Pith. sign in

REVIEW 4 major objections 5 minor 57 references

DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking assisted Processor Fuzzing

T0 review · 4 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DejaVuzz finds five new transient-execution bugs by giving a processor fuzzer memory swapping and differential taint tracking.

desk verdict Genuinely new primitives and five CVE-backed bugs, but the headline 4.7x coverage over SpecDoctor is built on the authors' own metric and doesn't hold up. read the letter →

arxiv 2504.20934 v1 pith:5PQPPZGL submitted 2025-04-29 cs.AR cs.CR

Jinyan Xu , Yangye Zhou , Xingzhi Zhang , Yinshuai Li , Qinhan Tan , Yinqian Zhang , Yajin Zhou , Rui Chang
show 1 more author
Wenbo Shen
This is my paper · ORCID
classification cs.ARcs.CR
keywords transientexecutionvulnerabilitiesprocessorfuzzingRTLverificationdynamicinformationflowtrackingdifferentialtestingspeculativemicroarchitecturalsidechannelspre-siliconsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

DejaVuzz is a pre-silicon fuzzer for transient execution vulnerabilities, the class of bugs behind Spectre and Meltdown, running on register-transfer-level designs of out-of-order processors. It argues that prior fuzzers fail for two reasons: they cannot freely arrange training code and transient code because both compete for the same addresses, and they cannot tell which microarchitectural changes were actually caused by the secret. To fix this, it time-shares a memory region between training and transient instruction sequences, and runs two copies of the processor with bit-flipped secrets, propagating taints only when the two copies disagree on a control signal. On two open-source RISC-V out-of-order cores it reports a 4.7x improvement in taint coverage over the leading baseline, near-zero training for most transient window types, and five previously unknown vulnerabilities that received six CVEs.

What carries the argument

The central mechanisms are two operating primitives. Dynamic swappable memory, or swapMem, divides memory into shared, dedicated, and swappable regions; a trap handler flushes the instruction cache and loads a new instruction sequence into the swappable region between phases, so that training and transient code can share one address space without polluting each other. Differential information flow tracking, or diffIFT, instruments the RTL at its intermediate-representation level with shadow taint cells; for multiplexers, comparison cells, register enables, and memory reads and writes, control taints propagate only when the corresponding signal differs between two DUT instances holding bit-flipped secrets. The taint coverage matrix counts, per module and per clock cycle, how many registers are tainted, giving the fuzzer a feedback signal for mutation, while taint liveness annotations bind data buffers to their validity state registers so that stale data left in buffers is not reported as leakage.

What would settle it

Take a secret-dependent branch or multiplexer select whose outcome is identical for the two bit-flipped secrets DejaVuzz uses (for example, a condition that checks only the lowest bit while the two secrets differ only in upper bits), add a third secret that flips that control signal, and check whether DejaVuzz's taint log reports the leak for the third secret while staying silent on the original pair; a silent miss on the pair would confirm diffIFT's under-approximation and bound the bug-finding guarantee.

Watch

Extended reading notes

Core claim

The paper's central claim is that transient execution bugs in complex out-of-order processors can be found systematically before silicon by giving the fuzzer two capabilities previous pre-silicon fuzzers lack: microarchitectural controllability via dynamic swappable memory and microarchitectural observability via differential information flow tracking. Dynamic swappable memory lets the fuzzer load training sequences and transient sequences into the same address space at different times, so it can trigger arbitrary transient windows, including backward branches and exception-driven windows that the prior state-of-the-art fuzzer discards, and then delete training packets that do not contribute. Differential information flow tracking instruments the RTL so that a tainted control signal only propagates its taint when two identical cores fed different secrets actually choose different values, which removes the control-flow over-tainting that makes prior taint trackers saturate. On this basis DejaVuzz defines a taint coverage matrix to guide mutation and taint liveness annotations to discard stale buffer contents, and reports five new transient execution vulnerabilities, Meltdown-Sampling, Phantom-RSB, Phantom-BTB, Spectre-Refetch, and Spectre-Reload, with six CVEs assigned across the two cores.

Load-bearing premise

The method assumes that two copies of the processor with bit-flipped secrets will show visibly different values on every secret-dependent control signal, so that any leak depending on a control decision will be tainted; if the chosen secret pair happens to agree on that signal, the leak is silently missed.

Editorial extensions

If this is right

  • If DejaVuzz is right, pre-silicon fuzzers can trigger all major classes of transient windows, including exception-driven, memory-disambiguation, branch-misprediction, indirect-jump, and return-address-misprediction windows, rather than a limited template subset.
  • Training overhead for a transient window drops to near zero for exception-type windows and to a few effective instructions for misprediction-type windows, because ineffective training packets are identified by re-simulation and discarded.
  • The differential taint approach damps control-flow over-tainting: a tainted selection signal is ignored unless two differently-secreted copies actually produce different selections, keeping taint counts low enough to serve as fuzzing coverage.
  • Taint liveness annotations can separate real leakages from stale-buffer artifacts, reducing false positives that otherwise make fuzzers spend iterations decoding unexploitable state.
  • Previously overlooked bugs, such as secret-dependent return-address-stack corruption and exception-time branch-target-buffer updates, become detectable in RTL, meaning real out-of-order cores without fixes could be at risk.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not explore this, but because diffIFT uses only two concrete secrets, its false-negative rate is governed by how often the secret pair lands on equal values at a secret-dependent control point; a natural extension would be to sweep several pairwise-different secrets per run or to substitute symbolic comparison at those control points.
  • If swapMem's scheduling can be mounted through a system-level mechanism such as DMA rather than a simulator trap handler, the same training/transient isolation could be applied to post-silicon or black-box processor testing, a possibility the paper only raises.
  • The reported 54-of-75 false-positive rate for the baseline suggests that stale-buffer artifacts dominate naive differential oracles; applying DejaVuzz's liveness-filtering logic to other cores should reproduce a similar drop in false positives, a testable prediction beyond the two processors in the paper.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes DejaVuzz, a pre-silicon fuzzer for transient execution vulnerabilities in RTL processors. It introduces two primitives: swapMem, which time-shares the address space so that training and transient instruction sequences can be scheduled without address conflicts, and diffIFT, which runs two DUT instances with different secrets and suppresses control taints unless the corresponding control signals differ between the instances. The primitives are used to trigger diverse transient windows, guide mutation through a taint-coverage matrix, and identify exploitable leaks via taint-liveness annotations. The evaluation on BOOM and XiangShan reports a 4.7x coverage improvement over SpecDoctor, lower training instruction overhead, and five previously unknown vulnerabilities with six assigned CVEs.

Significance. The strongest evidence is the discovery of five previously unknown transient execution bugs (B1-B5) with independently assigned CVEs on two nontrivial open-source RISC-V processors, with fixes for XiangShan confirmed by maintainers and source code/experiments publicly released. The swapMem and diffIFT ideas target genuine controllability and observability gaps in prior fuzzing work, and the taint-liveness oracle is a useful step toward reducing the false positives that plague earlier oracle designs. The main reservation is that the headline '4.7x coverage improvement' is measured with DejaVuzz's own taint-coverage metric over a replayed SpecDoctor corpus, so it does not constitute a fair end-to-end comparison and should not be presented as state-of-the-art superiority. The contribution is therefore significant despite the quantitative comparison requiring substantial rework.

major comments (4)
  1. [§6.3, Fig. 7, §4.2.2] The 4.7x coverage claim used in the abstract and introduction is not supported as a state-of-the-art comparison. The evaluation 'replays the phase 3 test cases generated by SpecDoctor' through the taint-coverage metric defined in §4.2.2; SpecDoctor never receives feedback from this metric, so it is structurally unable to optimize it, and the ratio largely measures how well DejaVuzz matches its own objective. Furthermore, the x-axis is iterations, not wall-clock time, while DejaVuzz runs two diffIFT-instrumented DUTs per iteration, so per-iteration cost is higher. The paper itself notes in §6.4 that 'higher coverage does not guarantee more bugs,' making this metric unsuitable as the sole evidence for outperforming SpecDoctor. I recommend supplementing or replacing this comparison with (a) wall-clock time to find known bugs under the same simulator and thread budget, and (b) an evaluation metric that is not the fuzzer's own mutation objective, or clearly qualifying the claim.
  2. [§4.2.2, §6.3] The taint-coverage point is defined as a (module, per-cycle tainted-register-count) tuple. This definition mechanically rewards encoding blocks that taint more registers for more cycles, even if the same transient behaviors are exercised, and no experiment in §6.3 demonstrates that this metric correlates with vulnerability discovery. Because the same metric also guides mutation in Phase 2, the reported coverage improvement is partly circular. I would like to see a validation of the metric: for example, its precision and recall on a labeled corpus of known transient-execution bug triggers and non-bugs, and an ablation showing that mutations chosen by taint coverage lead to bug detection rather than only to higher raw taint counts.
  3. [§3.3, Table 1, Fig. 6] The paper correctly states that diffIFT is an under-approximation because it compares only two concrete values. The proposed mitigation, flipping each bit of the secret, does not guarantee divergence of a secret-dependent control signal when the signal's value depends on multiple bits or on equality of derived values; in such cases control taints are suppressed and leaks that require a speculative control-flow change are missed. This is acknowledged in §3.3 but not quantified. Since taint coverage and mutation in Phase 2 depend on the resulting taint traces, the effect is not limited to oracle recall; it can also bias exploration. I request an experiment measuring the false-negative rate on known bug-triggering test cases with several secret pairs, and a discussion of whether the bit-flip secret generation is sufficient for the control-flow-dependent bugs B2-B5.
  4. [§4.3.2, Table 2, §7] The taint-liveness oracle is manual. Table 2 reports 212 and 592 lines of annotation for BOOM and XiangShan, and §7 acknowledges that DejaVuzz 'currently relies on manual taint liveness annotations.' The paper does not report the effort or expertise required to create these annotations, nor what happens when annotations are incomplete: an unannotated state register that gates an exploitable tainted sink will be silently filtered out. Because the oracle is central to false-positive reduction and to the bug reports, the reproducibility and generality claims are incomplete without a description of the annotation workflow, a validation that all relevant state registers are annotated for the two cores, and an assessment of sensitivity to annotation errors.
minor comments (5)
  1. [§6.2, Table 3] The training-overhead comparison would be easier to interpret if SpecDoctor's ETO were also reported; as it stands, Table 3 gives TO for SpecDoctor and both TO and ETO for DejaVuzz, so the 'lower training overhead' claim does not compare like with like in every row.
  2. [§6.3] In the liveness evaluation of SpecDoctor, please clarify whether the 75 test cases come from a full SpecDoctor run or from the replayed corpus used in Figure 7; the current wording is ambiguous.
  3. [§6.4] The statement that DejaVuzz 'detects the first bug in an average of about 10 minutes' should be accompanied by the number of runs, the variance, and the exact hardware configuration; a single average over 16 threads is not a distribution.
  4. [§2.1, Figure 1] Step 4 of the attack (decoding the secret) is only mentioned in the figure caption; the text should explain how the proposed oracle observes this step, since the oracle is based on taint liveness rather than on decoding a side channel.
  5. [§4.1.1] The claim that DejaVuzz 'covers transient windows triggered by all instruction types' is broader than what is evaluated; please qualify the claim to the supported trigger types (sequential, control transfer, and architectural exceptions).

Circularity Check

1 steps flagged · score 3.0 of 10

The 4.7x coverage headline is measured with DejaVuzz's own taint-coverage objective replayed onto SpecDoctor; the bug findings remain externally validated.

  1. self definitional [Sec. 6.3 Coverage Evaluation / Fig. 7; metric defined in Sec. 4.2.2 Step 2.2]
    "To avoid the impact of simulation performance differences between different RTL simulators, we replay the phase 3 test cases generated by SpecDoctor in our environment to obtain comparable results and use the number of iterations as the x-axis. The y-axis represents the number of taint coverage points defined in §4.2.2. ... With the help of taints, DejaVuzz can guide mutation more effectively, ultimately exploring 4.7× more coverage than SpecDoctor."

    The 4.7x ratio is computed with DejaVuzz's own taint-coverage matrix, which is exactly the signal DejaVuzz uses as coverage feedback to guide mutation (§4.2.2). SpecDoctor's phase-3 test cases are replayed under this metric, so the baseline is measured on an objective it never observes or optimizes; SpecDoctor is described as only doing random mutations on cases with different state hashes. The result therefore largely measures how well DejaVuzz matches its own self-defined fitness function, not an independent property such as bug-finding ability.

full rationale

The central vulnerability-discovery claims are externally grounded: the five previously unknown bugs received CVE numbers, and the paper reports maintainer confirmation and fixes, so the main contribution does not reduce to the paper's own definitions. The diffIFT underapproximation is explicitly admitted as a limitation in Sec. 3.3 and Sec. 7 rather than hidden, and the paper describes concrete mitigations (bit-flipping secret pairs and repeated attempts). No load-bearing self-citation chain appears: the Starship SoC generator citation is infrastructure, and cited prior tools are used as baselines or background, not as unverified justification for the central result. The one notable self-referential element is the coverage comparison: the 4.7x improvement uses DejaVuzz's taint coverage matrix as the y-axis while simultaneously using that same matrix as DejaVuzz's mutation objective, with SpecDoctor replayed under that metric. This makes the headline efficiency claim partly circular as an evaluation of general state-of-the-art superiority. The paper partially mitigates this by also reporting direct bug-detection outcomes and by disclaiming that higher coverage does not guarantee more bugs, but the abstract still promotes the 4.7x number as a primary result. Overall the derivation is not forced by definition; the self-referentiality is confined to the coverage-based SOTA claim, warranting a modest score of 3.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

DejaVuzz makes no mathematical derivation; its claims rest on the experimental toolchain. No numerical constants are fitted to data in the traditional sense. The central assumptions are simulation fidelity, correct taint policies, the two-variant differential approximation, manual liveness annotations, and the RoB-based transient window oracle.

assumptions (5)
  • domain assumption RTL simulation with VCS faithfully models microarchitectural behavior.
    All transient window and taint observations are made in simulation; divergence from real silicon would affect both false positives and negatives. Invoked throughout the evaluation.
  • domain assumption The taint propagation policies in Table 1 correctly abstract information flow for word-level RTL cells.
    diffIFT's coverage and oracle depend on these policies being accurate for multiplexers, comparison cells, registers, and memories.
  • ad hoc to paper Two DUT instances with bit-flipped secrets are sufficient to approximate precise IFT.
    Acknowledged as an under-approximation in Sec. 3.3; false negatives occur when secret pairs coincide on control signals.
  • domain assumption Manual liveness annotations correctly bind state registers to taint registers.
    Phase 3 filters tainted sinks based on these annotations; incorrect annotations misclassify leakages, as discussed in Sec. 4.3.2 and Sec. 7.
  • domain assumption Transient windows are detected by comparing enqueued vs committed instructions in the RoB.
    Used in Phase 1 and Phase 2; Sec. 6.3 reports an invalid test case that executed the transient window during training, indicating the oracle can misclassify.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking assisted Processor Fuzzing." pith.science (2026). https://pith.science/paper/5PQPPZGL

@misc{pith2026250420934,
  author       = {Pith},
  title        = {Pith review of: DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking assisted Processor Fuzzing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5PQPPZGL}},
  note         = {Machine review of arXiv:2504.20934}
}
read the original abstract

Transient execution vulnerabilities have emerged as a critical threat to modern processors. Hardware fuzzing testing techniques have recently shown promising results in discovering transient execution bugs in large-scale out-of-order processor designs. However, their poor microarchitectural controllability and observability prevent them from effectively and efficiently detecting transient execution vulnerabilities. This paper proposes DejaVuzz, a novel pre-silicon stage processor transient execution bug fuzzer. DejaVuzz utilizes two innovative operating primitives: dynamic swappable memory and differential information flow tracking, enabling more effective and efficient transient execution vulnerability detection. The dynamic swappable memory enables the isolation of different instruction streams within the same address space. Leveraging this capability, DejaVuzz generates targeted training for arbitrary transient windows and eliminates ineffective training, enabling efficient triggering of diverse transient windows. The differential information flow tracking aids in observing the propagation of sensitive data across the microarchitecture. Based on taints, DejaVuzz designs the taint coverage matrix to guide mutation and uses taint liveness annotations to identify exploitable leakages. Our evaluation shows that DejaVuzz outperforms the state-of-the-art fuzzer SpecDoctor, triggering more comprehensive transient windows with lower training overhead and achieving a 4.7x coverage improvement. And DejaVuzz also mitigates control flow over-tainting with acceptable overhead and identifies 5 previously undiscovered transient execution vulnerabilities (with 6 CVEs assigned) on BOOM and XiangShan.

Figures

Figures reproduced from arXiv: 2504.20934 by the authors.

Figure 1
Figure 1. Training and transient execution sections of Spectre-V1, Spectre-V2 and Spectre-RSB. The secret decod￾ing step ○4 is omitted. 5 previously unknown transient execution vulnerabilities, all of which are assigned CVE numbers. To facilitate the community and future research, we pub￾lish the source code and experiments of DejaVuzz at https: //github.com/sycuricon/DejaVuzz. 2 Background 2.1 Transient Execution Vulnerabili… view at source ↗
Figure 3
Figure 3. Assuming the branch instruction at 0x1010 can trigger transient windows at different addresses by using different branch targets L?, only transient windows that do not conflict with training instructions can be exploited. Third, the fuzzer analyzes the microarchitecture to deter￾mine if any bug exists. Unlike the functional bugs that can be detected using co-simulation [19, 53], transient execution vulnerabilities r… view at source ↗
Figure 4
Figure 4. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: DejaVuzz fuzzing workflow for finding transient execution vulnerabilities, taking Spectre-RSB for example. 4.1.2 Step 1.2: Trigger Optimization. After generating the trigger training packets, DejaVuzz evaluates which pack￾ets are helpful in triggering transient windows…
Figure 7
Figure 7. Figure 7: Taint coverage for 5 trials over 20,000 iterations. Coverage Evaluation. Next, we evaluate the efficiency of microarchitecture exploration [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 6
Figure 6. Figure 6: Taints during executing each test case. The dotted vertical line represents the start of the transient execution. the simulation speed is severely degraded. By eliminating control taints caused by identical control signals, diffIFT ef￾fectively mitigates control flow o…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 52 canonical work pages

  1. [1]

    Not all data are created equal: Data and pointer prioritization for scalable protection against{Data- Oriented} attacks

    Salman Ahmed, Hans Liljestrand, Hani Jamjoom, Matthew Hicks, N Asokan, and Danfeng Daphne Yao. Not all data are created equal: Data and pointer prioritization for scalable protection against{Data- Oriented} attacks. In 32nd USENIX Security Symposium (USENIX Security 23), pages 1433–1450, 2023

    work page 2023

  2. [2]

    Register transfer level information flow tracking for provably secure hardware design

    Armaiti Ardeshiricham, Wei Hu, Joshua Marxen, and Ryan Kastner. Register transfer level information flow tracking for provably secure hardware design. In Design, Automation & Test in Europe Conference & Exhibition (DATE), 2017, pages 1691–1696. IEEE, 2017

    work page 2017

  3. [3]

    Branch history injection: On the effectiveness of hardware mitigations against Cross-Privilege spectre-v2 attacks

    Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cris- tiano Giuffrida. Branch history injection: On the effectiveness of hardware mitigations against Cross-Privilege spectre-v2 attacks. In 31st USENIX Security Symposium (USENIX Security 22) , pages 971–988, Boston, MA, August 2022. USENIX Association

    work page 2022

  4. [4]

    Fallout: Leaking data on meltdown-resistant cpus

    Claudio Canella, Daniel Genkin, Lukas Giner, Daniel Gruss, Moritz Lipp, Marina Minkin, Daniel Moghimi, Frank Piessens, Michael Schwarz, Berk Sunar, Jo Van Bulck, and Yuval Yarom. Fallout: Leaking data on meltdown-resistant cpus. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , pages 769–784, 2019

    work page 2019

  5. [5]

    {HyPFuzz}:{Formal-Assisted} processor fuzzing

    Chen Chen, Rahul Kande, Nathan Nguyen, Flemming Andersen, Aakash Tyagi, Ahmad-Reza Sadeghi, and Jeyavijayan Rajendran. {HyPFuzz}:{Formal-Assisted} processor fuzzing. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 1361–1378, 2023

    work page 2023

  6. [6]

    Ieee standard vhdl language reference manual

    Design Automation Standards Committee et al. Ieee standard vhdl language reference manual. IEEE Std 1076-2008 (Revision of IEEE Std 1076-2002), pages 1–640, 2009

    work page 2008

  7. [7]

    N-variant systems: A secretless framework for security through di- versity

    Benjamin Cox, David Evans, Adrian Filipi, Jonathan Rowanhill, Wei Hu, Jack Davidson, John Knight, Anh Nguyen-Tuong, and Jason Hiser. N-variant systems: A secretless framework for security through di- versity. In USENIX Security Symposium, volume 114, page 114, 2006

    work page 2006

  8. [8]

    Rapid prototyping for microarchitectural attacks

    Catherine Easdon, Michael Schwarz, Martin Schwarzl, and Daniel Gruss. Rapid prototyping for microarchitectural attacks. In 31st USENIX Security Symposium (USENIX Security 22) , pages 3861–3877, 2022

    work page 2022

Show all 57 references
  1. [9]

    An exhaustive approach to detecting transient execution side channels in rtl designs of processors

    Mohammad Rahmani Fadiheh, Alex Wezel, Johannes Müller, Jörg Bormann, Sayak Ray, Jason M Fung, Subhasish Mitra, Dominik Stoffel, and Wolfgang Kunz. An exhaustive approach to detecting transient execution side channels in rtl designs of processors. IEEE Transactions on Computers...

    2022

  2. [10]

    Spectrerewind: Leak- ing secrets to past instructions

    Jacob Fustos, Michael Bechtel, and Heechul Yun. Spectrerewind: Leak- ing secrets to past instructions. InProceedings of the 4th ACM Workshop on Attacks and Solutions in Hardware Security , pages 117–126, 2020

    2020

  3. [11]

    Teesec: Pre-silicon vulnerability discovery for trusted ex- ecution environments

    Moein Ghaniyoun, Kristin Barber, Yuan Xiao, Yinqian Zhang, and Radu Teodorescu. Teesec: Pre-silicon vulnerability discovery for trusted ex- ecution environments. In Proceedings of the 50th Annual International Symposium on Computer Architecture, pages 1–15, 2023

    2023

  4. [12]

    Introspectre: A pre-silicon framework for discovery and analysis of transient execution vulnerabilities

    Moein Ghaniyoun, Kristin Barber, Yinqian Zhang, and Radu Teodor- escu. Introspectre: A pre-silicon framework for discovery and analysis of transient execution vulnerabilities. In 2021 ACM/IEEE 48th An- nual International Symposium on Computer Architecture (ISCA) , pages 874–88...

    2021

  5. [13]

    Hardware- software contracts for secure speculation

    Marco Guarnieri, Boris Köpf, Jan Reineke, and Pepe Vila. Hardware- software contracts for secure speculation. In 2021 IEEE Symposium on Security and Privacy (SP) , pages 1868–1883. IEEE, 2021

    2021

  6. [14]

    Speculation at fault: Modeling and testing microar- chitectural leakage of{CPU} exceptions

    Jana Hofmann, Emanuele Vannacci, Cédric Fournet, Boris Köpf, and Oleksii Oleksenko. Speculation at fault: Modeling and testing microar- chitectural leakage of{CPU} exceptions. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 7143–7160, 2023

    2023

  7. [15]

    Hardware infor- mation flow tracking

    Wei Hu, Armaiti Ardeshiricham, and Ryan Kastner. Hardware infor- mation flow tracking. ACM Computing Surveys (CSUR) , 54(4):1–39, 2021

    2021

  8. [16]

    Theoretical fundamentals of gate level information flow tracking

    Wei Hu, Jason Oberg, Ali Irturk, Mohit Tiwari, Timothy Sherwood, Dejun Mu, and Ryan Kastner. Theoretical fundamentals of gate level information flow tracking. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , 30(8):1128–1140, 2011

    2011

  9. [17]

    On the complexity of generating gate level information flow tracking logic.IEEE Transactions on Information Forensics and Security, 7(3):1067–1080, 2012

    Wei Hu, Jason Oberg, Ali Irturk, Mohit Tiwari, Timothy Sherwood, Dejun Mu, and Ryan Kastner. On the complexity of generating gate level information flow tracking logic.IEEE Transactions on Information Forensics and Security, 7(3):1067–1080, 2012

    2012

  10. [18]

    Spec- doctor: Differential fuzz testing to find transient execution vulnerabil- ities

    Jaewon Hur, Suhwan Song, Sunwoo Kim, and Byoungyoung Lee. Spec- doctor: Differential fuzz testing to find transient execution vulnerabil- ities. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 1473–1487, 2022

    2022

  11. [19]

    Difuzzrtl: Differential fuzz testing to find cpu bugs

    Jaewon Hur, Suhwan Song, Dongup Kwon, Eunjin Baek, Jangwoo Kim, and Byoungyoung Lee. Difuzzrtl: Differential fuzz testing to find cpu bugs. In 2021 IEEE Symposium on Security and Privacy (SP) , pages 1286–1303. IEEE, 2021

    2021

  12. [20]

    {TheHuzz}: Instruction fuzzing of processors using {Golden- Reference} models for finding {Software-Exploitable} vulnerabili- ties

    Rahul Kande, Addison Crump, Garrett Persyn, Patrick Jauernig, Ahmad-Reza Sadeghi, Aakash Tyagi, and Jeyavijayan Rajendran. {TheHuzz}: Instruction fuzzing of processors using {Golden- Reference} models for finding {Software-Exploitable} vulnerabili- ties. In 31st USENIX Securit...

    2022

  13. [21]

    Spectre attacks: Exploit- ing speculative execution

    Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, and Yuval Yarom. Spectre attacks: Exploit- ing speculative execution. Communications of the ACM , 63(7):93–101, 2020

    2020

  14. [22]

    Spectre returns! speculation attacks using the return stack buffer

    Esmaeil Mohammadian Koruyeh, Khaled N Khasawneh, Chengyu Song, and Nael Abu-Ghazaleh. Spectre returns! speculation attacks using the return stack buffer. In 12th USENIX Workshop on Offensive Technologies (WOOT 18), 2018

    2018

  15. [23]

    Rfuzz: Coverage-directed fuzz testing of rtl on fpgas

    Kevin Laeufer, Jack Koenig, Donggyu Kim, Jonathan Bachrach, and Koushik Sen. Rfuzz: Coverage-directed fuzz testing of rtl on fpgas. In 2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), pages 1–8. IEEE, 2018

    2018

  16. [24]

    Caisson: a hardware description language for secure information flow.ACM Sigplan Notices, 46(6):109–120, 2011

    Xun Li, Mohit Tiwari, Jason K Oberg, Vineeth Kashyap, Frederic T Chong, Timothy Sherwood, and Ben Hardekopf. Caisson: a hardware description language for secure information flow.ACM Sigplan Notices, 46(6):109–120, 2011. 14

    2011

  17. [25]

    Meltdown: Reading kernel memory from user space

    Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, Mike Hamburg, and Raoul Strackx. Meltdown: Reading kernel memory from user space. Communications of the ACM, 63(6):46–56, 2020

    2020

  18. [26]

    ret2spec: Speculative ex- ecution using return stack buffers

    Giorgi Maisuradze and Christian Rossow. ret2spec: Speculative ex- ecution using return stack buffers. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , pages 2109–2122, 2018

    2018

  19. [27]

    Medusa: Microarchitectural data leakage via automated attack synthe- sis

    Daniel Moghimi, Moritz Lipp, Berk Sunar, and Michael Schwarz. Medusa: Microarchitectural data leakage via automated attack synthe- sis. In 29th USENIX Security Symposium (USENIX Security 20) , pages 1427–1444, 2020

    2020

  20. [28]

    Revizor: Testing black-box cpus against speculation contracts

    Oleksii Oleksenko, Christof Fetzer, Boris Köpf, and Mark Silberstein. Revizor: Testing black-box cpus against speculation contracts. In Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems , pages 226–239, 2022

    2022

  21. [29]

    Hide and seek with spectres: Efficient discovery of speculative infor- mation leaks with random testing

    Oleksii Oleksenko, Marco Guarnieri, Boris Köpf, and Mark Silberstein. Hide and seek with spectres: Efficient discovery of speculative infor- mation leaks with random testing. In2023 IEEE Symposium on Security and Privacy (SP), pages 1737–1752. IEEE, 2023

    2023

  22. [30]

    In 29th USENIX Security Symposium (USENIX Security 20) , pages 1481– 1498, 2020

    Oleksii Oleksenko, Bohdan Trach, Mark Silberstein, and Christof Fet- zer.{SpecFuzz}: Bringing spectre-type vulnerabilities to the surface. In 29th USENIX Security Symposium (USENIX Security 20) , pages 1481– 1498, 2020

    2020

  23. [31]

    kmvx: Detecting kernel in- formation leaks with multi-variant execution

    Sebastian Österlund, Koen Koning, Pierre Olivier, Antonio Barbalace, Herbert Bos, and Cristiano Giuffrida. kmvx: Detecting kernel in- formation leaks with multi-variant execution. In Proceedings of the Twenty-Fourth International Conference on Architectural Support for Program...

    2019

  24. [32]

    Dynpta: Combining static and dynamic analysis for practi- cal selective data protection

    Tapti Palit, Jarin Firose Moon, Fabian Monrose, and Michalis Poly- chronakis. Dynpta: Combining static and dynamic analysis for practi- cal selective data protection. In 2021 IEEE Symposium on Security and Privacy (SP), pages 1919–1937. IEEE, 2021

    2021

  25. [33]

    Sigfuzz: A framework for discovering microarchitectural timing side channels

    Chathura Rajapaksha, Leila Delshadtehrani, Manuel Egele, and Ajay Joshi. Sigfuzz: A framework for discovering microarchitectural timing side channels. In 2023 Design, Automation & Test in Europe Conference & Exhibition (DATE), pages 1–6. IEEE, 2023

    2023

  26. [34]

    Or- chestra: intrusion detection using parallel execution and monitoring of program variants in user-space

    Babak Salamat, Todd Jackson, Andreas Gal, and Michael Franz. Or- chestra: intrusion detection using parallel execution and monitoring of program variants in user-space. In Proceedings of the 4th ACM European conference on Computer systems , pages 33–46, 2009

    2009

  27. [35]

    All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask)

    Edward J Schwartz, Thanassis Avgerinos, and David Brumley. All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask). In 2010 IEEE symposium on Security and privacy , pages 317–331. IEEE, 2010

    2010

  28. [36]

    Cascade: Cpu fuzzing via intricate program generation

    Flavien Solt, Katharina Ceesay-Seitz, and Kaveh Razavi. Cascade: Cpu fuzzing via intricate program generation. In Proc. 33rd USENIX Secur. Symp, pages 1–18, 2024

    2024

  29. [37]

    {CellIFT}: Leveraging cells for scalable and precise dynamic information flow tracking in {RTL}

    Flavien Solt, Ben Gras, and Kaveh Razavi. {CellIFT}: Leveraging cells for scalable and precise dynamic information flow tracking in {RTL}. In 31st USENIX Security Symposium (USENIX Security 22) , pages 2549–2566, 2022

    2022

  30. [38]

    Starship SoC Generator

    Sycuricon. Starship SoC Generator. https://github.com/sycuricon/ starship

  31. [39]

    Rtl verification for secure speculation using contract shadow logic

    Qinhan Tan, Yuheng Yang, Thomas Bourgeat, Sharad Malik, and Mengjia Yan. Rtl verification for secure speculation using contract shadow logic. arXiv preprint arXiv:2407.12232, 2024

    2024 arXiv

  32. [40]

    The Verilog® hardware description language

    Donald Thomas and Philip Moorby. The Verilog® hardware description language. Springer Science & Business Media, 2008

    2008

  33. [41]

    Crafting a usable microkernel, processor, and i/o system with strict and provable information flow security

    Mohit Tiwari, Jason K Oberg, Xun Li, Jonathan Valamehr, Timothy Levin, Ben Hardekopf, Ryan Kastner, Frederic T Chong, and Timothy Sherwood. Crafting a usable microkernel, processor, and i/o system with strict and provable information flow security. ACM SIGARCH Computer Archite...

    2011

  34. [42]

    Complete information flow tracking from the gates up

    Mohit Tiwari, Hassan MG Wassel, Bita Mazloom, Shashidhar Mysore, Frederic T Chong, and Timothy Sherwood. Complete information flow tracking from the gates up. InProceedings of the 14th international conference on Architectural support for programming languages and operating sy...

    2009

  35. [43]

    Checkmate: Automated synthesis of hardware exploits and security litmus tests

    Caroline Trippel, Daniel Lustig, and Margaret Martonosi. Checkmate: Automated synthesis of hardware exploits and security litmus tests. In 2018 51st Annual IEEE/ACM International Symposium on Microar- chitecture (MICRO), pages 947–960. IEEE, 2018

    2018

  36. [44]

    Inception: Expos- ing new attack surfaces with training in transient execution

    Daniël Trujillo, Johannes Wikner, and Kaveh Razavi. Inception: Expos- ing new attack surfaces with training in transient execution. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 7303–7320, 2023

    2023

  37. [45]

    Wenisch, Yu- val Yarom, and Raoul Strackx

    Jo Van Bulck, Marina Minkin, Ofir Weisse, Daniel Genkin, Baris Kasikci, Frank Piessens, Mark Silberstein, Thomas F. Wenisch, Yu- val Yarom, and Raoul Strackx. Foreshadow: Extracting the keys to the Intel SGX kingdom with transient out-of-order execution. In Pro- ceedings of th...

    2018

  38. [46]

    RIDL: Rogue in-flight data load

    Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Giorgi Maisuradze, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida. RIDL: Rogue in-flight data load. In S&P, May 2019

    2019

  39. [47]

    Specification and verification of side-channel secu- rity for open-source processors via leakage contracts

    Zilong Wang, Gideon Mohr, Klaus von Gleissenthall, Jan Reineke, and Marco Guarnieri. Specification and verification of side-channel secu- rity for open-source processors via leakage contracts. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Secu...

    2023

  40. [48]

    Nda: Preventing speculative execution attacks at their source

    Ofir Weisse, Ian Neal, Kevin Loughlin, Thomas F Wenisch, and Baris Kasikci. Nda: Preventing speculative execution attacks at their source. In Proceedings of the 52nd Annual IEEE/ACM International Symposium on Microarchitecture, pages 572–586, 2019

    2019

  41. [49]

    Inspectre gadget: Inspecting the residual attack surface of cross-privilege spectre v2

    Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida. Inspectre gadget: Inspecting the residual attack surface of cross-privilege spectre v2. In USENIX Security, 2024

    2024

  42. [50]

    Phantom: Ex- ploiting decoder-detectable mispredictions

    Johannes Wikner, Daniël Trujillo, and Kaveh Razavi. Phantom: Ex- ploiting decoder-detectable mispredictions. In Proceedings of the 56th Annual IEEE/ACM International Symposium on Microarchitecture, pages 49–61, 2023

    2023

  43. [51]

    SPEECHMINER: A framework for investigating and measuring speculative execution vulnerabilities

    Yuan Xiao, Yinqian Zhang, and Radu Teodorescu. SPEECHMINER: A framework for investigating and measuring speculative execution vulnerabilities. In 27th Annual Network and Distributed System Security Symposium, 2020

    2020

  44. [52]

    Regvault: hardware assisted selective data randomization for operating system kernels

    Jinyan Xu, Haoran Lin, Ziqi Yuan, Wenbo Shen, Yajin Zhou, Rui Chang, Lei Wu, and Kui Ren. Regvault: hardware assisted selective data randomization for operating system kernels. In Proceedings of the 59th ACM/IEEE Design Automation Conference, pages 715–720, 2022

    2022

  45. [53]

    In 32nd USENIX Security Symposium (USENIX Security 23) , pages 1307–1324, 2023

    Jinyan Xu, Yiyuan Liu, Sirui He, Haoran Lin, Yajin Zhou, and Cong Wang.{MorFuzz}: Fuzzing processor via runtime instruction morph- ing enhanced synchronizable co-simulation. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 1307–1324, 2023

    2023

  46. [54]

    To- wards Developing High Performance RISC-V Processors Using Agile Methodology

    Yinan Xu, Zihao Yu, Dan Tang, Guokai Chen, Lu Chen, Lingrui Gou, Yue Jin, Qianruo Li, Xin Li, Zuojun Li, Jiawei Lin, Tong Liu, Zhigang Liu, Jiazhan Tan, Huaqiang Wang, Huizhe Wang, Kaifan Wang, Chuanqi Zhang, Fawang Zhang, Linjuan Zhang, Zifei Zhang, Yangyang Zhao, Yaoyang Zho...

    2022

  47. [55]

    Pensieve: Microarchitectural modeling for security evaluation

    Yuheng Yang, Thomas Bourgeat, Stella Lau, and Mengjia Yan. Pensieve: Microarchitectural modeling for security evaluation. In Proceedings of 15 the 50th Annual International Symposium on Computer Architecture , pages 1–15, 2023

    2023

  48. [56]

    ({M) WAIT} for it: Bridging the gap between microarchitectural and archi- tectural side channels

    Ruiyi Zhang, Taehyun Kim, Daniel Weber, and Michael Schwarz. ({M) WAIT} for it: Bridging the gap between microarchitectural and archi- tectural side channels. In 32nd USENIX Security Symposium (USENIX Security 23), pages 7267–7284, 2023

    2023

  49. [57]

    Sonicboom: The 3rd generation berkeley out-of-order machine

    Jerry Zhao, Ben Korpan, Abraham Gonzalez, and Krste Asanovic. Sonicboom: The 3rd generation berkeley out-of-order machine. May 2020. 16

    2020

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.