Physical Memory Protection
ConceptPhysical Memory Protection (PMP) is a RISC-V mechanism in which machine-mode control registers define access privileges for physical memory regions on a per-hardware-thread basis. Evidence describes PMP as a standard feature for memory isolation in security-critical systems, a primitive for constrained-device attestation designs, and a feature area relevant to processor verification and fuzzing.
First seen 5/25/2026
Last seen 7/10/2026
Evidence 19 chunks
Wiki v2
WIKI
Overview
Physical Memory Protection (PMP) is a RISC-V feature used for memory isolation in security-critical systems. It provides per-hardware-thread machine-mode control registers that specify access privileges for physical memory regions. [C1]
Control registers
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
10 connectionsProcessorFuzz discovered a bug in Dromajo related to Physical Memory Protection checks.
GoldenFuzz learns PMP configurations as part of its semantic understanding.
Piccolo as a RISC-V microcontroller supports Physical Memory Protection.
GenHuzz detected vulnerabilities in the Physical Memory Protection implementation of RISC-V cores.
Flute as a RISC-V microcontroller supports Physical Memory Protection.
Physical Memory Protection (PMP) is discussed in the context of memory safety and compared to capabilities.
The Ibex Core has an optional Physical Memory Protection feature.
Physical Memory Protection is a feature of the RISC-V privileged specification.
RISC-V specifies Physical Memory Protection (PMP) as a standard component.
CVA6 SoC contains a Physical Memory Protection unit.
LINKED ENTITIES
1 linksCITATIONS
6 sources6 citations — click to expand
[1] PMP is a RISC-V feature used for memory isolation and provides per-hardware-thread machine-mode control registers specifying access privileges for physical memory regions. Verifying RISC-V Physical Memory Protection
[2] `pmpcfg` contains the physical memory protection configuration and `pmpaddr` contains physical memory protection addresses; both are listed as CSRs not monitored by ProcessorFuzz. ProcessorFuzz: Processor Fuzzing with Control and Status Registers
[3] Keystone relies on PMP in its trusted computing base to provide security guarantees such as integrity and confidentiality. Verifying RISC-V Physical Memory Protection
[4] LIRA-V uses read-only memory and RISC-V PMP to build a trust anchor for remote attestation and secure channel creation, including mutual attestation for trusted communication between devices. LIRA-V: Lightweight Remote Attestation for Constrained RISC-V Devices
[5] A formal-verification effort formalizes PMP rules from the RISC-V ISA manual, translates a Chisel PMP module to UCLID5 with LIME, encodes the specification in UCLID5, and verifies the implementation's functional correctness. Verifying RISC-V Physical Memory Protection
[6] ProcessorFuzz reported a Dromajo issue where PMP checks were performed and exceptions were raised on violations even with no PMP entries set. ProcessorFuzz: Processor Fuzzing with Control and Status Registers