From 5abfd1a4ab50ac7cb833ced543bc4ec25c8d1c9e Mon Sep 17 00:00:00 2001 From: Howard Mao Date: Wed, 3 Feb 2016 15:40:44 -0800 Subject: [PATCH] make sure to check for region violations in DMA frontend --- rocket/src/main/scala/dma.scala | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/rocket/src/main/scala/dma.scala b/rocket/src/main/scala/dma.scala index 24240c18..aa45c5be 100644 --- a/rocket/src/main/scala/dma.scala +++ b/rocket/src/main/scala/dma.scala @@ -53,7 +53,7 @@ object ClientDmaRequest { object ClientDmaResponse { val pagefault = UInt("b01") - val outer_err = UInt("b10") + val invalid_region = UInt("b10") def apply(status: UInt = UInt(0))(implicit p: Parameters) = { val resp = Wire(new ClientDmaResponse) @@ -164,6 +164,12 @@ class DmaFrontend(implicit p: Parameters) extends CoreModule()(p) alloc = Bool(false)) } + def check_region(cmd: UInt, src: UInt, dst: UInt): Bool = { + val dst_ok = Mux(cmd === DMA_CMD_SOUT, dst >= UInt(mmioBase), dst < UInt(mmioBase)) + val src_ok = Mux(cmd === DMA_CMD_SIN, src >= UInt(mmioBase), Bool(true)) + dst_ok && src_ok + } + tlb.io.req.valid := tlb_to_send.orR tlb.io.req.bits.vpn := Mux(tlb_to_send(0), src_vpn, dst_vpn) tlb.io.req.bits.passthrough := Bool(false) @@ -227,7 +233,12 @@ class DmaFrontend(implicit p: Parameters) extends CoreModule()(p) } when (state === s_translate && !to_translate.orR) { - state := s_dma_req + when (check_region(cmd, src_paddr, dst_paddr)) { + state := s_dma_req + } .otherwise { + resp_status := ClientDmaResponse.invalid_region + state := s_finish + } } def setBusy(set: Bool, xact_id: UInt): UInt =