Microarchitectural Espionage: FPGA-Based Security Analysis of Branch Prediction in RISC-V Out-of-Order Cores

Overview & Synopsis

Modern processor microarchitectural optimizations, while enhancing performance, inadvertently introduce side channels that can leak sensitive information through timing variations. This paper presents an FPGA-based security testbed for studying branch predictor side-channel vulnerabilities in open-source RISC-V out-of-order cores. We demonstrate a configurable platform built on the Berkeley Out-of-Order Machine (BOOM) core, adapted for resource-constrained FPGA deployment with customizable branch predictor configurations. Through baremetal execution and cycle-accurate timing measurements, we implement and evaluate three classes of timing attacks: Conditional Branch Prediction Attacks (CBPA), Indirect Branch Prediction Attacks (IBPA), and a practical smart-lock application attack. Our results show that simplified one-level predictors exhibit deterministic timing separations of 9 to 17 cycles, enabling perfect secret recovery with 100% accuracy for 16-bit secrets within 500 measurement rounds. We further demonstrate practical attack scenarios, including the extraction of a randomly-generated 4-digit smart-lock code, and evaluate the impact of branch predictor complexity on attack feasibility. This work provides an open-source framework for reproducible microarchitectural security research on RISC-V platforms, enabling evaluation of both attacks and countermeasures.