2026-06-09 –, Poster Island A
Side-channel attacks leveraging microarchitectural features are well-studied on x86 and ARM, but less so on RISC-V. This work implements and evaluates Flush+Reload cache-side-channel attacks on user-space software in a RISC-V system simulated in gem5 full-system mode. We develop both eviction-based and cache-block-invalidate (cbo.inval) probes, establishing an attack methodology for an unprivileged process using the RISC-V cycle counter. Our experiments reveal timing differences between cached and evicted accesses, confirming the existence of exploitable timing channels. While key recovery remains partial, these results demonstrate the feasibility of cache side-channel attacks on RISC-V and validate gem5 as an effective platform for microarchitectural security research.