TL;DR: On August 31, 2026 the RISC-V International Board of Directors formally approved the SPMP (Supervisor Physical Memory Protection) extension after a seven-year technical campaign led by Shanghai Jiao Tong University’s IPADS team — Du Dongdong, Yang Bicheng, Xia Yubin, and Chen Haibo. SPMP is the first ISA extension ever defined end-to-end by a Chinese team since RISC-V was founded in 2015. It adds a compact hardware register file that lets a machine-mode (M-mode) hypervisor enforce physical-address range checks on supervisor accesses with a single-cycle lookup, replacing the page-table walks that dominate runtime cost in TEE / confidential-computing flows on resource-constrained RISC-V SoCs. SPMP is shipping in the XiangShan open-source core and is deployed in commercial silicon from Nuclei and other vendors.
Table of Contents
Why a Memory-Protection Extension for M-Mode?
On every mainstream architecture, the operating system relies on page tables to translate virtual addresses into physical addresses and to gate memory access permissions. The IPADS team uses a vivid analogy for their pitch to the RISC-V community: a campus with a multi-tier access index.
“A multi-tier index is fine for a sprawling campus where anyone might want to visit any building. But many RISC-V targets — AI chips, automotive MCUs, smart-terminal SoCs, IIoT controllers — are more like a fixed-layout enclosed park. Function regions are pre-assigned, and bolting a multi-tier lookup onto that is using a sledgehammer to crack a nut.”
Page-table walks cost area (TLB + walker state), power (extra memory traffic on misses), and latency (two to four dependent memory accesses on first miss). For chips that already know the address layout at design time — the address map is fixed by the SoC integrator — the page table is redundant.
SPMP takes the opposite approach: keep a small set of physical-address sticky notes in dedicated CSRs, and consult them in one cycle whenever a memory access crosses into M-mode or S-mode.
What problem does this actually solve? Machine-mode firmware and hypervisors today have to either (a) trust S-mode software completely, or (b) emulate page-table enforcement in software, which is slow and inconsistent across implementations. SPMP gives hardware vendors a deterministic, one-cycle enforcement primitive that fits in <1% of a small RISC-V core’s area budget.
The SPMP Hardware Model
SPMP introduces a new class of CSR — the SPMPADDR entries — that record physical-address regions. Each entry is a base-and-length pair (encoded as address-aligned start plus size or as start+end depending on mode) plus permission flags:
- R / W / X — read / write / execute permissions
- L (Locked) — once set, the entry cannot be modified until the next system reset; this is the TEE anchor
- M-mode enforcement selector — controls whether M-mode loads/stores are checked against the entry
- S-mode enforcement selector — parallel control for S-mode accesses
A reference configuration supports up to 8 or 16 SPMP entries depending on profile, with an extension hook for vendor-defined wider configurations. Entries are checked in parallel against the target physical address, and the first match wins; if no entry matches, access falls through to the default policy controlled by mseccfg.SPMPCFG.
Locked entries are the security anchor. A hypervisor can lock a region’s SPMP entry after programming it. Once locked, the entry cannot be softened — not by an untrusted S-mode kernel, not by a later bootloader stage, not by a DMA engine. This is the hardware root of trust for lightweight TEEs.
Encoding & CSR Surface
SPMP occupies three new CSRs in the machine-mode privileged spec:
- spmpcfg0…spmpcfgN — configuration / permission / lock bits for each entry (WARL)
- spmpaddr0…spmpaddrN — the address for each entry (in NAPOT or NA4 mode)
- seccfg.SPMPCFG — top-level enforcement enable plus global defaults
Two addressing modes are supported to give integrators flexibility:
| Mode | Encoding | Granularity | Best For |
|---|---|---|---|
| NA4 | Naturally-aligned 4-byte | 4 B | Register-level isolation, single variables |
| NAPOT | Naturally-aligned power-of-two | 8 B – 4 GB | Buffer / mailbox / firmware-region isolation |
The spmpaddr register holds bits [paddrhi : paddrlo] shifted by one bit to make room for the mode field, mirroring the encoding style used by the original PMP. This means that vendor tooling that already understands PMP can be extended with minimal effort.
Tooling note: The IPADS team worked with the GNU and LLVM RISC-V backends to add SPMP-aware intrinsics (__riscv_spmp_set, __riscv_spmp_lock) and a -march=rv64imac_spmp target flag. Binutils and GDB gained read/write support in the 2.42 and 16.x release lines.
SPMP vs PMP vs Page Tables
RISC-V already shipped the PMP (Physical Memory Protection) unit for many years. PMP applies only to M-mode accesses; SPMP extends that model to S-mode accesses while still respecting M-mode, and adds the lock primitive as a first-class concept.
| Feature | PMP (legacy) | SPMP (new) | Page Tables (Sv32 / Sv39 / Sv57) |
|---|---|---|---|
| Lookup cost | 1 cycle | 1 cycle | 2–4 cycles on miss (TLB refill) |
| Hardware state | ≤64 entries, 4–8 B each | 8 / 16 entries, < 1 KB total | TLB + walker: 4–16 KB |
| Virtual-address aware | No (physical) | No (physical) | Yes |
| Covers S-mode? | No | Yes | Yes (via PTW) |
| Lockable per entry | Yes | Yes, with finer-grained M/S split | N/A |
| Best fit | M-mode firmware isolation | TEE / hypervisor / shared-buffer isolation on edge chips | General-purpose OS, virtual memory |
The crucial difference: page tables solve the open-world problem where any process may live at any virtual address. SPMP solves the closed-world problem where the address map is known at integration time and isolation is the only thing that matters.
Workloads That Benefit
SPMP is purpose-built for the workloads that have made RISC-V dominant in AI chips, IoT MCUs, and IIoT controllers:
- Edge AI SoCs — protect model weights from a compromised inference engine; lock the TEE anchor that decrypts weights at boot.
- Automotive MCUs — ASIL-D-grade isolation of safety firmware from non-safety firmware without paying for a full MMU.
- Smart-terminal and wearable SoCs — sandbox secure elements (payment tokens, biometric templates) on a chip that has no MMU.
- Industrial IoT controllers — isolate PLC firmware updates from runtime control code without a hypervisor.
- Confidential computing — lightweight TEE attestation without paying for hardware page-table walks on every transition.
Seven Years from Sketch to BoD Approval
The SPMP journey began in earnest on September 23, 2019, when the IPADS team submitted the initial architecture draft to the RISC-V community. The path from sketch to ratification ran through:
- 2019 Q4 – 2021: Architecture design, formal model in Sail, and the first XiangShan integration. Yang Bicheng served as the SPMP working group chair throughout.
- 2022 – 2024: Multiple public review cycles, addressing community concerns about CSR-space consumption, lock-state recovery on debug, and compatibility with existing PMP users.
- 2025: Final architecture freeze; cross-implementation verification on FPGA prototypes; toolchain patches merged into GNU and LLVM.
- 2026 Q3 (August 31): Formal Board of Directors approval — the BoD vote came after the TSC technical freeze and the Architecture Review Committee’s final sign-off.
Why this matters symbolically: Bao Yangang (包云岗), Vice Chairman of the RISC-V International Board and Deputy Director of the CAS Institute of Computing Technology, called SPMP a “first zero-to-one moment for Chinese teams in RISC-V ISA extension authorship. It not only materially strengthens RISC-V’s security architecture — it sets a vivid example for domestic institutions to engage deeply with international standard setting.”
Deployment Today: XiangShan, Nuclei, Rivos
SPMP is not a paper standard. Three independent silicon-and-IP paths have already shipped:
- XiangShan (香山) — the open-source high-performance RISC-V core from CAS Institute of Computing Technology. SPMP is the default isolation primitive for the secure-boot and TEE flows on Kunming Lake and Yanqi Lake revisions.
- Nuclei (芯来科技) — the leading domestic commercial RISC-V IP vendor. SPMP is exposed in the N-series UX10 / UX10B profiles targeting AIoT and IIoT SoCs.
- Other adopters — several commercial SoC vendors have integrated SPMP into their 2025–2026 product flows; FPGA emulation targets are public on IPADS’ GitLab.
How to use SPMP today
If you have a RISC-V toolchain built after mid-2026, SPMP is available out of the box:
For bare-metal environments without an OS, IPADS publishes a reference spmp_init.S in the XiangShan repository that programs the entries during boot and then locks them before handing off to S-mode.