The PMP Snapshot Engine
Fast and Fault-Resilient PMP Reconfiguration for RISC-V
Christian Larmann (TU Delft - Electrical Engineering, Mathematics and Computer Science)
Abdullah Aljuffri (King Abdulaziz City for Science and Technology)
Adrian Marotzke (Nxp Semiconductors)
Alejandro Garza (Nxp Semiconductors)
Said Hamdioui (TU Delft - Electrical Engineering, Mathematics and Computer Science)
Mottaqiallah Taouil (TU Delft - Electrical Engineering, Mathematics and Computer Science)
More Info
expand_more
Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.
Abstract
This paper presents a Physical Memory Protection Snapshot Engine (PSE), a lightweight hardware extension for RISC-V that addresses both performance and security challenges of Physical Memory Protection (PMP) reconfiguration. By storing and restoring full PMP configurations in a single cycle, the PSE drastically reduces the overhead of context switches typically used in Trusted Execution Environments (TEEs) and secure real-time systems. At the same time, the redundant storage and two-dimensional parity protection provide an efficient and effective defense against fault injection attacks that target PMP registers. In 100k randomized trials, our experimental results demonstrate that the PSE can reliably detect and prevent FI-induced privilege escalations, while incurring only 11.7% area overhead. This makes it a practical solution for embedded devices where both efficiency and trustworthiness are essential.
Files
File under embargo until 04-12-2026