Research window: Past 24 hours (2026-09-24 05:00 ~ 2026-09-25 05:00, Beijing time). Sources: Hacker News, Google News aggregation (multiple Chinese and English queries, via proxy), Scienmag tech news site, XDA, LinuxGizmos, RISC-V International official website and blog (including patrol of 391 member company websites), openRuyi official news page, and GitHub (push and commit searches across organizations and key repositories including XiangShan/NEMU/GEM5, openRuyi-Project, DAMO XuanTie XUANTIE-RV, ESWIN, Sophgo, SpacemiT spacemit-com/spacemit-robotics, Sipeed, Radxa Linkr, revyos, Espressif, etc.)

Index

  • Today’s Highlights: UPC Research: Using XuanTie C910 and On-Chip Performance Counters to Let RISC-V Chips “Self-Detect” Microarchitectural Attacks, 99% Detection Accuracy (09-24)
  • I. Open-Source Community and Software Ecosystem
    • XiangShan: Two Merges into Kunminghu v3 Default Branch, Vector, TAGE, and Free List Advancing in Parallel Across Multiple Branches (09-24)
    • openRuyi: SPECS Merges expat 2.8.5 Security Update, No New Releases on Official Site (09-24)
    • Open-Source Ecosystem Shorts: felix86 Four Commits, riscv-unified-db and qtrvsim Updates (09-24)
  • II. Product and Ecosystem News
    • Espressif ESP32-S31 Linux Port Gains Momentum: Moving from MCU to SBC Form Factor (09-24)
    • Sophgo BM1688 New Board OrangePi O1 Announced: 16 TOPS TPU Plus RISC-V C906 Coprocessor (09-24)
    • Radxa Linkr v1.5.0 Released: Plugin Center, ZeroTier/EasyTier Network Plugins, and Screenshot OCR (09-24)
  • III. Deep Dive on Domestic Teams
    • SpacemiT: llama.cpp Branch Releases v0.2.0, Standalone ggml-spacemit Backend Debuts (09-24)
    • SpacemiT: model-zoo-vision Three Performance Optimizations, mpp Fixes and RL Toolchain Updates (09-24)
    • Sophgo: Multiple Repo Pushes Within Window, bootloader-riscv Adjusts edk2 Source Directory Convention (09-24)
    • Espressif: esp-idf 14 Merges Within Window, esp-vision Adds Camera Runtime Control (09-24)
    • Sipeed: SLogic Logic Analyzer Software Stack Seven Commits, Driver Migrating to Shared libslogic (09-24)
  • IV. Embodied Intelligence and Robotics Special Chapter
    • SpacemiT spacemit-robotics: LingLong Merges SONIC Motion Tracking Policy, MuJoCo Simulation Fixes (09-24)
    • UC Berkeley Releases IISWC 2026 Tutorial: ML and Robotics Workloads on Heterogeneous RISC-V SoCs (09-24)
  • V. Summary and Trend Observations

Today’s Highlight: UPC Study: Using XuanTie C910 and On-Chip Performance Counters to Make RISC-V Chips “Self-Detect” Microarchitectural Attacks, with 99% Detection Accuracy

Date: 2026-09-24　Sources: Scienmag, “Machine Learning Turns RISC-V Chips Into Their Own Hardware Attack Detectors”, Paper: Pou, Otero, Robledo, Pajuelo & Canal, RISC-V hardware attack detection using on-chip hardware performance counters, Cybersecurity 9(1) Article 222, HARPY-V dataset (CORA Research Data Repository)

On September 24, Scienmag published a report on research by a team at the Universitat Politècnica de Catalunya (UPC) in Spain: the researchers “installed” machine learning detectors into the RISC-V chip’s own hardware performance counters (HPCs), enabling real-time detection of microarchitectural attacks inside the chip. The paper was published in the journal Cybersecurity (9(1), Article 222). The experiments were completed on real commercial silicon — DAMO XuanTie C910 (a 64-bit out-of-order core, RV64GCV) mounted on a Sipeed LicheePi 4A development board running Debian 13; the team built and released the HARPY-V dataset: approximately 64,000 labeled samples, containing 16 types of microarchitectural attacks (Flush+Reload, Flush+Flush, Evict+Reload, Spectre V1/V2/RSB, timing drift, TLB and page-table walk attacks, as well as GhostWrite, among others) and 16 benign programs. The benign set deliberately uses workloads that share hardware structures with the attacks, bringing the classification problem close to real-world difficulty.

Results and engineering details: binary detection (attack/benign) achieved 99% accuracy, while multiclass classification (distinguishing specific attack types) reached about 95%; in a “leave-one-attack-out” zero-day simulation, combinations of random forest with mRMR feature selection and decision tree with RFECV still maintained high detection rates, and “choosing the right counters” was more critical than “stacking more counters.” The team also disclosed two valuable empirical lessons: on the C910, monitoring multiple counters simultaneously with perf causes mutual interference (some readings were amplified by more than 3x), so counters must be collected individually one at a time; and most of the C910’s perf event descriptions are inaccurate, so the counter mappings in the official manual must be treated as authoritative.

Significance and boundaries: this is one of the first microarchitectural attack detection studies to use commercial RISC-V silicon (rather than FPGA soft cores or simulators) as its platform and to release a reproducible dataset. “Using the chip’s built-in counters plus a lightweight model for proactive detection” is a low-cost hardening path that requires no silicon changes and no kernel patches, echoing the security narrative of the open RISC-V ecosystem; at the same time, its boundaries should be noted — the experiments cover only a single core model, counter patterns are strongly correlated with microarchitecture and require retraining across chips; supervised learning depends on labeled attack data, and generalization to entirely new attack types remains to be validated.

I. Open-Source Community and Software Ecosystem

1.1 XiangShan: Two Merges into the Kunminghu v3 Default Branch; Vector, TAGE, and Free List Advance in Parallel Across Branches

Date: 2026-09-24　Source: XiangShan commit: uBTB hit check timing (#6489), XiangShan commit: CommonHR redirect history maintenance fix, XiangShan commit: vector store mask support (new store path), XiangShan commit: TAGE bank conflict fix, XiangShan commit: free list bitmap rotation (performance), GEM5 commit: configurable L2 low-precision offload (#1183), NEMU commit: CUTE AMU callbacks and controller optimization

The main XiangShan repository (default branch kunminghu-v3) merged two commits in this window: a timing adjustment for the uBTB hit check (#6489) and a fix for history maintenance errors caused by CommonHR redirect triggering. The denser activity occurred across development branches — 6 fixes on the vector (0923) branch: vle exception handling, vector store mask support on the new store path, vector load VL dependency tracking, vldSNMergeInfo initial value correction, merging the old vd on vector load writeback, and cancellation of vstd uops outside the physical store queue; TAGE branch prediction fixed bank conflicts and corrected the CommonHR maintenance error; the free list refactor branch rotates refill banks using bitmap enqueue count (performance); the ECC RERI feature branch received commits; the load-to-use timing branch fixed specMiss timing. On the simulation and verification side: GEM5 advanced across multiple branches (configurable L2 low-precision offload #1183, H2P page tables enabled by default, MaskRAT modeling plan, Hybrid ROB support for move elimination, weekly performance coverage refresh #1188); NEMU completed CUTE AMU callbacks and optimized the share-ctrl controller. Overall, this shows a dual-track rhythm of “wrapping up vector memory access path fixes + front-end prediction and cache microarchitecture tuning.”

1.2 openRuyi: SPECS Merges expat 2.8.5 Security Update; No New Releases on the Official Site

Date: 2026-09-24　Source: openRuyi commit: expat 2.8.5 security fix, openRuyi commit: python-pyzmq package name normalization, openRuyi commit: KDE desktop install component dependency addition

The main repository of the openRuyi project, led by the Institute of Software, Chinese Academy of Sciences, received three SPECS commits in this window: expat upgraded to 2.8.5 (security fix batch), the python-zmq package name normalized to python-pyzmq, and the KDE desktop install component (openruyi-desktop-setup-kde) adding a dependency on openruyi-logo. There were no new announcements on the official news page during this window, and the 2026.09 release is still unpublished (the most recent release was 2026.07); other repositories such as kvm-unit-tests and fwts saw no new commits in this window.

1.3 Open-Source Ecosystem Shorts: Four felix86 Commits, riscv-unified-db and qtrvsim Updates

Date: 2026-09-24　Source: felix86 commit: MOV+SHUFPS optimization (#788), felix86 commit: REPL regression fix (#789), felix86 commit: semaphore lock/unlock around fork (#790), felix86 commit: Zydis decode optimization (#791), riscv-unified-db commit: WFI timeout and U-Mode parameters (#2526), qtrvsim commit: legacy SUSE packaging adopts GCC-13

  • felix86, a binary translation project for running x86/x86-64 programs on RISC-V Linux, received 4 commits in this window: optimizing the MOV+SHUFPS combination into the PSHUFD instruction (#788), fixing a REPL regression (#789), locking/unlocking a semaphore around fork (#790), and a minor Zydis decode optimization (#791) — continuing the rhythm of polishing game and workload compatibility.
  • riscv-unified-db (the RISC-V machine-readable specification database) added WFI timeout and U-Mode support parameters (#2526), supplementing the specification database with low-power and privileged-mode descriptions.
  • qtrvsim (a teaching-oriented RISC-V simulator) packaging adjustment: legacy SUSE distributions require building with GCC-13.

II. Product and Ecosystem Updates

2.1 Linux porting momentum builds for Espressif ESP32-S31: from MCU toward SBC form factor

Date: 2026-09-24　Source: XDA, “The newest ESP32 can actually run Linux, and it’s getting uncomfortably close to a Raspberry Pi”, CNX Software: ESP32-S31 Linux BSP developer preview (08-22)

XDA published a feature discussing Espressif’s ESP32-S31: a dual-core 32-bit RISC-V main core (up to 320 MHz, plus a 40 MHz low-power core) and the first ESP32 with a built-in Sv32 MMU. On the hardware side it also offers a Gigabit Ethernet MAC (RGMII), USB 2.0 High-Speed OTG host, dual-slot SDIO, DVP camera input, and a parallel LCD controller — a peripheral mix approaching that of a modern single-board computer. The official Linux BSP developer preview shipped in August (Buildroot 2025.02 + U-Boot + Linux 6.18 branch, full image about 13.7MB); community ports are advancing in parallel: GrieferPig’s Linux 6.12 supervisor-mode port (about 15MB usable memory, CoreMark around 1059), and another port based on Linux 7.1 + OpenSBI 1.9 that can drive an 800x480 LCD console. XDA’s assessment: the S31’s peripherals, bandwidth, and CPU privilege model are all “close to an SBC,” but Linux support remains experimental and is not recommended for production in the near term.

2.2 New Sophgo BM1688 board OrangePi O1 announced: 16 TOPS TPU plus RISC-V C906 co-processor

Date: 2026-09-24　Source: LinuxGizmos, “16-TOPS AI SBC with SATA 3.0 runs on octa-core Sophgo BM1688”

LinuxGizmos published details of the OrangePi O1 board (90×70mm): based on the Sophgo BM1688 vision computing processor — 8-core Arm Cortex-A53 (up to 1.65GHz) plus a RISC-V C906 co-processor (up to 1.2GHz), with an integrated TPU delivering INT8 16 TOPS / INT4 32 TOPS / FP16-BF16 around 4 TFLOPS, supporting Caffe, PyTorch, TensorFlow, ONNX, and MXNet, positioned for edge-side large-model and vision-model inference. On-board configuration: 8/16GB LPDDR4X, eMMC (16-128GB options), M.2 NVMe (PCIe 3.0), SATA 3.0, dual Gigabit Ethernet ports, Wi-Fi 6E / Bluetooth 5.3, optional 4G/5G modules, HDMI 2.0 4K60, dual MIPI-CSI and 6 video inputs; supports 16-channel 1080p30 decoding. The BM1688’s embedded RISC-V C906 co-processor is the “RISC-V inside” this Arm-main-core edge AI chip, and a typical form of the multi-core heterogeneous AI chip path taken by domestic RISC-V vendors.

2.3 Radxa Linkr v1.5.0 released: plugin center, ZeroTier / EasyTier network plugins, and screenshot OCR

Date: 2026-09-24　Source: Linkr v1.5.0 release notes

Radxa Linkr released v1.5.0: a new plugin center (one-stop management for uploading, installing, enabling, disabling, and uninstalling plugins); for networking, new ZeroTier and EasyTier network plugins (join a network, view network information, leave a network); adaptive resizing of screenshot watermarks and screenshot OCR text recognition. Linkr is Radxa’s browser-based remote management product line for development boards and NAS devices, and has been part of this daily’s routine monitoring scope since September; this is the major version update within the window.

III. Deep Dive on Domestic Teams

3.1 SpacemiT: llama.cpp fork releases v0.2.0, standalone ggml-spacemit backend debuts

Date: 2026-09-24　Source: spacemit-com/llama.cpp v0.2.0 release notes

The SpacemiT llama.cpp fork has released v0.2.0: the core change is the introduction of a standalone ggml-spacemit backend (build flag -DGGML_SPACEMIT=ON) — a single main thread submits tasks to the spine runtime, which then spawns worker threads, so the thread parameter -t is always set to 1; compute cores are specified via the environment variable SPACEMIT_PERFER_CORE_ID as a list of physical core IDs (e.g., cores 8 through 15), and models are placed via –device SPACEMIT0, with llama-cli/llama-bench/llama-server all scheduled this way. The server retains multi-stream ASR capability: it can pair with the smt media backend to handle audio requests concurrently (e.g., -np 4 with 6 cores). This fork has evolved continuously since the MTMD refactor in v0.1.7; this release lands “backend independence,” marking a milestone version in SpacemiT’s inference stack’s march toward modularization.

3.2 SpacemiT: three performance optimizations in model-zoo-vision, mpp fixes and RL toolchain updates

Date: 2026-09-24　Source: model-zoo-vision commit: post-processing speedup (#93), model-zoo-vision commit: superpoint descriptor precomputation (#95), model-zoo-vision commit: segmentation skips missing labels and vectorizes YOLO26-Sem, mpp commit: vdec concurrent throughput test, mpp commit: reclaim fix before decoder teardown, model_zoo_rl commit: inference thread configuration and warmup (#13)

SpacemiT’s vision and multimedia software stack saw multiple updates during the window: model-zoo-vision received three performance optimizations — CTC/LightGlue/YOLO post-processing speedup (#93), superpoint descriptor sampling precomputation (#95), and segmentation tasks skipping missing labels plus vectorized YOLO26-Sem argmax; mpp received three — vdec concurrent input/output throughput testing, a fix for reclaim timing before decoder teardown, and v2d rejecting unaligned target origins; model_zoo_rl added inference thread configuration and model warmup (#13); ai-sdk synchronized its vision and rl submodule references.

3.3 Sophgo: multiple repos pushed during the window, bootloader-riscv adjusts edk2 source directory convention

Date: 2026-09-24　Source: bootloader-riscv commit: RV_EDKII_SRC_DIR as edk2 top-level source directory

Multiple repositories in the Sophgo GitHub organization saw pushes during the window: bootloader-riscv merged a build adjustment using RV_EDKII_SRC_DIR as the edk2 top-level source directory (making it easier to specify an external edk2 source tree); repos including zsbl, edk2-platforms, MultiArchUefiPkg, sophon-demo, sophon-tools, and sophon-edk2 also had push records during the window. For product-side developments, see 2.2 (OrangePi O1 details announced); no other new items.

3.4 Espressif: 14 merges in esp-idf during the window, esp-vision adds camera runtime control

Date: 2026-09-24　Source: esp-vision commit: camera runtime IPA and ISP control

Espressif’s esp-idf saw 14 merges during the window, covering protocomm security hardening, relaxed esp_tee linking, coredump wrapping, CSI release flow, and synchronized CI adjustments; the vision component repository esp-vision added runtime IPA and ISP control for the camera module (enabling online adjustment of image processing parameters). Combined with the ESP32-S31 Linux progress in 2.1, Espressif’s software investment across its RISC-V product line (ESP32-C series, P4, S31, etc.) remains active.

3.5 Sipeed: seven commits to the SLogic logic analyzer software stack, driver migrates to shared libslogic

Date: 2026-09-24　Source: SLogic commit: driver migrates to shared libslogic, SLogic commit: macOS CI builds ngscope and sigrok-bridge, SLogic commit: SLogic32U3 rate specification adjustment, scopehal-apps commit: upgrade to SLogic driver branch, NanoKVM commit: storage mount semantics fix

Sipeed’s SLogic logic analyzer software stack advanced 7 commits during the window, with the main thrust being the migration of the sipeed-slogic driver from a private implementation to the shared libslogic library (with all-logic upgraded in sync), unified builds of ngscope and sigrok-bridge on macOS CI, unified digital channel color schemes across the four GUIs, and the SLogic32U3’s four-channel maximum rate adjusted from 1600 to 1400 MHz (a specification correction), with ngscope defaulting to 40 MS/s sampling and 100 kS; scopehal-apps followed up by upgrading to the SLogic driver branch. In addition, NanoKVM fixed storage mount semantics (read-only image mounts, /data handed to a single writer), reducing concurrent write risks.

IV. Embodied Intelligence and Robotics Special Section

4.1 SpacemiT spacemit-robotics: LingLong integrates SONIC motion tracking policy, MuJoCo simulation fix

Date: 2026-09-24　Source: humanoid_linglong PR #16: Integrate SONIC motion tracking policy, humanoid_common PR #20: SONIC motion selection and RL protection, humanoid_common commit: SONIC runtime interface, simulation_mujoco commit: Decouple rendering from physics (#9)

SpacemiT’s robotics line merged important software updates within the window: the humanoid robot application package LingLong (LingLong L1, 28 DoF) integrated the SONIC motion tracking policy (PR #16) — registering the SONIC model and eight selectable reference motions into the policy YAML, configuring the 28-DoF action mapping, observations and reference inputs, gains, and target bounds; humanoid_common concurrently added support for SONIC motion selection and RL protection (PR #20): the policy adapter and HMI can switch SONIC reference motions while maintaining whole-body control, with new per-joint target bounds and inference timeout diagnostics. On the simulation side, MuJoCo fixed the decoupling of PC rendering from physics simulation (#9), complementing the existing “PC simulation + K3 board RL inference” sim2sim workflow, making it easier to debug policies on a single machine before deploying to the real robot.

4.2 UC Berkeley releases IISWC 2026 tutorial: ML and robotics workloads on heterogeneous RISC-V SoCs

Date: 2026-09-24　Source: ucb-bar/IISWC-tutorial-2026-RISCV-ML-Robotics

UC Berkeley (ucb-bar) released the microsite repository for its IISWC 2026 tutorial: “Building, Tracing, and Optimizing End-to-End ML and Robotic Workloads on Heterogeneous RISC-V SoCs with a Lightweight Zephyr Runtime” — centered on building, tracing, and optimizing end-to-end machine learning and robotics workloads on heterogeneous RISC-V SoCs using a lightweight Zephyr runtime. The tutorial organizes “robotics workload methodology” (building, tracing, optimizing) as a standalone topic, indicating that academic research on RISC-V robotics and ML workloads is becoming systematized.

V. Summary and Trend Observations

  • Security research enters a “reproducible” phase: UPC completed microarchitectural attack detection research using the commercial XuanTie C910 core and public datasets, advancing the RISC-V security narrative from “single-point vulnerability disclosure (GhostWrite, etc.)” to “quantitative detection plus dataset sharing”; for domestic cores, being selected as an experimental platform reflects both heightened attention and a reminder that commercial silicon needs proactive detection solutions.
  • Edge AI hardware and software reinforced in tandem: the Linux porting attempt for ESP32-S31, the new BM1688 single-board computer, SpacemiT llama.cpp v0.2.0, and Espressif esp-vision all point to edge inference moving from “it runs” to “it runs well” in the engineering phase; RISC-V continues to expand its form-factor boundaries from MCUs to edge boxes.
  • Dual-track rhythm in open-source communities: XiangShan is advancing vector, prediction, and cache microarchitectural tuning in parallel across multiple branches, maintaining a high development density; openRuyi this week focused on security updates and packaging specifications, awaiting the 2026.09 release window.
  • Embodied intelligence advancing in layers: after LingLong integrated the SONIC motion tracking policy, the robotics software stack continues to accumulate across three layers — “runtime interface, policy assets, simulation closed loop”; alongside academic activities such as the IISWC tutorial, the methodology building for RISC-V robotics workloads is unfolding in parallel on both the industry and academic sides.
  • Watch points: whether openRuyi 2026.09 will be released; the pace at which the official ESP32-S31 Linux BSP moves from developer preview to general availability; upstreaming developments for the SpacemiT ggml-spacemit backend.

Appendix: Complete Source List

Source Verification Table

Source Verification Result
Hacker News No strongly RISC-V-related new posts within the window (the Tiny-Vedas paper entry had low engagement, below the inclusion threshold)
Google News aggregation (multiple queries in Chinese and English) English side surfaced the UPC security research (included in today’s highlights), ESP32-S31 Linux (included in 2.1), BM1688 (included in 2.2), and English follow-up on the ESWIN hearing (already covered in the 09-22 issue, not repeated); Chinese side surfaced an aggregated summary of a Sophgo PT exhibition interview (original site URL unavailable, not included) and various consumer electronics noise; gambling and sports headlines were removed wholesale by semantic filtering
English tech media (Scienmag, XDA, LinuxGizmos) Scienmag published the UPC research report (included in today’s highlights, paper DOI verified); XDA published the ESP32-S31 Linux feature (included in 2.1); LinuxGizmos published OrangePi O1 details (included in 2.2)
GitHub organizations and key repositories Pushes within the window: XUANTIE-RV 0, eswincomputing 0, sophgo 7, Nuclei-Software 0, espressif 36, spacemit-com 8, spacemit-robotics 4, sipeed 9, revyos 0, openhwgroup 0, radxa-linkr 1 (linkr v1.5.0), openRuyi-Project 3, XiangShan family 3 (XiangShan/NEMU/GEM5)
RISC-V International website/blog Blog had only people-interview content within the window (Maven Silicon), not included; member website sweep of 391 companies completed (224 unchanged / 98 changed / 69 failed), with all changes being homepage marketing and rolling updates (including the Sophgo website), and no substantive product or architecture developments
openRuyi dual-source No new announcements on the official news page (the 2026.09 release is still unpublished); three SPECS commits in the main GitHub repository (included in 1.2)
CNX Software/LinuxGizmos/Phoronix RSS LinuxGizmos entry see 2.2; CNX surfaced CyboPal ONE (RK3588 platform, not RISC-V, excluded); Phoronix had no hits within the window