SPRUIY2 November 2024 F29H850TU , F29H859TU-Q1
The Protected Call Stack is a dedicated hardware stack used to make protected function call and return. This stack is directly controlled by CPU and is inaccessible to user code. The basic protection concept of the C29x CPU is based on LINKs, STACKs, and ZONEs. The protected function call and return is the method used to make a function call by the current executing code to another function residing in a different STACK. The C29x security architecture allows definition of legal callable function labels using the instructions ENTRY1.PROT and ENTRY2.PROT. This makes sure that code from another STACK can only make function calls or branches to labels with the instruction packet “ENTRY1.PROT || ENTRY2.PROT” present. This prevents malicious code from randomly entering into code regions without permission. Nesting of protected calls is allowed up to the number of levels supported by the protected call stack. Table 2-8 shows the rules of code execution across stack.
Protected call Stack Pointer (PSP) register: The PSP register keeps track of the utilization of protected call stack and shows the current value of protected call stack pointer. This register is automatically incremented and decremented by HW on a protected call (CALL.PROT) and protected return (RET. PROT) respectively.
Warning level for Protected call Stack Pointer (WARNPSP) register: This WARNPSP is a user configurable register which allows early warning of protected stack overflow detection. When PSP register >= WARNPSP register, error signal is generated to ESM.
Maximum Protected call Stack Pointer (MAXPSP) register: The MAXPSP register is not user configurable register. When PSP register = MAXPSP register, CPU enters fault state as protected call stack is full.
Program Flow Operation | Comments and CPU Action |
---|---|
Linear code execution within the same LINK | Allowed without any restriction |
Branches, calls and returns within the same LINK | |
Branches, calls and returns across different LINKs, but within the same STACK | |
Protected function return (RET.PROT) where the return address is on a different STACK compared to the current STACK | |
Protected function calls (CALL.PROT @label/Ax) where source and destination are on same STACK | |
Protected function return (RET.PROT) where the return address is on a same STACK | |
Linear code execution crossing LINK, but within the same STACK | Not allowed, CPU enters FAULT state. |
Branches where source and destination are on different STACKs | |
Function calls (CALL{D} @label/Ax) where source and destination are on different STACKs | |
Execution of a function return instruction (RET{D} /RET{D} <addr1>) where the return address is on a different STACK compared to the current STACK | |
Realtime Interrupt (RTINT) and NMI | This is handled in the hardware and does not need any consideration in the user code. The Interrupt service routine can reside in the same or a different LINK/STACK/ZONE. |
Interrupts (INT) | ISR must be on the same stack. If not, CPU enters FAULT state. |