Toward Secure RISC-V Microarchitecture: Vulnerability Classes and Defenses

RISC-V is an open instruction set architecture that enables a wide range of processor implementations across academia and industry. While its architectural simplicity and extensibility support rapid innovation, RISC-V processors exhibit microarchitectural behaviors that give rise to side-channel and transient-execution vulnerabilities similar to those observed in other high-performance CPU architectures. This paper presents a structured taxonomy of microarchitectural vulnerabilities in RISC-V processors, organized into five classes based on the affected hardware components and dominant sources of leakage: cache-based channels, speculative and transient execution, branch prediction structures, memory and address translation subsystems, and observation through performance monitoring mechanisms. For each class, we examine representative vulnerabilities and documented attacks on existing RISC-V implementations and research prototypes, and analyze the underlying microarchitectural mechanisms that enable information leakage. We further study countermeasures applicable to each vulnerability class, covering both RISC-V-specific proposals and adaptations of mechanisms previously developed for x86 and ARM platforms. The surveyed defenses are systematically analyzed in terms of security coverage, performance overhead, and implementation complexity, highlighting both their strengths and practical limitations. The resulting taxonomy and comparative analysis aim to support RISC-V architects, system designers, and software developers in reasoning about microarchitectural risks and mitigation trade-offs during system design.