Novel Microarchitectural Side-Channel Attacks on Open-Source RISC-V Cores

We present a simulation-to-silicon security characterization of microarchitectural side channels on open-source RISC-V cores. Twenty-three attack classes are measured across a six-core corpus that spans the design space from simple in-order pipelines (Rocket, VexiiRiscv) through a single-issue in-order core (CVA6) to a three-point out-of-order width sweep (BOOM Medium/Large/Mega), together with two dual-hart systems-on-chip for cross-hart channels. Six of the classes are novel microarchitectural primitives rooted in RISC-V-specific features that lack x86/ARM counterparts: speculative and enforcement-timing leakage through Physical Memory Protection (PMP), PMP write-any-read-legal (WARL) fingerprinting, page-table-walker/PMP fault-cause fingerprinting, and load-reserved/store-conditional (LR/SC) reservation lifetime and granularity channels, while the remainder are the first systematic cross-privilege and cross-core RISC-V instantiations of coherence, predictor, translation, and functional-unit channels. Every channel is quantified with Welch’s Test Vector Leakage Assessment (TVLA) and paired with a proof of concept whose success rate is reported with Wilson 95% confidence intervals and explicit sample counts. Critically, we move the evaluation beyond deterministic register-transfer-level (RTL) simulation to real silicon: on a Xilinx Zedboard (xc7z020), we capture eighty-four live unit-level channel measurements and run an eleven-experiment side-channel battery on a whole RISC-V core, with a synthesis and dynamic-power model for every attack unit. Eight mitigations are implemented at the RTL and firmware levels; each is evaluated for channel closure (TVLA), portability across cores, robustness to an adaptive attacker, amortized software overhead on a standard workload suite, and, for the first time in this setting, measured silicon area and dynamic-power cost. Six of the eight mitigations cost at most 0.8% look-up-table area, and all eight change dynamic power by under two milliwatts. We further contribute a formal threat-model taxonomy, a statistical-validity treatment of the TVLA methodology, and a design-recommendation checklist for RISC-V implementers.