Reading List

* Indicates the resource is available through MIT library.

	Background Reviews and Related Books	Research Papers	Fun Readings and Videos
L01 Intro	6.191 [6.004] slides L05 The Digital Abstraction L15 Memory Hierarchy L16 Caches L17 Operating Systems: Virtual Machines & Exceptions L18 Virtual Memory L20 Data and Control Hazards in Pipelined Processors L22 Modern Processor Architecture		It’s Time for Operating Systems to Rediscover Hardware
L02 Side Channel		Kiriansky et al. DAWG: A Defense Against Cache Timing Attacks in Speculative Execution Processors Karger et al. A retrospective on the VAX VMM security kernel. (Section VI-E)	Side Channel Security Youtube Channel
L03 Cache-based Side Channels		Yarom et al. FLUSH+RELOAD: A High Resolution, Low Noise, L3 Cache Side-Channel Attack Colin Percival. Cache missing for fun and profit Liu et al. Last-Level Cache Side-Channel Attacks are Practical. Yan et al. Attack Directories, Not Caches: Side Channel Attacks in a Non-Inclusive World.	EntryBleed: Breaking KASLR under KPTI with Prefetch
L04 Transient Execution Attacks	6.590 [6.823] L06 Complex Pipelining Scoreboarding 6.590 [6.823] L06 Recording	Hill et al. On the Spectre and Meltdown Processor Security Vulnerabilities. Lipp et al. Meltdown: Reading Kernel Memory from User Space. Kocher et al. Spectre Attacks: Exploiting Speculative Execution. Chandler Carruth. Speculative Load Hardening: A Spectre Variant #1 Mitigation Technique. MDS: Microarchitectural Data Sampling.
L05 Software and Hardware Contract		Guarnieri et al. Hardware-Software Contracts for Secure Speculation. ARM. DIT, Data Independent Timing. Intel. Data Operand Independent Timing Instruction Set Architecture (ISA) Guidance. Cauligi et al. FaCT: A DSL for Timing-Sensitive Computation Rane et al. Secure, Precise, and Fast Floating-Point Operations on x86 Processors. BearSSL. Constant-time Crypto.
L06 Hardware Security Module	Costan et al. Intel SGX Explained (Section 3.1-3.3, Section 4.1, 4.4-4.5) Jakub Szefer. Principles of Secure Processor Architecture Design* (Chapter 5 Hardware Root of Trust)	Dyer et al. Building the IBM 4758 Secure Coprocessor. 2001 Apple Platform Security. Page 5-96.
L07 Physical Attacks	6.191 [6.004] L5 The Digital Abstraction L10 Sequential Circuit Colin O’Flynn. The Hardware Hacking Handbook* (Chapters 1, 5, 8, 13) Andrew “bunnie” Huang. Hacking the Xbox	Mangard et al. Power Analysis Attacks: Revealing the Secrets of Smart Cards. Smith et al. Building a high-performance, programmable secure coprocessor. (Section 4)	Andrew “bunnie” Huang’s talk on Supply Chain Attacks & Verifiability (Slides) Recording
L08 Rowhammer Attacks	Jacob et al. Memory systems: cache, DRAM, disk. (Chapter 10)	Kim et al. Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors Razavi et al. Flip Feng Shui: Hammering a Needle in the Software Stack. Tang et al. CLKSCREW: Exposing the Perils of Security-Oblivious Energy Management Wang et al. Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86	Onur Mutlu. The Story of Rowhammer Seaborn et al. Exploiting the DRAM rowhammer bug to gain kernel privileges.
L09 Trusted Execution Environment (TEE)	Costan et al. Intel SGX Explained. (Section 5 and 6.2)	AMD Secure Encrypted Virtualization (SEV). Protecting VM Register State With SEV-ES. AMD SEV-SNP Lee et al. Keystone: An Open Framework for Architecting Trusted Execution Environments. RISC-V Privileged Instructions. (Section 3.6) Arm Confidential Compute Architecture Intel Trust Domain Extensions (TDX)
L10 Hardware Support for Memory Safety	Szekeres et al. SoK: Eternal War in Memory	Aleph One. Smashing the Stack for Fun and Profit. Watson et al. An Introduction to CHERI. The Arm Morello Board. Appel et al. Virtual memory primitives for user programs. Jonathan Corbet. Memory protection keys. Qualcomm. Pointer Authentication on ARMv8.3 Design and Analysis of the New Software Security Instructions. Armv8.5-A Memory Tagging Extension. Intel. Control-flow Enforcement Technology Specification. (Section 1-3) Abadi et al. Control-flow integrity principles, implementations, and applications.	xkcd. HeartBleed Explanation.
L11 Hardware Fuzzing and Verification		Coe et al. Computational aspects of the Pentium affair. Trippel et al. Fuzzing Hardware Like Software. Hicks et al. SPECS: A Lightweight Runtime Mechanism for Protecting Software from Security-Critical Processor Bugs. Biham et al. Bug Attacks. Dessouky et al. HardFails: Insights into Software-Exploitable Hardware Bugs. Manès et al. The Art, Science, and Engineering of Fuzzing: A Survey. Barberis et al. Branch History Injection: On the Effectiveness of Hardware Mitigations Against Cross-Privilege Spectre-v2 Attacks.	Christopher Domas. Breaking the x86 Instruction Set. Intel Pentium FPU glitch. Rafal Wojtczuk. A Stitch In Time Saves Nine: A Case Of Multiple OS Vulnerability. Riding the Fuzzing Hype Train (RAID’21 Keynote)