How does the Rabbit stack protection work?

The Rabbit 3000A to 6000 have a “stack protection” feature. But it feels like there is a lack of details in the manual.

According to the Rabbit 3000 manual, any “stack-relative memory” or “stack operation” outside the set boundaries or within 16B of the set boundaries access should trigger the interrupt.

What is a “stack operation”? Does it include add sp, d and ld sp, hl? If yes, is sp still written?

What happens on a stack-relative write outside the boundaries? Is the memory still written?

For the Rabbit 4000, the manual states that writes within 16B below the upper or 16B above the lower limit will trigger the interrupt. What about reads? What happens when attempting to access memory outside the bounds?

So according to the textual description, in the section on memory protection, Rabbit 3000A differs from the Rabbit 4000 and later (any stack operation or memory access outside or within 16B of the boundaries vs. write accesses to the 16B near the boundaries only)? But the register descriptions still are the same for both, referring to interrupts triggered on any stack operation or memory access outside or within 16B of the boundaries?

A stack is a library of sorts such as a TCP/IP library or Modbus library. The stack protection helps prevent an over follow from occurring and damaging the (Stack Library).

You might need to do some testing to get those answers. The chips were released long ago, and it’s unlikely that I’ll be able to track down additional details on that feature. If the Dynamic C libraries don’t make use of the registers, it was one of many chip features that Z-World/Rabbit/Digi never officially supported. For example, the Rabbit 6000 had USB support and two integrated PIC-like controllers (FIMs) that were tested but not supported by the libraries.

Hmm. I’ve tried today, wrote test cases for various thing I could think of (set sp to somewhere in the forbidden range, either within the 16B part or beyond the bound, do so via direct load to sp vs. via add sp, #d, try to read in 16B part or beyond bound, write there, go into 16B area via push or pop). I tried on a Rabbit 3000A and a Rabbit 4000. Nothing triggered the stack violation interrupt (by contrast, the periodic interrupt and rst 0x10 work fine, so my interrupt setup should be ok). My test code is at at http://colecovision.eu/stuff/test-rabbit-stack-protection.c, I compiled it with SDCC from the current rabbit branch.