RISC‐V Microarchitectural Attacks: No Timer, No Problem?

RISC-V processors are increasingly being deployed in cyber-physical, time-sensitive embedded, and reactive systems, making microarchitectural timing side-channel attacks a practical security concern. A commonly proposed countermeasure is to disable access to the high-resolution rdcycle timer under the assumption that practical attacks require precise timing measurements. However, this approach is unsuitable for systems that rely on precise timing for scheduling and deadline enforcement, and it does not remove the underlying secret-dependent microarchitectural state. We demonstrate the limitations of this countermeasure by evaluating four cache and transient-execution attacks, namely Flush+Reload, Flush+Flush, Flush+Fault, and Spectre V1, on a commercial out-of-order RISC-V core, the T-Head C910. We replace rdcycle with three alternative timing sources: a software counter thread, clock_gettime, and perf_event_open. Under background CPU loads ranging from 25% to 100%, with 50 repetitions per configuration, the alternative timing sources achieve up to a 93% average attack success rate across the evaluated settings, showing that the attacks remain effective even under substantial system noise. We further demonstrate complete 128-bit AES key recovery, clear timing separation between page-table-walk and no-walk executions, and a cross-core covert channel that transmits 1,024 bits with zero errors in 49 out of 50 independent runs. We also evaluate index masking and speculation-fence insertion for Spectre V1 and examine L1 instruction-cache and L1 data-cache miss rates as indicators for profiling-based attack detection. These results show that restricting rdcycle alone is insufficient and that effective protection requires layered hardware and software countermeasures.