Exceptions, Interrupts & NVIC

• The Nested Vectored Interrupt Controller is part of the core, not an SoC peripheral — same register layout on every Cortex-M.
• Tightly-coupled to the pipeline: vector fetch and register stacking happen concurrently during exception entry.
• Up to 240 external IRQs (v6-M: 32; v8-M: up to 480).
• Pre-emptive, priority-based, deterministic latency.
• Exception entry & exit sequences implemented in hardware — the handler looks like an ordinary C function.

Offset    Word
0x0000    Initial MSP (loaded into SP at reset)
0x0004    Reset_Handler
0x0008    NMI_Handler
0x000C    HardFault_Handler
0x0010    MemManage_Handler
0x0014    BusFault_Handler
0x0018    UsageFault_Handler
0x001C    SecureFault_Handler  (v8-M)
0x0020    (reserved)
0x0024    (reserved)
0x0028    (reserved)
0x002C    SVC_Handler
0x0030    DebugMon_Handler
0x0034    (reserved)
0x0038    PendSV_Handler
0x003C    SysTick_Handler
0x0040    IRQ0_Handler         ; vector 16
0x0044    IRQ1_Handler
...       ...

• Table lives at the address held in VTOR (SCB->VTOR, at 0xE000_ED08).
• At reset VTOR = 0, so the table must be at address 0 or the SoC remaps flash/ROM there.
• Relocating to SRAM is a common trick: copy table, update VTOR, enable one ISR at a time.
• VTOR must be aligned to the next power-of-two above (num_vectors × 4) — typically 128 or 256 bytes minimum, larger for big tables.
• v8-M TrustZone: two VTORs — VTOR_S (privileged-Secure) and VTOR_NS (Non-Secure).

• Lower numerical value = higher priority (counter-intuitive — source of many bugs).
• System exceptions Reset/NMI/HardFault have fixed negative priorities and cannot be reordered.
• All other exceptions (incl. configurable faults, PendSV, SysTick, external IRQs) are programmable.
• Priority field is architecturally 8 bits but only the top N bits are implemented.

How many bits?

Most ST/NXP STM32/LPC parts implement 4 bits → 16 levels. Nordic nRF52 implements 3 bits → 8 levels.

Each priority field is split into preempt priority (upper) and sub-priority (lower) by AIRCR.PRIGROUP.

Preempt = can I interrupt another ISR?
Sub = who runs first if multiple are simultaneously pending at the same preempt level?

Entry (12 cycles)

• Stacking of 8 words overlapped with vector fetch.
• Load PC from vector → start fetching ISR.
• On M7 (dual-issue + cache), typical entry is 10 cycles best-case from a hit.

Exit (12 cycles)

• BX lr with EXC_RETURN pattern triggers unstack.
• 8 words popped; IPSR & control restored; instructions of pre-empted code resume.
• Unless a new exception is pending at equal-or-higher priority → tail-chain (next slide).

Without tail-chaining (hypothetical)

Two 12-cycle stacks + two 12-cycle unstacks = 48 cycles of pure overhead.

With tail-chaining (actual)

Frame stays on stack; only 6 cycles to fetch new vector & enter ISR2. Saves ~20 cycles per chained pair.

Scenario

A low-priority IRQ fires → CPU starts stacking. Midway through, a higher-priority IRQ fires.

• The NVIC monitors pending IRQs during stacking.
• If a higher-priority exception arrives, CPU completes the in-flight stacking (frame is valid) and redirects the vector fetch to the new target.
• The lower-priority exception becomes pending → eventually tail-chains after the higher one.

During exit unstacking…

• If another IRQ preempts while the CPU is in the middle of unstacking, pop is aborted.
• The current frame is reused — no re-push — and the new ISR vector is fetched.
• Requires the frame to still be valid on the current stack; CPU guarantees that by only aborting in the early pop cycles.

Without lazy stacking

• On exception entry, if FPU is active, CPU always pushes 18 extra FP words (S0–S15, FPSCR, padding).
• ~17 extra cycles on M4, 20+ on M7.
• Wasted if the ISR does not touch the FPU.

With lazy stacking

• CPU reserves space (advances SP by 18 words) but skips the writes.
• Sets FPCCR.LSPACT = 1.
• If the ISR ever executes an FP instruction → hardware detects this, performs the deferred save, then continues.
• If it never does → no FP registers written. Full save / restore avoided.

/* Enable lazy stacking (default on M4F with FPU on) */
#define FPCCR   (*(volatile uint32_t*)0xE000EF34)
#define FPCCR_ASPEN  (1U << 31)
#define FPCCR_LSPEN  (1U << 30)

/* Most startup code sets both:
   ASPEN = automatic FP state preservation on exception
   LSPEN = lazy — defer until the handler uses FPU */
FPCCR |= FPCCR_ASPEN | FPCCR_LSPEN;

• WIC is a small always-on block that duplicates the NVIC's mask logic.
• In deep sleep, core & NVIC are clock-gated (M7+) or power-gated (state-retentive).
• When a masked-in IRQ asserts → WIC asserts WAKEUP to the power-management IP → clocks restore → NVIC takes the interrupt normally.
• Entry latency grows by clock-start time (typ. a few µs to ~100 µs depending on LDO/PLL).

Needed because without the WIC, the NVIC cannot sense the IRQ line while its clock is off. With the WIC, sub-µA deep sleep with IRQ wake is possible.

SVCall synchronous

• Triggered by the SVC #imm instruction in user code.
• Runs at configured priority (typically high) — returns via unstack as normal.
• Classic use: syscall trampoline — user task requests kernel action; handler reads the imm byte to dispatch.
• On v8-M, SVC from Non-Secure traps into NS handler; S-side has its own.

PendSV software-pended

• Set by writing SCB->ICSR.PENDSVSET.
• Runs at its own priority slot; typically configured as the lowest priority.
• Used by RTOS kernels for the context switch — PendSV is guaranteed to run after all higher-priority IRQs finish, so the switch can never pre-empt a critical ISR.
• Classic FreeRTOS pattern: SysTick or kernel syscall pends PendSV → PendSV_Handler performs the switch.

• 24-bit down-counter in the SCS. Counts at core clock or external (impl.-defined) clock.
• Fires SysTick exception (#15) on reload.
• Register set:
  • SYST_CSR — enable, tickint, clksource, countflag.
  • SYST_RVR — reload value.
  • SYST_CVR — current.
  • SYST_CALIB — implementation-provided 10 ms calibration constant.

/* 1 kHz tick on a 168 MHz M4 */
#define SYST_CSR  (*(volatile uint32_t*)0xE000E010)
#define SYST_RVR  (*(volatile uint32_t*)0xE000E014)
#define SYST_CVR  (*(volatile uint32_t*)0xE000E018)

void systick_init(uint32_t core_hz, uint32_t tick_hz)
{
    SYST_RVR = core_hz / tick_hz - 1; /* 167 999 */
    SYST_CVR = 0;                     /* clear */
    SYST_CSR = (1U<<2) |   /* CLKSOURCE = core */
               (1U<<1) |   /* TICKINT */
               (1U<<0);    /* ENABLE */
}

A single 24-bit counter means max interval at 168 MHz ≈ 99.9 ms. Tickless RTOS designs pair SysTick with the RTC for longer sleeps.

Where the evidence lives

• SCB->HFSR — hard-fault status. FORCED=1 means an escalated configurable fault.
• SCB->CFSR — configurable fault status register. Three bytes: MMFSR / BFSR / UFSR.
• SCB->MMFAR — fault address if MMARVALID.
• SCB->BFAR — bus-fault address if BFARVALID.
• Auto-stacked frame holds the faulting PC, LR, xPSR.

__attribute__((naked))
void HardFault_Handler(void)
{
    __asm volatile (
        "TST lr, #4          \n"
        "ITE EQ              \n"
        "MRSEQ r0, MSP       \n"
        "MRSNE r0, PSP       \n"
        "B hard_fault_c      \n");
}

void hard_fault_c(uint32_t *sf)
{
    uint32_t pc   = sf[6];
    uint32_t lr   = sf[5];
    uint32_t psr  = sf[7];
    uint32_t cfsr = SCB->CFSR;
    /* write to RTT / flash / UART, then NVIC_SystemReset */
}

Pattern: find the stack used at fault (MSP/PSP via bit 2 of LR/EXC_RETURN), grab stacked PC + CFSR, log it, reset.

/* Enable a peripheral IRQ at priority 0x50 */
NVIC_SetPriority(EXTI0_IRQn, 0x50);
NVIC_EnableIRQ(EXTI0_IRQn);

/* Pend in software */
NVIC_SetPendingIRQ(EXTI0_IRQn);

/* Get active ISR# (nonzero in Handler mode) */
uint32_t vect = __get_IPSR();

/* Atomic critical section for BASEPRI-filterable IRQs */
uint32_t prev = __get_BASEPRI();
__set_BASEPRI(0x20);
/* … */
__set_BASEPRI(prev);

Under the hood

• NVIC_EnableIRQ(n) → sets bit n%32 in NVIC->ISER[n/32].
• NVIC_SetPriority(n, p) → writes the upper __NVIC_PRIO_BITS bits of p to NVIC->IPR[n].
• Faults / PendSV / SysTick use SCB->SHPR[1..3] instead of IPR.
• CMSIS macros on v8-M automatically target the Secure or NS register bank based on the current state — no source changes needed when moving code S↔NS.

• Two vector tables: VTOR_S (Secure) and VTOR_NS (Non-Secure). Every exception is either S or NS depending on target state.
• Each fault type can be banked — S and NS each has its own MemManage/Bus/Usage handler.
• When an exception crosses domains, hardware stacks additional context (DCRS bit in EXC_RETURN).
• NMI and HardFault can be configured to always target Secure (AIRCR.BFHFNMINS).

• Stacking of additional state + an integrity signature prevents NS code from forging a return into S.
• Priority register banks: NS code cannot raise its priority above the NS-Prio boundary set by S at boot.
• SecureFault (exception #7) is dedicated to TZ violations — separate from MemManage/Bus/Usage.