Saravana Pandian Annamalai
25. April 2019 · Write a comment · Categories: ARM, Embedded Software · Tags: , , ,

In our earlier blogs on ARM Interrupt architectures, we explored the ARM exception models and registers. Also, we went through different kinds of Interrupt controllers being used. In the upcoming blogs, we will primarily see ARM Interrupt handling from the firmware/software perspective including operating systems like FreeRTOS, Linux and WinCE. To being with, this blog will discuss interrupt handling in ARM Cortex M MCUs.

Cortex M Vector Table

As discussed earlier, the ARM Cortex M series of MCUs typically carters to lower end application with the core running between a few MHz to a maximum 150MHz. To target low cost tools and ease of development, the interrupt architecture is designed to be simpler and straight forward. The vector table in ARM Cortex M series looks like:

Cortex M Vector Table

Typically, on power-on reset, the Vector table base address is defined to be at 0. The ARM core, up on boot up, loads the stack pointer with the value stored at offset 0. And then it loads the Program counter with the address available at offset 4 and starts executing the same.

Thus, the vector table design is such that the stack is operational before the core starts executing thereby eliminating the need for an assembly code to set things up for calling functions. In the firmware perspective, this is a major advantage. There is no need to write any assembly code.

Following these 2 words, the table should hold the addresses of the exception handlers. The first 14 of them are pre-defined ad reserved for handling specific to the core and its execution. From offset, 0x40, the SoC specific interrupt handlers are defined and can be customized by the silicon vendor.

It can also be noted that there is a priority associated with each of these exceptions. Lower the number the higher the priority. Some of the major exceptions defined by ARM are

Reset Handler

At the highest priority of -3, this is the entry point of execution. Loaded to PC on power on reset, this is responsible for initializing the system peripherals and start executing the firmware/OS.

NMI Handler

At a priority only next to Reset Handler (-2), as the name suggests this cannot be masked by software. It is typically triggered by a specialized peripheral unit that can be connected to a critical functionality.

HardFault Handler

This exception is caused when there is an error during exception processing. At a higher priority of -1 than other exception, this can be used to recover from issues during exception handling.

MemManage Handler

Caused due to memory protection faults, the priority level can be configured by the firmware.

BusFault Handler

Caused during to memory access – either during instruction fetch or data access, the priority level can be configured by the firmware

UsageFault Handler

Caused during to instruction executing, the priority level can be configured by the firmware. The handler is called when one of the following errors occurs

  • Presence of an undefined instruction
  • Performing an illegal unaligned access
  • Core in invalid state on instruction execution
  • An error occurring on exception return.
  • Doing an unaligned address on word and halfword memory access
  • Performing division by zero

SVCall Handler

Known as the Supervisor Call, this handler is called up on the core executing a SVC instruction. This is typically used in OS environments to execute system services.

PendSV Handler

This is typically used in OS environments to perform context switching.

SysTick Handler

The ARM Cortex M core defines a specialize timer module to keep track of the System time. This handler is executed once this timer value reaches 0.

With this understanding of Cortex M vector table, now we will see how the firmware handles exceptions in software.

Cortex M Vector Table

To practically understand Cortex M Interrupt handling, we will take an example of software implementation of FreeRTOS running on NXP K66 MCU compiled using GCC tool chain. The first and foremost step is to define the vector table and place it in the Vector base location. The vector table for the device looks like this:

__attribute__ ((used, section(“.isr_vector”)))

void (* const g_pfnVectors[])(void) = {

// Core Level – CM4

&_vStackTop,                            // The initial stack pointer

ResetISR,                                   // The reset handler

NMI_Handler,                           // The NMI handler

HardFault_Handler,                   // The hard fault handler

MemManage_Handler,              // The MPU fault handler

BusFault_Handler,                     // The bus fault handler

UsageFault_Handler,                 // The usage fault handler

0,                                                // Reserved

0,                                                // Reserved

0,                                                // Reserved

0,                                                // Reserved

SVC_Handler,                           // SVCall handler

DebugMon_Handler,                // Debug monitor handler

0,                                               // Reserved

PendSV_Handler,                     // The PendSV handler

SysTick_Handler,                     // The SysTick handler


// Chip Level – MK66F18

DMA0_DMA16_IRQHandler,       // 16 : DMA Channel 0, 16 Transfer Complete

DMA1_DMA17_IRQHandler,       // 17 : DMA Channel 1, 17 Transfer Complete

DMA2_DMA18_IRQHandler,       // 18 : DMA Channel 2, 18 Transfer Complete



UART0_RX_TX_IRQHandler,      // 47 : UART0 Receive/Transmit interrupt



CAN1_Tx_Warning_IRQHandler,  // 113: CAN1 Tx warning interrupt

CAN1_Rx_Warning_IRQHandler,  // 114: CAN1 Rx warning interrupt

CAN1_Wake_Up_IRQHandler,      // 115: CAN1 wake up interrupt


}; /* End of g_pfnVectors */

As it can be seen, the interrupt handlers are clubbed together as an array with the address to the top of the stack (lowest address as it grows towards higher address) as the first element. This array is placed in address 0, via linker script mechanism. In this example, using the section (.isr_vector) keyword, the location of the vector table is set to 0.

Also, it can be noted that there are hundreds of interrupt handlers supported. Even this example has close to 115 handlers. Obviously, a firmware system will not have all these implemented, hardly 20-30 interrupts will be used in a system. Instead of asking the user to define handlers, the start-up code provided by the silicon vendors, will have dummy functions (a while (1) loop) defined with weak reference.

weak void NMI_Handler(void)

{ while(1) {}


WEAK_AV void SVC_Handler(void)

{ while(1) {}


So, when the developer defines an interrupt handler with the same name in his code, this weak function will be discarded and user-defined function linked against instead.

Cortex M Interrupt Handling

With the vector table installed, the functions that are needed can be added one by one in the firmware. As a first step, the Reset Handler has to be created. At typical, reset handler will look like as below.

void ResetISR(void) {

// Disable interrupts

__asm volatile (cpsid i”);

// If __USE_CMSIS defined, then call CMSIS SystemInit code



// Copy the data sections from flash to SRAM.


unsigned int LoadAddr, ExeAddr, SectionLen;

unsigned int *SectionTableAddr;

// Load base address of Global Section Table

SectionTableAddr = &__data_section_table;

// Copy the data sections from flash to SRAM.

while (SectionTableAddr < &__data_section_table_end) {

LoadAddr = *SectionTableAddr++;

ExeAddr = *SectionTableAddr++;

SectionLen = *SectionTableAddr++;

data_init(LoadAddr, ExeAddr, SectionLen);


// At this point, SectionTableAddr = &__bss_section_table;

// Zero fill the bss segment

while (SectionTableAddr < &__bss_section_table_end) {

ExeAddr = *SectionTableAddr++;

SectionLen = *SectionTableAddr++;

bss_init(ExeAddr, SectionLen);


// Reenable interrupts

__asm volatile (cpsie i”);



// main() shouldn’t return, but if it does, we’ll just enter an infinite loop


while (1) {




This minimalistic handler, disables all interrupts up on entry, configures the core and major peripherals via SystemInit function. Then it initializes the data and bss sections. Finally, it enables the interrupts before jumping to the main function.

Now we will see how a peripheral is configured for interrupt operation based on the Systick unit.

uint32_t SysTick_Config(uint32_t ticks)


if ((ticks – 1UL) > SysTick_LOAD_RELOAD_Msk)


return (1UL); /* Reload value impossible */


SysTick->LOAD = (uint32_t)(ticks – 1UL); /* set reload register */

NVIC_SetPriority (SysTick_IRQn, (1UL << __NVIC_PRIO_BITS) – 1UL); /* set Priority for Systick Interrupt */

SysTick->VAL = 0UL; /* Load the SysTick Counter Value */

SysTick->CTRL = SysTick_CTRL_CLKSOURCE_Msk |


SysTick_CTRL_ENABLE_Msk; /* Enable SysTick IRQ and SysTick Timer */

return (0UL); /* Function successful */


As the code listing shows, the function configures various registers needed for proper operation of the Systick interrupt such as LOAD, VAL, CTRL etc. IT=t also configures the priority of the interrupt. As mentioned earlier, in Cortex M architecture, each of the interrupts has an associated priority. Depending on the implementation, there could be n number of bits corresponding to each interrupt number. Lower the number, higher the priority/urgency and can be set via the NVIC_SetPriority CMSIS API. With this mechanism, it is possible for the interrupts to be prioritized and only the higher priority one will be serviced if more than one interrupt is pending at the same time.

Typical handler for SysTick looks like:

void SysTickHandler( void )


/* The SysTick runs at the lowest interrupt priority, so when this interrupt

executes all interrupts must be unmasked. There is therefore no need to

save and then restore the interrupt mask value as its value is already

known. */



                    /* Increment the RTOS tick. */

                    if( xTaskIncrementTick() != pdFALSE )


                                  /* A context switch is required. Context switching is performed in the PendSV interrupt. Pend the PendSV interrupt. */

                            portNVIC_INT_CTRL_REG = portNVIC_PENDSVSET_BIT;





Cortex M Interrupt Handling via Assembly

So far, we have not writing a single line of assembly code and still able to do all the required functionality in software. In some cases, there will be a need to do assembly code. In these cases, the handler can be defined as naked function (Which will not generate any stack push/pop and return codes) and implement them in assembly.

For example, in FreeRTOS, the SVC Handler implementation is as below:

void vPortSVCHandler( void ) __attribute__ (( naked ));

void vPortSVCHandler( void )


     __asm volatile (

     ldr r3, pxCurrentTCBConst2 \n” /* Restore the context. */

     ldr r1, [r3] \n” /* Use pxCurrentTCBConst to get the pxCurrentTCB address. */

     ldr r0, [r1] \n” /* The first item in pxCurrentTCB is the task top of stack. */

     ldmia r0!, {r4-r11, r14} \n” /* Pop the registers that are not automatically saved on exception entry and the critical nesting count. */

     msr psp, r0 \n” /* Restore the task stack pointer. */

     isb \n”

     mov r0, #0 \n”

     msr basepri, r0 \n”

     bx r14 \n”

     ” \n”

     ” .align 4 \n”

     “pxCurrentTCBConst2: .word pxCurrentTCB \n”



Thus with compiler extensions, it is possible to include assembly based interrupt handling as well.

Switching Vector tables

In the above examples, we have noted that the vector table is located at address 0. But there are cases, where we will need to place it at a different location. For example, the flash location could be at address 0, and the RAM, where the user wants to place the vector table could be elsewhere. Or it could be a dual A/B firmware or a bootloader/application firmware each sitting at a different location. So, based on the current code being executed, the vector table location differs.

ARM provides a simple mechanism to switch the base address of the vector table. It provides a Vector table offset register at address 0xE000ED08 in the NVIC group, where the base address can be programmed. For example, to switch the vector location to address 0x20000000, following lines will suffice.

Saravana Pandian Annamalai
27. October 2016 · Write a comment · Categories: ARM, Embedded Software, Technology · Tags: ,

With an understanding of ARM registers and Exception model, now we are ready to explore the ARM interrupt controllers. These are the modules that sit in between the interrupt sources (peripherals) and ARM cores deciding how to route the interrupts to.

The ARM core accepts only two input signals handling unscheduled interrupts from the external systems – nIRQ and nFIQ. If IRQ is asserted, the system enters IRQ mode as discussed earlier or if FIQ is asserted, FIQ mode is entered.

It is up to the ARM licences i.e SoC manufacturer to decide the mechanism to route the interpret signals to the core. There are many ways to implement the interrupt controllers each of which are discussed in detail in this blog.

Vendor Specific Model

In the early ARM implementations where there used to be only one core in general, the logic for this routing of interrupts to the core is done by the SoC manufacturer mostly based on their design philosophy. More likely there will be a set of following registers

  • RAW Interrupt Status register
  • Interrupt Enable Register
  • Interrupt Status Register
  • IRQ Priority Encoding
  • FIQ/IRQ Selection

Up on assertion of any interrupt line, the interrupt source is checked if it is configured as FIQ. If so, the signal is routed to the core immediately. If it is an IRQ interrupt, ARM interrupt status is updated. If multiple interrupts occur simultaneously, the priority is resolved between other pending interrupts and finally the core is given the interrupt signal.

The below diagram gives a model implementation for the Interrupt Controller by Freescale called the Interrupt Collector (ICOLL) used in Freescale/NXP iMx233/iMx28 series of MCUs.

Freescale Interrupt Collector

Vendor specific Interrupt Controller

Vectored Interrupt Controller – VIC

ARM itself came up with a model called Vectored Interrupt Controller (VIC). Sitting directly on the AMBA High Speed bus, the latency is significantly reduced. Being an early generation controller it supports 32 interrupt sources each of which can be routed to either FIQ or IRQ signals. A unique feature of VIC is that, as it name suggests, it supports 16 vectored interrupts. In this there are 16 registers where the address of the corresponding interrupt service routines (ISR) can be saved. Based on the priority, the VIC identifies the high priority interrupt and loads its ISR address to a register called VICVectAddr. The firmware can simply use a LDR PC instruction to jump to this ISR. This saves a lot of software effort in branching to the ISR there by reducing latency.

Interrupt Controller from ARM

Vectored Interrupt Controller (VIC)

But VIC supports only level sensitive interrupts that must remain active HIGH till the ISR services it. Thus for these reasons, many SoC designers preferred their own implementation rather than the VIC.

Generic Interrupt Controller – GIC

As processors evolved, soon the number of interrupts became quiet large and also it was not uncommon to have more than 1 core (either symmetric or asymmetric), there was a need for a more standardized way of handling interrupts.

ARM defines Generic Interrupt Controller that suits this need. Though vendors are still free to choose their own mechanism, GIC has become very popular and is almost present in all modern SoCs. It consists of primarily two components – Distributor and CPU interfaces. The primary functionalities of the same include


This is the peripheral facing component that is available as only one implementation (instance). It is responsible for managing interrupts in the whole system and decides priorities between them and routing mechanism of the same.

CPU Interfaces:

For each CPU core available, there is a corresponding CPU Interface present bridging the Distributor interface with the core. It implements the priority masking for the processor.

The below diagram explains the same.


ARM's Interrupt Controller for Multi-core SoCs

ARM Generic Interrupt Controller (GIC)

The interrupts are identified by unique ID and could be in any one of the following 4 states (as explained by the GIC Architecture Specification):

  • Inactive: An interrupt that is not active or pending.
  • Pending: An interrupt from a source to the GIC that is recognized as asserted in hardware or generated by software and is waiting to be serviced by a target processor.
  • Active: An interrupt from a source to the GIC that has been acknowledged by a processor, and is being serviced but has not completed.
  • Active and pending: A processor is servicing the interrupt and the GIC has a pending interrupt from the same source.

Based on the source, there are three major types of interrupts defined.

Shared Peripheral Interrupts – SPI: These interrupts sources are typically from different peripherals in the system. They can be routed to (i.e shared with) any one or more of the cores as per the requirement and will be handled suitably. For example, UART0 and UART1 interrupts could be SPI and configured in the Distributor to be routed to two available cores. Up on UART0 interrupt, the signal is routed to first available processor. If at that instance, UART1 interrupt is received, the distributor routes it to the other core for handling.

These are assigned Interrupt ID from 32 to 1019.

Private Peripheral Interrupts – PPI: There could be interrupts that are only specific to one processor. In such cases, they are routed to PPI of only that processor. For example in an asymmetric system with a Cortex A5 and Cortex M4, a Watchdog interrupt corresponding to A5 will be routed only to the A5 core. There might be no need to share it with the M4. Hence it will be routed as a PPI.

The interrupt ID is defined from 16 to 31.

Software Generated Interrupts – SGI: ARM defines interrupt IDs 0 through 15 specifically for Inter processor communication. It is possible a SGI can be routed to one or more processors through the Distributor.

The Interrupts 0 to 31 are banked by the distributor for each CPU Interface i.e. each processor sees them different and are identified by the CPUID. For example, PPI 16 could be pending in CPU0 but not in CPU1. Whereas, in case of the SPI, it will be same across the CPU’s as they are not banked.

Irrespective of all these, each core is provided signal through either nIRQ or nFIQ lines for interrupting program execution.

Nested Vectored Interrupt Controller – NVIC

While the above implementations are suitable for powerful processors, there is a need for specialized handling in microcontroller profiles that typically run in sub-100MHz speed and with few tens of kilobytes of RAM and flash. It is important to reduce the interrupt latency and to leverage the fact that the number of peripherals is less and hence fewer interrupt sources. For that, ARM defines a NVIC model for the Cortex-M implementations.

In Cortex-M implementation, the interrupt service routine addresses are to be provided in a set of consecutive addresses at offsets corresponding to the vector number. As soon as the interrupt signals are received, the NVIC finds the ISR corresponding to the highest priority interrupt and jumps to it.

The Cortex-M core accepts only nIRQ interrupt and there is no option for a FIQ.

With our understanding of hardware implementation, in the upcoming blogs, we will discuss software mechanism in handling interrupts in ARM architectures.

Saravana Pandian Annamalai
27. August 2015 · Write a comment · Categories: ARM, Embedded Software, Technology · Tags: ,

Continuing our series on interrupts, this blog will capture the ARM interrupt architecture along with the evolution of the same from the early ARMv4 to the latest ARMv8 models. A fair outline of overall flow, including the exception/ registers model, is given to aid the reader understand the principles behind the ARM interrupt architecture design.

ARM Instruction Set

ARM architecture has continuously evolved since its introduction. Beginning with ARMv4, architecture evolution is labeled with incremental values like ARMv5, ARMv6 till the latest ARMv8. There are additions and extensions that are labeled with a suffix like ARMv5TE or ARMv6K.

As with any RISC core, ARM supports very few instructions and is capable of executing them fast at a rate of 1 instruction per clock using techniques such as pipelining, branch prediction, caching etc.

Many RISC architectures define a set of instructions and encoding that will be executed by the processor. But ARM Architecture is an advanced design that supports different instruction sets that can be changed dynamically. Each of these instruction execution modes offer unique advantage like higher code density, support for Java execution etc. Few of the instruction sets supported are

ARM: The default mode that operates with fixed width (32-bit) instructions. Automatically changed to this mode when an interrupt/exception occurs.

Thumb: It is a 16-bit instruction set that can be used for higher code density. It is has limited set of instructions and registers compared to ARM mode, but can be advantageous if limited register manipulations are done.

Thumb2: Introduced in ARMv6T2, this brings the best of both worlds, by supporting mixed 16 bit and 32 bit instructions able to achieve very higher code density and performance. This has become popular that modern OS like Windows Embedded Compact has made this the default execution mode. Even Linux kernel supports compilation to Thumb2 mode.

Jazelle: Optimized for Java code execution.

SIMD: Single Instruction Multiple Data instruction set for better data manipulation.

There are other sets like VFP, Security extension etc that are not explained in this blog. It is interesting to note that these instructions sets can be interchangeably used as switching from one to another is as simple as setting one or more bits is a register, that can be accomplished by a single instruction.

With ARMv8, two higher level Execution States are introduced – AArch32 and AArch64. While the AArch32 is mostly similar to the instructions sets in the earlier architectures, AArch64 supports a single 64 bit instructions set and registers. It is possible to transition between these during exceptions by a process called Interprocessing.

ARM Processor Modes and Exception Levels

While the instruction sets define the type of instructions supported, ARM core supports multiple modes that defines how the access privilege, current exception taken etc. The processor modes supported are

Mode Description
User Mode with minimal access privilege. It is not possible to change to other modes from this mode. In an OS, generally the applications are executed in this mode
FIQ Entered up on an Fast Interrupt being received
IRQ Entered up on an Interrupt being received
Supervisor Same set of register visibility as in User mode but with higher privileges
Monitor Part of security extension that can be used during transition from a Secure Mode to Non-secure mode.
Abort Entered when there is an error accessing data memory(Data Abort) or instruction area (Prefetch abort)
Undefined Entered when a wrong instructions is executed
System Mode that has full privileges that can be used to configure the system. Usually the kernel operates in this mode in an OS.

Of these modes, except User mode, all others are said to be privileged modes. Usually the transition between these modes is done primarily with exceptions and in limited case, with instructions.

AArch64, introduces four Exception levels, represented by ELn, that is used to determine the level of privilege. EL0 is the least privileged while EL3 is the most. The recommended usage model for the same are:

ARMv8 Exception Model

Recommended usage of ARMv8 Exception Levels

It is key to remember that the AArch32 mode processor states are still usable when executing in that.

ARM Register Model

It is generally known that there are 16 general purpose registers (R0 through R12, R13 (Stack Pointer), LR (Link Register) and PC) and two Program Status Registers (CPSR and SPSR). But few of these registers are actually banked and different registers are available for different processor modes. The register bank in AArch32 state as given in ARMv8 TRM is given below:

Registers in ARM

Arm Register Banking

Based on the current processor mode, the registers are visible to software access. i.e. if the processor is in Supervisor mode, reading R13 will return SP_svc where as access to R13 will return SP_irq in IRQ mode. For FIQ mode, lot more registers are banked enabling fewer stack push/pops for faster interrupt processing. Also, since the FIQ vector is at the end of the vector table, the handler (ISR) can be directly placed at the FIQ vector address rather than having a branch to ISR instruction as in case of other exceptions.

In AArch64 mode, there are 31 64-bit general purpose registers labeled XL0 to XL30. XL30 is generally used as Procedure Link Register. None of these are banked. But there are few registers that are banked for each Execution level – Stack Pointer (SP), the Exception Link Register (ELR) and the Saved Process State Register (SPSR). To enable access of AArch32 registers from AArch64 state, the AArch32 registers are mapped to lease significant 32-bits of the AArch64 registers. The mapping of the same as given by ARM is as follows

  X0-X7 X8-X15 X16-X23 X24-X30
0 R0 R8_usr R14_irq R8_fiq
1 R1 R9_usr R13_irq R9_fiq
2 R2 R10_usr R14_svc R10_fiq
3 R3 R11_usr R13_svc R11_fiq
4 R4 R12_usr R14_abt R12_fiq
5 R5 R13_usr R13_abt R13_fiq
6 R6 R14_usr R14_und R14_fiq
7 R7 R13_hyp R13_und No Register

ARM Exceptions Model

In ARM architecture, anything that affects sequential flow of instructions is called an exception. For example, it could be an occurrence of an interrupt, access of wrong memory or even power-cycling the system. These exceptions are clearly defined along with the specific steps taken on an exception – typically involving change in processor mode and jumping to a vector address. Some of the defined exceptions are

Exception Description Entered Mode Vector Offset
Reset Entered on power on reset Supervisor mode 0x00
Undefined Instruction Invalid/Unimplemented instruction Undefined 0x04
Supervisor Call Usually by SWI/SVC instruction. Used for system call implementation Supervisor 0x08
Secure Monitor Call Usually by SMC/SMI instruction. Monitor 0x08
Prefetch Abort Invalid instruction memory access Abort 0x0C
Data Abort Invalid Data memory access Abort 0x10
IRQ Interrupt request to the core IRQ 0x18
FIQ FIQ request to core FIQ 0x1C

When any of these exceptions occurs in an ARM core, following set of sequences happens:

  • CPSR is copied to the SPSR of the mode being entered.
  • Processor mode is set to the new state
  • Whatever the existing instruction set being executed, it is changed to ARM state
  • Return address (of mode being left) is stored to the link register of the mode being entered
  • PC is set to the vector address corresponding to the entered exception

Now that the processor is in the new exception mode, the corresponding registers are banked. The software can choose to handle the exception as desired. Care should be taken that no registers are corrupted or lost, due to multiple or nested exceptions. Registers can be backed up in the stack.

To return back to the interrupted code, following operations can be done:

  • Restore the registers back to the original values (by popping from stack)
  • The above process can be done using a single instruction LDMFD^ if possible.

For AArch64, numerous exception classes are defined that are source of the exceptions like WFI, Illegal execution state, Misaligned PC Exception etc. The cause of exception can be obtained from the Exception Syndrome Register (ESR). The major happenings on an exception entry, as given by ARMv8 TRM,

  • The PE state is saved in the SPSR_ELx at the Exception level the exception is taken to.
  • The preferred return address is saved in the ELR_ELx at the Exception level the exception is taken to.
  • Execution moves to the target Exception level, and starts at the address defined by the exception vector.
  • The stack pointer register selected is the dedicated stack pointer register for the target Exception level.

To return from exception, an ERET instruction can be used. On executing the same:

  • PC is restored with the value held in the ELR_EL of level returning from.
  • PSTATE is restored by using the contents of the SPSR_EL of level returning from.

It is possible to switch from AArch64 to AArch32 states using exceptions.

Thus ARM Architecture is evolving fast to accommodate the growing requirements in computing. Now with basic idea about, the instruction set, register sets and exception model in ARM architecture, we will see about the Interrupt Architecture in specific in the upcoming blog.