Spectre Vulnerabilities in SiFive P550 and T-Head Xuantie C910/C920 RISC-V Processors
Research from CISPA and KU Leuven demonstrates that high-performance commercial RISC-V processors, specifically the SiFive P550 and T-Head Xuantie C910/C920, are susceptible to speculative execution side-channel attacks. By exploiting vulnerabilities in the Branch Predictor Unit (BPU) and Reorder Buffer (ROB), attackers can execute Spectre Variant 1 (Bounds Check Bypass), Variant 2 (Branch Target Injection), and Variant 4 (Speculative Store Bypass). These flaws allow unauthorized data extraction across security boundaries and privilege levels via cache timing analysis. While software mitigations like pipeline flushing and fencing are possible, they introduce significant performance overhead, highlighting a critical need for architectural hardware redesigns in the RISC-V ecosystem.