Projects

Software-inspired Hardware Verification

Hardware bugs are hard to patch after manufacturing and must be found before tape-out. This line of work brings techniques from software testing and analysis to pre-silicon hardware verification.

Processor Fuzzing

Processor fuzzing, also called CPU fuzzing, applies fuzzing to pre-silicon processor verification. Processor fuzzers generate test programs and run them on the simulated RTL design. They then compare the execution results against an oracle to detect bugs. Our fuzzers have found 20 previously unknown bugs, with 17 CVEs assigned, in the open-source RISC-V processors Rocket, BOOM, CVA6, and XiangShan.

Functional bug fuzzer: MorFuzz

Side-channel bug fuzzer: DejaVuzz

Hardware-assisted System Security

This line of work designs hardware primitives that help operating system kernels protect their security-critical data against memory corruption with low performance overhead.

Data Space Randomization

Data space randomization protects security-critical kernel data, such as return addresses and user credentials, against memory corruption and disclosure. It encodes the in-memory representation of this data with secret keys. Without the keys, corrupted data decodes to garbage values and leaked data does not reveal the plaintext. Our cryptographically strong hardware primitives protect six types of sensitive data in the Linux kernel at register granularity with minimal performance overhead.

Kernel data randomization: RegVault·RegVault II

See Publications for the full list of papers.