Skip to content
STIMSMITH

Physical Memory Protection

Concept

Physical Memory Protection (PMP) is a RISC-V mechanism in which machine-mode control registers define access privileges for physical memory regions on a per-hardware-thread basis. Evidence describes PMP as a standard feature for memory isolation in security-critical systems, a primitive for constrained-device attestation designs, and a feature area relevant to processor verification and fuzzing.

First seen 5/25/2026
Last seen 6/8/2026
Evidence 10 chunks
Wiki v2

WIKI

Overview

Physical Memory Protection (PMP) is a RISC-V feature used for memory isolation in security-critical systems. It provides per-hardware-thread machine-mode control registers that specify access privileges for physical memory regions. [C1]

Control registers

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

6 connections
ProcessorFuzz ← mentions 85% 3e
ProcessorFuzz discovered a bug in Dromajo related to Physical Memory Protection checks.
UCAM-CL-TR-984 ← uses 90% 2e
Physical Memory Protection (PMP) is discussed in the context of memory safety and compared to capabilities.
Piccolo ← uses 80% 2e
Piccolo as a RISC-V microcontroller supports Physical Memory Protection.
Flute ← uses 80% 2e
Flute as a RISC-V microcontroller supports Physical Memory Protection.
RISC-V part of → 90% 1e
Physical Memory Protection is a feature of the RISC-V privileged specification.
RISC-V ← uses 100% 1e
RISC-V specifies Physical Memory Protection (PMP) as a standard component.

CITATIONS

6 sources
6 citations — click to expand
[1] PMP is a RISC-V feature used for memory isolation and provides per-hardware-thread machine-mode control registers specifying access privileges for physical memory regions. Verifying RISC-V Physical Memory Protection
[2] `pmpcfg` contains the physical memory protection configuration and `pmpaddr` contains physical memory protection addresses; both are listed as CSRs not monitored by ProcessorFuzz. ProcessorFuzz: Processor Fuzzing with Control and Status Registers
[3] Keystone relies on PMP in its trusted computing base to provide security guarantees such as integrity and confidentiality. Verifying RISC-V Physical Memory Protection
[4] LIRA-V uses read-only memory and RISC-V PMP to build a trust anchor for remote attestation and secure channel creation, including mutual attestation for trusted communication between devices. LIRA-V: Lightweight Remote Attestation for Constrained RISC-V Devices
[5] A formal-verification effort formalizes PMP rules from the RISC-V ISA manual, translates a Chisel PMP module to UCLID5 with LIME, encodes the specification in UCLID5, and verifies the implementation's functional correctness. Verifying RISC-V Physical Memory Protection
[6] ProcessorFuzz reported a Dromajo issue where PMP checks were performed and exceptions were raised on violations even with no PMP entries set. ProcessorFuzz: Processor Fuzzing with Control and Status Registers