I’m studying this paper on different side-channel attacks on Risc-V cores: https://misc0110.net/files/riscv_attacks_sp23.pdf

The authors introduce a new attack called Flush+Fault which works around the limitation that makes Flush+Reload impossible, no shared I-Cache and D-Cache (harvard architecture).
So if I understand correctly, the “reload” step is not possible on that core, which is why they do Fault instead.

Further down, they successfully execute the “Evict+Reload” attack on the same core. So my question is: Why does the Reload step work for “Evict+Reload”, when it was impossible for Flush+Reload?