DenseChip

RISC-V Design ยท All levels

PMP and Physical Memory Protection Domains: Debug Playbook

Debug Playbook for PMP and Physical Memory Protection Domains.

Debug playbook

Debug Playbook for PMP and Physical Memory Protection Domains is anchored on Unauthorized-access block rate, PMP rule evaluation latency, and coverage of privilege-domain isolation tests.. Convert observations into mechanism-backed decisions with explicit ownership.

  1. Freeze workload seed, binary, compiler, firmware, and platform setup.

  2. Find earliest persistent mechanism failure in the timeline.

  3. Build one reduced reproducer for dominant hypothesis.

  4. Patch minimal fix with explicit rollback gate.

  5. Rerun correctness + performance + power matrix.

Decision tree

diagram
ROOT CAUSE TREE - PMP and Physical Memory Protection Domains

Unauthorized-access block rate, PMP rule evaluation latency, and coverage of privilege-domain isolation tests. regressed
          |
   reproducible on fixed seed?
      /                 \
    no                   yes
    |                     |
env/tool drift       first failing domain?
                     /        |         \
                  decode    execute    memory/MMU
                    |         |            |
               control map  bypass/FU   TLB/walk/perm
                    |
         privilege/CSR side effects checked?

Stop at first confirmed mechanism, then assign explicit owner + fix proof.

Review memo template

diagram
RISC-V REVIEW MEMO - Memory & Virtualization / PMP and Physical Memory Protection Domains

1. Symptom
   - Failing metric: Unauthorized-access block rate, PMP rule evaluation latency, and coverage of privilege-domain isolation tests.
   - Failing workload slice: <name>
   - Triggering mode: <privilege/virtualization/interrupt/cache/boot>
   - Build and runtime tags: <toolchain/firmware/RTL revision>

2. Mechanism hypothesis
   - Primary mechanism: RISC-V Physical Memory Protection (PMP) constrains physical-address access by privilege mode using programmable regions and R/W/X permission bits, commonly in NAPOT or TOR encodings. Each memory access is checked against ordered PMP entries, enabling machine-mode firmware to isolate supervisor/user domains, secure monitors, and device windows before virtual translation or after it depending on implementation stage. Correct deployment requires deterministic region priority, lock-bit strategy, and synchronization with boot-time memory map handoff so protections cannot be bypassed by stale configuration or unexpected privilege transitions. In safety and security signoff, PMP policy must be validated alongside trap handling, debug access policy, and firmware update flows to prevent escalation paths.
   - Competing hypotheses: <decode control / hazard / MMU / privilege / integration>
   - Missing evidence: <trace/counter/proof/report>

3. Proposed action
   - Smallest reversible change: <RTL/compiler/runtime/config>
   - Expected movement: <throughput/latency/tail/perf-per-watt>
   - Regression risk: correctness, security, power, timing, software compatibility

4. Signoff
   - Required artifact: PMP region map with rule-priority table, lock policy, and privilege-mode access matrix.
   - Required owners: security architecture owner, firmware and boot-flow owner, CPU privilege architect, platform software owner, security validation owner
   - Final decision: ship, bounded rollout, rollback, or escalate
Practice this lesson