0
\$\begingroup\$

Is the stack executable on the STM32F4 MCU? I want to do this:

 unsigned int buffer[3];
 buffer[0] = 0x10000FA5; //Address: 0x10000FA0
 buffer[1] = 0xA0E1; //Address: 0x10000FA4 NOP
 buffer[2] = 0xA0E1; //Address> 0x10000FA8 NOP
 __asm __volatile__
 (
   "movw R1, #0x0fa0\n"  
   "movt R1, #0x1000\n" 
   "ldr pc, [r1, #0]\n" 
 );

In the assembly code, I fetch the content at address 0x10000fa0 (buffer[0]) to get my new program counter. The new program counter is 0x10000FA5, which is the address of the content of buffer[1]. In buffer[1] there is now an instruction (NOP) saved. Is this possible to execute?

Edit: I tried it out with GDB but I am getting following exception: prvGetRegistersFromStack (pulFaultStackAddress=0x10000f78 ) from FreeRTOS

\$\endgroup\$
2
  • \$\begingroup\$ Could you please explain (1) why do you want to do this? and (2) why didn't you try to run your code in a debugger / emulator to see if it works as you planned? \$\endgroup\$ Jul 31, 2018 at 12:56
  • \$\begingroup\$ I tried it, but when loading the address of buffer[1] into PC I get a prvGetRegistersFromStack (pulFaultStackAddress=0x10000f78 <Task1Stack+3960>) exception (using FreeRTOS). I am experimenting with exploits and want just to know what is possible \$\endgroup\$
    – who93
    Jul 31, 2018 at 13:13

3 Answers 3

2
\$\begingroup\$

The stm32 can happily execute from RAM, so yes, this is possible. Depending on which variant of STM32F4 you have different sections of SRAM are attached to the I-bus, this is detailed in the reference manual for your part.

Why do you want to do this? What problem are you trying to solve?

If you are trying to execute code from RAM there are well defined ways to achieve this with the linker.

\$\endgroup\$
3
  • \$\begingroup\$ thanks, was just wondering how the stack is managed by the CPU \$\endgroup\$
    – who93
    Jul 31, 2018 at 12:00
  • \$\begingroup\$ What do you mean? The CPU just has an active stack pointer MSP or PSP and it increments and decrements it when it uses the stack. The stack is just a block of memory. \$\endgroup\$
    – Colin
    Jul 31, 2018 at 12:01
  • 1
    \$\begingroup\$ @who93 The important point is that the CPU doesn't manage the stack, it manages the stack pointer. \$\endgroup\$ Jul 31, 2018 at 12:02
1
\$\begingroup\$

I think this should work. But keep in mind that you probably can't just do a BL from RAM to FLASH or vice versa because the distance is too large (much larger than the maximum distance within RAM or FLASH).

I have used something similar to this to write a timed delay loop (on LPC2148 IIRC) because RAM timing is much more predicatble than FLASH timing (due to wait states, read buffering, alignment, etc.)

\$\endgroup\$
1
  • 1
    \$\begingroup\$ But a BLX will always work. \$\endgroup\$ Jul 31, 2018 at 13:53
1
\$\begingroup\$

It is possible to protect the stack against execution using the Memory Protection Unit (MPU) of the Cortex-M4, but this is rarely done. So yes, it should generally be possible to execute code on the stack.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.