An apparatus comprising: processing circuitry to issue memory access requests specifying a target address identifying a location to be accessed in a memory system; and a memory protection unit, MPU, comprising: permission checking circuitry to check whether a memory access request issued by the processing circuitry satisfies access permissions specified in a memory protection table stored in the memory system, the memory protection table comprising a plurality of memory protection entries, each memory protection entry specifying: access permissions for a corresponding address region of variable size within an address space, and region identifying parameters for identifying a start address and an end address of the corresponding address region, each memory protection entry specifying separate region identifying parameters for identifying the start address and the end address, wherein said MPU is configured to permit said variable size to be a number of bytes other than a power of 2; and MPU memory access circuitry to initiate at least one MPU memory access request for accessing the memory protection table from said memory system; wherein the MPU memory access circuitry is configured to determine whether a memory access request specifying a given target address hits against a given memory protection entry using the separate region identifying parameters identifying the start address and end address of the corresponding address region specified by the given memory protection entry. processing circuitry to issue memory access requests specifying a target address identifying a location to be accessed in a memory system; and a memory protection unit, MPU, comprising: permission checking circuitry to check whether a memory access request issued by the processing circuitry satisfies access permissions specified in a memory protection table stored in the memory system, the memory protection table comprising a plurality of memory protection entries, each memory protection entry specifying: access permissions for a corresponding address region of variable size within an address space, and region identifying parameters for identifying a start address and an end address of the corresponding address region, each memory protection entry specifying separate region identifying parameters for identifying the start address and the end address, wherein said MPU is configured to permit said variable size to be a number of bytes other than a power of 2; and MPU memory access circuitry to initiate at least one MPU memory access request for accessing the memory protection table from said memory system; wherein the MPU memory access circuitry is configured to determine whether a memory access request specifying a given target address hits against a given memory protection entry using the separate region identifying parameters identifying the start address and end address of the corresponding address region specified by the given memory protection entry. permission checking circuitry to check whether a memory access request issued by the processing circuitry satisfies access permissions specified in a memory protection table stored in the memory system, the memory protection table comprising a plurality of memory protection entries, each memory protection entry specifying: access permissions for a corresponding address region of variable size within an address space, and region identifying parameters for identifying a start address and an end address of the corresponding address region, each memory protection entry specifying separate region identifying parameters for identifying the start address and the end address, wherein said MPU is configured to permit said variable size to be a number of bytes other than a power of 2; and MPU memory access circuitry to initiate at least one MPU memory access request for accessing the memory protection table from said memory system; wherein the MPU memory access circuitry is configured to determine whether a memory access request specifying a given target address hits against a given memory protection entry using the separate region identifying parameters identifying the start address and end address of the corresponding address region specified by the given memory protection entry.