Projects on Giovanni Nicosia

Reproducible TRNG Integration in a RISC-V SoC

Fri, 27 Mar 2026 00:00:00 +0200

This master’s thesis was developed in the context of the VE-HEP (Versatile Hardware Execution Platform) project, a research initiative aimed at building a flexible and secure RISC-V-based SoC. The core contribution is the integration of a physical True Random Number Generator (TRNG) — designed following the OpenTRNG open-source framework — directly into the SoC’s peripheral bus.

The TRNG IP is exposed to the processor via an APB3 wrapper written in SpinalHDL, with a well-defined register map that allows firmware to configure the entropy source, read raw samples, and monitor health-test status. A lightweight C firmware driver was implemented to exercise the peripheral and validated end-to-end through functional simulation. The hardware description was also cross-verified at the Verilog netlist level to ensure correctness after synthesis.

ESCAPE Seminars — QR Attendance System

Fri, 06 Mar 2026 00:00:00 +0100

The ESCAPE Seminars attendance system was built to automate registration and presence tracking for a seminar series at Politecnico di Torino. Attendees authenticate using their institutional PoliTO credentials through a SAML2 flow backed by a Keycloak Identity Provider, ensuring that only enrolled students can register — without storing passwords in the application.

The backend is a Django REST API connected to a PostgreSQL database. Upon successful authentication, the system generates a unique QR code for each session and user pair. Organizers can scan codes in real time via a dedicated endpoint, and an admin dashboard provides attendance summaries, CSV exports, and per-seminar statistics.

eBPF Vulnerability Testing Suite

Thu, 25 Sep 2025 00:00:00 +0200

This project is a structured testing suite that demonstrates real-world security vulnerabilities in eBPF and XDP kernel programs, mapping each finding to coding rules defined in ISO/IEC TS 17961 (C Secure Coding Rules). The suite covers issues such as out-of-bounds memory access, uninitialized map values, integer overflows in packet offset calculations, and verifier bypass patterns.

Each test case ships as a pair of intentionally vulnerable and patched C programs, loadable into the kernel via bpftool. The test environment is isolated inside a KVM/QEMU virtual machine to prevent any risk of destabilising the host kernel during verifier stress tests and deliberately crashing probes.

PoliTO Students — Open Resources for Students

Wed, 18 Jun 2025 00:00:00 +0200

PoliTO Students is a GitLab organization that collects and publishes open-source lecture notes, exercise sheets, and study guides for courses at Politecnico di Torino. All documents are written in LaTeX or Typst and built automatically on every push via GitLab CI/CD pipelines, with the resulting PDF artifacts published to GitLab Pages and made freely available to all students.

Each document repository packages its own build toolchain as a Nix derivation, ensuring that the exact same compiler versions and font sets are used both locally and in CI. Contributors can enter a ready-to-use shell with nix develop or devenv shell without installing anything system-wide, and the CI runners consume the same derivation for byte-for-byte reproducible PDFs.

NixOS System Configuration

Wed, 25 Oct 2023 00:00:00 +0200

This repository is a Nix Flake that manages the complete, declarative configuration of all my personal machines — development workstations and a homelab server — from a single, version-controlled source of truth. Each host is defined as a NixOS configuration module that composes shared profiles (desktop environment, development tools, security hardening) with host-specific settings, making it straightforward to keep multiple machines consistent or diverge them intentionally.

The homelab server runs a set of self-hosted services deployed as NixOS containers, isolated from each other and from the host. Networking between containers and to the outside is managed through a VPN (WireGuard), with firewall rules derived directly from the NixOS configuration. Secrets such as API keys, database passwords, and VPN private keys are encrypted at rest using SOPS (Secrets OPerationS) and decrypted at activation time, so no plaintext secrets ever land in the Nix store.