Researchers expose Spectre flaws in commercial out-of-order RISC-V processors

Academic teams from Belgium and Germany have proven that commercial out-of-order RISC-V CPUs, specifically the SiFive P550 and T-Head Xuantie C910/C920, succumb to the full range of Spectre attacks, including PHT, BTB, RSB and STL variants. Their experiments leaked Linux kernel memory at a rate of 338 bytes per second on the Xuantie C910. In contrast, in-order designs like SiFive U74 and Xuantie C906 showed no susceptibility.

The authors argue that RISC-V lacks the introspection interfaces needed for effective mitigation and that the platform's diversity prevents a one-size-fits-all fix. After responsibly reporting the flaws in December, three patches entered mainline Linux while two more await review, and SiFive and T-Head have begun addressing the findings. The study underscores the need for dedicated architectural safeguards rather than merely porting existing mitigations from older architectures.