============================================================

1. The Big Picture — What Happens on an Exception

When an exception (interrupt, fault, SVC, PendSV, SysTick…) fires, the Cortex-M4 hardware performs two distinct actions automatically before the first instruction of the ISR runs:

1. State save (push): It pushes 8 registers onto the currently active stack (PSP if Thread mode was using PSP, else MSP).
2. Mode change: It switches to Handler mode, forces MSP as the active SP, loads the ISR vector from the vector table into PC, and places a special EXC_RETURN value into LR.

When the ISR executes BX LR (or any return instruction), the processor reads the EXC_RETURN value that was stored in LR, uses it to decide which stack to restore from, pops the 8 registers back, and returns to exactly where it was interrupted.

============================================================

2. The Automatic Stack Frame (Exception Stack Frame)

The Cortex-M4 pushes exactly 8 registers in a specific order. This is called Stack Frame 1 (SF1) — the hardware-managed frame. If the FPU is active, an additional 17 words (S0–S15, FPSCR, aligner) may be pushed (Extended Frame), but we focus on the basic frame here.

Stack Frame Word-by-Word (array indexing)

When you capture the stack pointer in your handler (e.g., MRS R0, MSP), R0 points to pBaseStackFrame[0] = R0. The indices are:

============================================================

3. EXC_RETURN — The Magic Link Register Values

When the processor enters an exception handler, it loads LR with a special value called EXC_RETURN. The upper 28 bits are all 1s (0xFFFFFFF?), and the lower 4 bits encode the return context. When a BX/POP/LDM with PC reaches the processor while in Handler mode with an EXC_RETURN value in the target register, it performs exception return instead of a normal branch.

EXC_RETURN Bit Field Decoding

/* EXC_RETURN = 0xFFFFFFFD — bit-by-bit */
Bits[31:4] = 0xFFFFFFF  /* all ones — signals this is EXC_RETURN */
Bit [3]    = 1          /* Return to Thread mode (0 = return to Handler) */
Bit [2]    = 1          /* Restore SP from PSP  (0 = restore from MSP) */
Bit [1]    = 0          /* Reserved, always 0 */
Bit [0]    = 1          /* Reserved, always 1 */

/* EXC_RETURN = 0xFFFFFFF9 */
Bit [3]    = 1          /* Thread mode */
Bit [2]    = 0          /* Restore from MSP */

/* EXC_RETURN = 0xFFFFFFF1 */
Bit [3]    = 0          /* Handler mode (nested exception) */
Bit [2]    = 0          /* Restore from MSP */

============================================================

4. CONTROL Register — Selecting the Stack Pointer

The CONTROL register governs which stack pointer is active in Thread mode and the privilege level. It is a 3-bit register readable/writable only via MRS/MSR instructions.

Setting CONTROL = 0x2 (SPSEL=1, nPRIV=0)

#include <stdint.h>

void switch_thread_to_psp(uint32_t psp_top)
{
    /* Step 1: Load PSP register with the top of task stack */
    __asm volatile ("MSR PSP, %0" :: "r"(psp_top));

    /* Step 2: Set CONTROL.SPSEL = 1 → Thread mode will use PSP
       CONTROL = 0x02 means: privileged + PSP active             */
    uint32_t ctrl = 0x2;
    __asm volatile ("MSR CONTROL, %0" :: "r"(ctrl));

    /* Step 3: ISB — flush pipeline so CONTROL change takes effect */
    __asm volatile ("ISB");
}

============================================================

5. Key Registers — Complete Reference

NVIC ISER0 (0xE000E100)

NVIC STIR — Software Trigger Interrupt Register (0xE000EF00)

XPSR — Combined Program Status Register

============================================================

6. Complete Code Walkthrough — Exception Entry/Exit Trace

This example sets PSP to 0x20008000, switches Thread mode to use PSP (CONTROL=0x2), then fires IRQ3 via STIR. This lets us observe that the stack frame is saved to PSP while the ISR runs using MSP.

/* ================================================================
 * EXCEPTION ENTRY / EXIT DEMONSTRATION
 * STM32F407 — Registers programmed directly
 * ================================================================ */
#include <stdio.h>
#include <stdint.h>

/* ── Generate IRQ3 (RTC_WKUP on STM32F407) from software ── */
void generate_interrupt(void)
{
    uint32_t *pSTIR  = (uint32_t*)0xE000EF00; /* SW Trigger Interrupt Register */
    uint32_t *pISER0 = (uint32_t*)0xE000E100; /* Interrupt Set-Enable Register 0 */

    /* Enable IRQ3 in NVIC — set bit 3 */
    *pISER0 |= (1 << 3);

    /* Write IRQ number 3 to STIR — triggers software interrupt */
    *pSTIR = (3 & 0x1FF);
}

int main(void)
{
    /* ── Step 1: Set PSP to a valid RAM address ──────────────────
       0x20008000 is in the middle of STM32F407 SRAM (128KB total:
       0x20000000–0x20020000). We use it as our thread stack top.  */
    uint32_t psp_value = 0x20008000;
    __asm volatile ("MSR PSP, %0" :: "r"(psp_value));

    /* ── Step 2: CONTROL = 0x02 ──────────────────────────────────
       bit[1]=SPSEL=1: Thread mode SP is now PSP
       bit[0]=nPRIV=0: Thread mode remains privileged             */
    uint32_t ctrl = 0x2;
    __asm volatile ("MSR CONTROL, %0" :: "r"(ctrl));

    /* Stack pointer is now PSP = 0x20008000
       MSP still holds the main/scheduler stack                   */

    printf("Thread mode: before interrupt (SP=PSP=0x20008000)\n");

    /* ── Step 3: Fire IRQ3 ──────────────────────────────────────
       Hardware will:
       a) Push 8 regs to PSP (because Thread mode was using PSP)
          PSP decrements by 32 bytes → PSP = 0x20007FE0
       b) Switch to Handler mode, use MSP for ISR stack
       c) Load LR with EXC_RETURN = 0xFFFFFFFD (bit2=1 → pop from PSP)
       d) Set PC = vector table entry for IRQ3                    */
    generate_interrupt();

    /* ── Step 4: After ISR returns ──────────────────────────────
       Hardware pops 8 regs from PSP (restores PSP to 0x20008000)
       Returns here                                               */
    printf("Thread mode: after interrupt (PSP restored)\n");

    for(;;);
}

/* ── IRQ3 = RTC_WKUP ISR — executes in Handler mode ── */
void RTC_WKUP_IRQHandler(void)
{
    /* At this point:
       - Processor is in Handler mode
       - SP = MSP (not PSP) — ISRs always use MSP
       - LR = 0xFFFFFFFD (EXC_RETURN to Thread/PSP)
       Reading IPSR here would show 19 (16 + IRQ3)               */
    printf("Handler mode: ISR running (SP=MSP)\n");

    /* BX LR (implicit from compiler) triggers exception return:
       - Reads EXC_RETURN=0xFFFFFFFD from LR
       - Pops 8 regs from PSP
       - Returns to Thread mode with PSP active                   */
}

Execution Timeline

Verifying PSP Change with Inline Assembly

/* Read and print PSP at various points */
uint32_t read_psp(void)
{
    uint32_t psp;
    __asm volatile ("MRS %0, PSP" : "=r"(psp));
    return psp;
}

uint32_t read_msp(void)
{
    uint32_t msp;
    __asm volatile ("MRS %0, MSP" : "=r"(msp));
    return msp;
}

uint32_t read_control(void)
{
    uint32_t ctrl;
    __asm volatile ("MRS %0, CONTROL" : "=r"(ctrl));
    return ctrl;
}

uint32_t read_ipsr(void)
{
    uint32_t ipsr;
    __asm volatile ("MRS %0, IPSR" : "=r"(ipsr));
    return ipsr;  /* 0 = Thread mode, non-zero = Handler mode */
}

/* In ISR, reading MSP gives you base of exception stack frame */
void RTC_WKUP_IRQHandler(void)
{
    uint32_t msp_val = read_msp();
    uint32_t ipsr   = read_ipsr();
    printf("ISR: MSP=0x%08lX, IPSR=%lu\n", msp_val, ipsr);
    /* IPSR will be 19 (16 + IRQ3=3) */
}

Extracting Stack Frame Inside ISR

/* Naked entry point — preserves exact register state */
__attribute__((naked)) void RTC_WKUP_IRQHandler(void)
{
    /* In handler mode, SP = MSP which points to the stacked frame.
       Pass MSP as argument to C function.                         */
    __asm("MRS R0, MSP");
    __asm("B   IRQ3_Handler_c");
}

void IRQ3_Handler_c(uint32_t *frame)
{
    printf("Stacked R0  = 0x%08lX\n", frame[0]);
    printf("Stacked R1  = 0x%08lX\n", frame[1]);
    printf("Stacked R2  = 0x%08lX\n", frame[2]);
    printf("Stacked R3  = 0x%08lX\n", frame[3]);
    printf("Stacked R12 = 0x%08lX\n", frame[4]);
    printf("Stacked LR  = 0x%08lX\n", frame[5]);
    printf("Stacked PC  = 0x%08lX\n", frame[6]); /* next instruction after SVC/interrupt */
    printf("Stacked xPSR= 0x%08lX\n", frame[7]);

    /* Bit 24 of stacked xPSR should be 1 (T-bit) */
    if (frame[7] & (1 << 24))
        printf("T-bit = 1 (Thumb mode, correct)\n");
}

============================================================

7. Exception Sequence — Detailed Hardware Steps

Entry Sequence (hardware performs automatically)

Exit Sequence (when BX LR with EXC_RETURN in LR executes)

============================================================

8. Tail Chaining — Zero-Overhead ISR-to-ISR Transitions

When a higher-priority exception becomes pending while a lower-priority ISR is running, or when two exceptions are pending simultaneously, the Cortex-M4 uses tail chaining to switch from one ISR to the next without performing a full pop+push cycle.

============================================================

9. Interview Questions & Answers

Q1. What 8 registers does Cortex-M4 automatically save on exception entry?

R0, R1, R2, R3, R12, LR (R14), PC (R15), and xPSR. These are the caller-saved registers per AAPCS. R4–R11 are callee-saved and pushed manually by the compiler inside the ISR if needed.

Q2. What is EXC_RETURN and what are its three possible values?

EXC_RETURN is a special value (upper bits = 0xFFFFFFF) loaded into LR by the processor on exception entry. It encodes the return context:
• 0xFFFFFFF1 — return to Handler mode, use MSP
• 0xFFFFFFF9 — return to Thread mode, use MSP
• 0xFFFFFFFD — return to Thread mode, use PSP

Q3. If Thread mode is using PSP and an interrupt fires, which stack does the hardware push the stack frame onto?

The hardware pushes the 8-register stack frame onto the PSP (Process Stack Pointer). This is because the interrupted Thread mode code owns the PSP, and the frame belongs to that thread’s context. The ISR then runs using MSP. On return, EXC_RETURN=0xFFFFFFFD tells the processor to pop from PSP.

Q4. Can an ISR ever use PSP instead of MSP?

No. Handler mode always uses MSP regardless of CONTROL.SPSEL. SPSEL only affects Thread mode. This is a fundamental ARM Cortex-M design choice to ensure ISRs always have a predictable, dedicated stack (MSP = scheduler stack in RTOS scenarios).

Q5. What is the purpose of the T-bit in the stacked xPSR?

The T-bit (bit 24 of xPSR) indicates Thumb mode. It is saved so that when the exception returns, the processor restores the correct ISA state. On Cortex-M4, T-bit must always be 1 (all code is Thumb-2). If the restored xPSR has T-bit=0, a UsageFault (INVSTATE) is triggered immediately after return.

Q6. Why does CONTROL.SPSEL not take effect immediately after MSR CONTROL?

There can be pipeline effects. After writing to CONTROL, an ISB (Instruction Synchronization Barrier) should be executed to flush the pipeline and ensure the new SPSEL value is in effect before any subsequent instruction that depends on the SP value. Without ISB, the processor may still fetch subsequent instructions using the old SP.

Q7. In a naked ISR, why do we read MSP to get the stack frame pointer?

When an exception fires while Thread mode was using PSP, the hardware pushes the frame to PSP then switches SP to MSP for the ISR. At the start of the naked ISR, MSP points directly to the pushed stack frame (R0 at top). Reading MSP therefore gives the base address of the exception frame, allowing C code to read/modify the stacked register values.

Q8. What is tail chaining and when does it occur?

Tail chaining occurs when one ISR completes and there is another pending exception ready to run. Instead of popping the stack frame back to Thread mode and immediately pushing it again for the next ISR, the processor keeps the frame on the stack and just fetches the new ISR vector. This saves ~12 cycles and reduces interrupt latency for back-to-back interrupts.

Q9. What is late arrival in Cortex-M exception handling?

Late arrival occurs when a higher-priority exception becomes pending during the stack-push phase of entering a lower-priority exception. The processor is already doing the hardware save, so it completes the save and then switches to the higher-priority handler instead, using the already-saved frame. When the high-priority ISR finishes, it tail-chains to the lower-priority ISR.

Q10. How do you determine whether code is currently executing in Thread mode or Handler mode?

Read the IPSR (Interrupt Program Status Register) using MRS Rn, IPSR. If IPSR[8:0] = 0, code is in Thread mode. Any non-zero value means Handler mode, and the value is the exception number (1=Reset, 2=NMI, 3=HardFault, etc.). IRQ N maps to exception number N+16.

Q11. What does 8-byte stack alignment mean and why is it required?

The ARM ABI requires the stack to be 8-byte aligned at any public interface (function call or exception entry). Cortex-M4 ensures this automatically at exception entry by examining bit 9 of the saved xPSR — if an extra word was pushed as an aligner pad, this bit is set so it can be removed on return. This is needed because LDRD/STRD and VFP instructions require 8-byte-aligned accesses.

Q12. How is the exception stack frame different when the FPU is active?

With the FPU, an Extended Stack Frame is pushed: the basic 8 registers plus S0–S15 (16 FP registers), FPSCR, and a reserved word = 26 total words (104 bytes). Cortex-M4 supports lazy FP context saving where the FP registers are only pushed if the ISR actually uses FP instructions, reducing overhead when the ISR doesn’t need FP. The EXC_RETURN bit[4]=0 indicates an extended frame was used.

container