Skip to content
STIMSMITH

Address Matching

Concept WIKI v1 · 7/30/2026

Address matching is a configuration parameter in RISC-V Physical Memory Protection (PMP) that specifies how region boundaries encoded in `pmpaddrX` Control and Status Registers are interpreted to define physical memory regions. Three modes are defined: Top of Range (TOR), Naturally Aligned Four-byte (NA4), and Naturally Aligned Power-of-2 (NAPOT).

Overview

In the RISC-V Physical Memory Protection (PMP) architecture, address matching refers to the way boundaries of memory regions are calculated from the values stored in the PMP address registers (pmpaddrX). The address matching mode is encoded in bits [4:3] (A field) of the corresponding PMP configuration register (pmpcfgX), and determines how the address in pmpaddrX is interpreted when defining a region boundary.

Address Matching Modes

The RISC-V PMP specification defines three address matching modes for memory regions:

  1. Top of Range (TOR) — In this mode, the value stored in pmpaddrX represents the upper boundary of an arbitrary range. The lower boundary of the region is given by the previous PMP address register (or 0 for the first region), and the upper boundary is computed as pmpaddrX << 2. This effectively treats consecutive pmpaddrX entries as paired lower/upper bounds.

  2. Naturally Aligned Four-byte (NA4) — Indicates that the region is exactly four bytes long and is naturally aligned.

  3. Naturally Aligned Power-of-2 (NAPOT) — Indicates a region whose size is a power of two and which is naturally aligned to that size. The size is encoded via the number of trailing 1 bits in the pmpaddrX register; the upper boundary is calculated as 2^(n + 3) where n is the number of set least-significant bits in pmpaddrX.

Operation

When PMP is enabled, the hardware performs an address matching check before each instruction fetch or memory access. The procedure is:

  1. Read the address matching mode (A field, bits [4:3]) from the relevant pmpcfgX.
  2. Search the configured PMP regions for one that matches the target address, interpreting pmpaddrX according to the selected mode (TOR, NA4, or NAPOT).
  3. Once a matching region is found, decode the 3 least significant bits of the configuration register as permissions:
    • Bit 2 (X) — Execute permission
    • Bit 1 (W) — Write permission (store instructions)
    • Bit 0 (R) — Read permission (load instructions)

If the requested access is not permitted by the region's permissions, a precisely trapped exception is raised.

Region Composition

Regions form a continuous address space: each region's upper boundary serves as the next region's lower boundary. A typical RISC-V PMP supports up to 64 such regions, defined by paired pmpaddrX/pmpcfgX registers. The smallest encodable region is 4 bytes (via NA4), while NAPOT supports arbitrarily large power-of-two sizes, and TOR supports arbitrarily positioned ranges.

Relationship to PMP

Address matching is a sub-mechanism of PMP that controls how region boundaries are computed. It does not by itself grant or deny accesses — that is determined by the X/W/R permission bits once a region match is found. Combined with PMP's lock bit (which prevents configuration writes until CPU reset), address matching and permissions together form the complete PMP protection model.

Other Contexts

The phrase "address matching" also appears in unrelated domains:

  • In cryptocurrency privacy research, cross-chain address matching refers to techniques for identifying when seemingly incompatible address formats (e.g., Bitcoin vs. Ethereum) derive from the same underlying cryptographic public keys, enabling detection of key reuse across UTXO and account-based cryptocurrencies.
  • In neuromorphic/parallel processor design, local target address matching describes a technique that eliminates the address bus between processor-memory nodes by matching destination addresses in situ, reducing data transport energy costs.

These uses are distinct from the RISC-V PMP context but share the underlying notion of comparing or resolving an address against one or more reference values.

LINKED ENTITIES

4 links
Physical Memory Protection (PMP) USES
Naturally Aligned Power-of-2 (NAPOT) PART_OF
Naturally Aligned Four-byte (NA4) PART_OF
Top of Range (TOR) PART_OF

CITATIONS

7 sources
7 citations
[1] Address matching refers to the way boundaries of memory regions are calculated, with three available modes in PMP: NAPOT, NA4, and TOR. Adding Physical Memory Protection to the VeeR EL2 RISC-V Core
[2] In TOR mode, the upper boundary is calculated as pmpaddrX << 2 because the address stored in the address register represents bits [33:2] of the physical address space. Adding Physical Memory Protection to the VeeR EL2 RISC-V Core
[3] For NAPOT, the upper boundary is calculated as 2^(n+3) where n is the number of set least-significant bits in pmpaddrX; the smallest encodable region is a 4-byte range. Adding Physical Memory Protection to the VeeR EL2 RISC-V Core
[4] The address matching configuration (bits 4,3) is read from the PMP CSRs to determine how each pmpaddrX is interpreted during a region match. Adding Physical Memory Protection to the VeeR EL2 RISC-V Core
[5] Once a matching region is found, bits [2:0] of the PMP configuration register decode X/W/R permissions for execution, writes, and reads respectively. Adding Physical Memory Protection to the VeeR EL2 RISC-V Core
[6] In cryptocurrency research, cross-chain address matching identifies when addresses in incompatible formats (e.g., Bitcoin and Ethereum) derive from the same public keys, exposing key reuse. Reuse of Public Keys Across UTXO and Account-Based Cryptocurrencies
[7] In a low-power AI ASIC, local target address matching eliminates the address bus between processor-memory nodes, reducing data transport energy costs. Co-design of a novel CMOS highly parallel, low-power, multi-chip neural network accelerator