From 5abfd1a4ab50ac7cb833ced543bc4ec25c8d1c9e Mon Sep 17 00:00:00 2001
From: Howard Mao <zhehao.mao@gmail.com>
Date: Wed, 3 Feb 2016 15:40:44 -0800
Subject: [PATCH] make sure to check for region violations in DMA frontend

---
 rocket/src/main/scala/dma.scala | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/rocket/src/main/scala/dma.scala b/rocket/src/main/scala/dma.scala
index 24240c18..aa45c5be 100644
--- a/rocket/src/main/scala/dma.scala
+++ b/rocket/src/main/scala/dma.scala
@@ -53,7 +53,7 @@ object ClientDmaRequest {
 
 object ClientDmaResponse {
   val pagefault = UInt("b01")
-  val outer_err = UInt("b10")
+  val invalid_region = UInt("b10")
 
   def apply(status: UInt = UInt(0))(implicit p: Parameters) = {
     val resp = Wire(new ClientDmaResponse)
@@ -164,6 +164,12 @@ class DmaFrontend(implicit p: Parameters) extends CoreModule()(p)
       alloc = Bool(false))
   }
 
+  def check_region(cmd: UInt, src: UInt, dst: UInt): Bool = {
+    val dst_ok = Mux(cmd === DMA_CMD_SOUT, dst >= UInt(mmioBase), dst < UInt(mmioBase))
+    val src_ok = Mux(cmd === DMA_CMD_SIN,  src >= UInt(mmioBase), Bool(true))
+    dst_ok && src_ok
+  }
+
   tlb.io.req.valid := tlb_to_send.orR
   tlb.io.req.bits.vpn := Mux(tlb_to_send(0), src_vpn, dst_vpn)
   tlb.io.req.bits.passthrough := Bool(false)
@@ -227,7 +233,12 @@ class DmaFrontend(implicit p: Parameters) extends CoreModule()(p)
   }
 
   when (state === s_translate && !to_translate.orR) {
-    state := s_dma_req
+    when (check_region(cmd, src_paddr, dst_paddr)) {
+      state := s_dma_req
+    } .otherwise {
+      resp_status := ClientDmaResponse.invalid_region
+      state := s_finish
+    }
   }
 
   def setBusy(set: Bool, xact_id: UInt): UInt =