diff --git a/riscv/cfg.h b/riscv/cfg.h
index 13dcf3ac..dbdb58b5 100644
--- a/riscv/cfg.h
+++ b/riscv/cfg.h
@@ -61,6 +61,7 @@ public:
         const char *default_bootargs,
         const char *default_isa, const char *default_priv,
         const char *default_varch,
+        const reg_t default_pmpregions,
         const std::vector<mem_cfg_t> &default_mem_layout,
         const std::vector<int> default_hartids,
         bool default_real_time_clint)
@@ -69,6 +70,7 @@ public:
       isa(default_isa),
       priv(default_priv),
       varch(default_varch),
+      pmpregions(default_pmpregions),
       mem_layout(default_mem_layout),
       hartids(default_hartids),
       explicit_hartids(false),
@@ -80,6 +82,7 @@ public:
   cfg_arg_t<const char *>            isa;
   cfg_arg_t<const char *>            priv;
   cfg_arg_t<const char *>            varch;
+  reg_t                              pmpregions;
   cfg_arg_t<std::vector<mem_cfg_t>>  mem_layout;
   std::optional<reg_t>               start_pc;
   cfg_arg_t<std::vector<int>>        hartids;
diff --git a/riscv/dts.cc b/riscv/dts.cc
index 5d374637..9937d579 100644
--- a/riscv/dts.cc
+++ b/riscv/dts.cc
@@ -14,6 +14,7 @@
 std::string make_dts(size_t insns_per_rtc_tick, size_t cpu_hz,
                      reg_t initrd_start, reg_t initrd_end,
                      const char* bootargs,
+                     size_t pmpregions,
                      std::vector<processor_t*> procs,
                      std::vector<std::pair<reg_t, mem_t*>> mems)
 {
@@ -57,7 +58,7 @@ std::string make_dts(size_t insns_per_rtc_tick, size_t cpu_hz,
          "      compatible = \"riscv\";\n"
          "      riscv,isa = \"" << procs[i]->get_isa().get_isa_string() << "\";\n"
          "      mmu-type = \"riscv," << (procs[i]->get_isa().get_max_xlen() <= 32 ? "sv32" : "sv57") << "\";\n"
-         "      riscv,pmpregions = <16>;\n"
+         "      riscv,pmpregions = <" << pmpregions << ">;\n"
          "      riscv,pmpgranularity = <4>;\n"
          "      clock-frequency = <" << cpu_hz << ">;\n"
          "      CPU" << i << "_intc: interrupt-controller {\n"
diff --git a/riscv/dts.h b/riscv/dts.h
index 62081511..1878ca1e 100644
--- a/riscv/dts.h
+++ b/riscv/dts.h
@@ -10,6 +10,7 @@
 std::string make_dts(size_t insns_per_rtc_tick, size_t cpu_hz,
                      reg_t initrd_start, reg_t initrd_end,
                      const char* bootargs,
+                     size_t pmpregions,
                      std::vector<processor_t*> procs,
                      std::vector<std::pair<reg_t, mem_t*>> mems);
 
diff --git a/riscv/sim.cc b/riscv/sim.cc
index 0ef13b8b..8a155604 100644
--- a/riscv/sim.cc
+++ b/riscv/sim.cc
@@ -303,7 +303,7 @@ void sim_t::make_dtb()
     std::pair<reg_t, reg_t> initrd_bounds = cfg->initrd_bounds();
     dts = make_dts(INSNS_PER_RTC_TICK, CPU_HZ,
                    initrd_bounds.first, initrd_bounds.second,
-                   cfg->bootargs(), procs, mems);
+                   cfg->bootargs(), cfg->pmpregions, procs, mems);
     dtb = dts_compile(dts);
   }
 
diff --git a/spike_main/spike.cc b/spike_main/spike.cc
index ecce0c58..933f626d 100644
--- a/spike_main/spike.cc
+++ b/spike_main/spike.cc
@@ -36,6 +36,7 @@ static void help(int exit_code = 1)
   fprintf(stderr, "  --log=<name>          File name for option -l\n");
   fprintf(stderr, "  --debug-cmd=<name>    Read commands from file (use with -d)\n");
   fprintf(stderr, "  --isa=<name>          RISC-V ISA string [default %s]\n", DEFAULT_ISA);
+  fprintf(stderr, "  --pmpregions=<n>      Number of PMP regions [default 16]\n");
   fprintf(stderr, "  --priv=<m|mu|msu>     RISC-V privilege modes supported [default %s]\n", DEFAULT_PRIV);
   fprintf(stderr, "  --varch=<name>        RISC-V Vector uArch string [default %s]\n", DEFAULT_VARCH);
   fprintf(stderr, "  --pc=<address>        Override ELF entry point\n");
@@ -286,6 +287,7 @@ int main(int argc, char** argv)
             /*default_isa=*/DEFAULT_ISA,
             /*default_priv=*/DEFAULT_PRIV,
             /*default_varch=*/DEFAULT_VARCH,
+            /*default_pmpregions=*/16,
             /*default_mem_layout=*/parse_mem_layout("2048"),
             /*default_hartids=*/std::vector<int>(),
             /*default_real_time_clint=*/false);
@@ -357,6 +359,7 @@ int main(int argc, char** argv)
   parser.option(0, "l2", 1, [&](const char* s){l2.reset(cache_sim_t::construct(s, "L2$"));});
   parser.option(0, "log-cache-miss", 0, [&](const char UNUSED *s){log_cache = true;});
   parser.option(0, "isa", 1, [&](const char* s){cfg.isa = s;});
+  parser.option(0, "pmpregions", 1, [&](const char* s){cfg.pmpregions = atoul_safe(s);});
   parser.option(0, "priv", 1, [&](const char* s){cfg.priv = s;});
   parser.option(0, "varch", 1, [&](const char* s){cfg.varch = s;});
   parser.option(0, "device", 1, device_parser);