Physical Memory Protection
ConceptPhysical Memory Protection (PMP) is a RISC-V mechanism in which machine-mode control registers define access privileges for physical memory regions on a per-hardware-thread basis. Evidence describes PMP as a standard feature for memory isolation in security-critical systems, a primitive for constrained-device attestation designs, and a feature area relevant to processor verification and fuzzing.
First seen 5/25/2026
Last seen 9/1/2026
Evidence 23 chunks
Wiki v2
WIKI
Overview
Physical Memory Protection (PMP) is a RISC-V feature used for memory isolation in security-critical systems. It provides per-hardware-thread machine-mode control registers that specify access privileges for physical memory regions. [C1]
Control registers
NEIGHBORHOOD
3 nodes · 3 edgesgraph · Physical Memory Protection · depth=1
RELATIONSHIPS
11 connectionsProcessorFuzz discovered a bug in Dromajo related to Physical Memory Protection checks.
Physical Memory Protection (PMP) is discussed in the context of memory safety and compared to capabilities.
Piccolo as a RISC-V microcontroller supports Physical Memory Protection.
Flute as a RISC-V microcontroller supports Physical Memory Protection.
GenHuzz detects vulnerabilities related to Physical Memory Protection configurations.
GoldenFuzz learns PMP configurations as part of its semantic understanding.
GenHuzz detected vulnerabilities in the Physical Memory Protection implementation of RISC-V cores.
CVA6 SoC contains a Physical Memory Protection unit.
Physical Memory Protection is a feature of the RISC-V privileged specification.
RISC-V specifies Physical Memory Protection (PMP) as a standard component.
The Ibex Core has an optional Physical Memory Protection feature.
LINKED ENTITIES
1 linksCITATIONS
6 sources6 citations — click to expand
[1] PMP is a RISC-V feature used for memory isolation and provides per-hardware-thread machine-mode control registers specifying access privileges for physical memory regions. Verifying RISC-V Physical Memory Protection
[2] `pmpcfg` contains the physical memory protection configuration and `pmpaddr` contains physical memory protection addresses; both are listed as CSRs not monitored by ProcessorFuzz. ProcessorFuzz: Processor Fuzzing with Control and Status Registers
[3] Keystone relies on PMP in its trusted computing base to provide security guarantees such as integrity and confidentiality. Verifying RISC-V Physical Memory Protection
[4] LIRA-V uses read-only memory and RISC-V PMP to build a trust anchor for remote attestation and secure channel creation, including mutual attestation for trusted communication between devices. LIRA-V: Lightweight Remote Attestation for Constrained RISC-V Devices
[5] A formal-verification effort formalizes PMP rules from the RISC-V ISA manual, translates a Chisel PMP module to UCLID5 with LIME, encodes the specification in UCLID5, and verifies the implementation's functional correctness. Verifying RISC-V Physical Memory Protection
[6] ProcessorFuzz reported a Dromajo issue where PMP checks were performed and exceptions were raised on violations even with no PMP entries set. ProcessorFuzz: Processor Fuzzing with Control and Status Registers