  \url{http://www.eecs.berkeley.edu/Pubs/TechRpts/2015/EECS-2015-49.html}.

\bibitem[Wecherowski(2009)]{wecherowski2009smm}
Filip Wecherowski.
\newblock A real {SMM} rootkit: Reversing and hooking {BIOS} {SMI} handlers.
\newblock \emph{Phrack Magazine}, 13\penalty0 (66), 2009.

\bibitem[Wegman and Carter(1981)]{wegman1981mac}
Mark~N. Wegman and J.~Lawrence Carter.
\newblock New hash functions and their use in authentication and set equality.
\newblock \emph{Journal of Computer and System Sciences}, 22\penalty0
  (3):\penalty0 265--279, 1981.

\bibitem[Wojtczuk and Rutkowska(2009{\natexlab{a}})]{wojtczuk2009smm}
Rafal Wojtczuk and Joanna Rutkowska.
\newblock Attacking {SMM} memory via {Intel} {CPU} cache poisoning.
\newblock \emph{Invisible Things Lab}, 2009{\natexlab{a}}.

\bibitem[Wojtczuk and Rutkowska(2009{\natexlab{b}})]{wojtczuk2009txt}
Rafal Wojtczuk and Joanna Rutkowska.
\newblock Attacking {Intel} trusted execution technology.
\newblock \emph{Black Hat DC}, 2009{\natexlab{b}}.

\bibitem[Wojtczuk and Rutkowska(2011)]{wojtczuk2011txt}
Rafal Wojtczuk and Joanna Rutkowska.
\newblock Attacking intel txt via sinit code execution hijacking, 2011.

\bibitem[Wojtczuk et~al.(2009)Wojtczuk, Rutkowska, and
  Tereshkin]{wojtczuk2009txt2}
Rafal Wojtczuk, Joanna Rutkowska, and Alexander Tereshkin.
\newblock Another way to circumvent {Intel}{\textregistered} trusted execution
  technology.
\newblock \emph{Invisible Things Lab}, 2009.

\bibitem[Xu et~al.(2015)Xu, Cui, and Peinado]{xu2015pagefaults}
Yuanzhong Xu, Weidong Cui, and Marcus Peinado.
\newblock Controlled-channel attacks: Deterministic side channels for untrusted
  operating systems.
\newblock In \emph{Proceedings of the 36th IEEE Symposium on Security and
  Privacy (Oakland)}. IEEE -- Institute of Electrical and Electronics
  Engineers, May 2015.

\bibitem[Yarom and Falkner(2013)]{yarom2013llctiming}
Yuval Yarom and Katrina~E. Falkner.
\newblock {Flush+Reload}: a high resolution, low noise, {L3} cache side-channel
  attack.
\newblock \emph{IACR Cryptology ePrint Archive}, 2013:\penalty0 448, 2013.

\bibitem[Yarom et~al.(2015)Yarom, Ge, Liu, Lee, and Heiser]{yarom2015intelhash}
Yuval Yarom, Qian Ge, Fangfei Liu, Ruby~B. Lee, and Gernot Heiser.
\newblock Mapping the {Intel} last-level cache.
\newblock Cryptology ePrint Archive, Report 2015/905, 2015.

\bibitem[Yee et~al.(2009)Yee, Sehr, Dardyk, Chen, Muth, Ormandy, Okasaka,
  Narula, and Fullagar]{yee2009native}
Bennet Yee, David Sehr, Gregory Dardyk, J.~Bradley Chen, Robert Muth, Tavis
  Ormandy, Shiki Okasaka, Neha Narula, and Nicholas Fullagar.
\newblock Native client: A sandbox for portable, untrusted x86 native code.
\newblock In \emph{Security and Privacy, 2009 30th IEEE Symposium on}, pages
  79--93. IEEE, 2009.

\bibitem[Yuffe et~al.(2011)Yuffe, Knoll, Mehalel, Shor, and
  Kurts]{yuffe2011sandybridge}
Marcelo Yuffe, Ernest Knoll, Moty Mehalel, Joseph Shor, and Tsvika Kurts.
\newblock A fully integrated multi-{CPU}, {GPU} and memory controller 32nm
  processor.
\newblock In \emph{Solid-State Circuits Conference Digest of Technical Papers
  (ISSCC), 2011 IEEE International}, pages 264--266. IEEE, 2011.

\end{thebibliography}
