Exception interrupt returns EXC_RETURN in Cortex-M3

After entering the exception service routine, the hardware automatically updates the value of LR to the special EXC_RETURN.

When the program returns from the exception service routine and sends the EXC_RETURN value to the PC, the processor's exception interrupt return sequence is started.

Because the value of LR, EXC_RETURN, is automatically set by the hardware, do not change it unless there is a special requirement.

The upper 28 bits of RETURN are all 1, and only the value of bit[3:0] has a special meaning. The bit segment is as follows:

There are three legal EXC_RETURN values, as follows:

If the main program is running in thread mode and is interrupted while using MSP, LR=0xFFFFFFF9 in the service program (LR was automatically pushed onto the stack before the main program was interrupted).

If the main program is running in thread mode and is interrupted while using the PSP, LR=0xFFFFFFFD in the service program (LR was automatically pushed onto the stack before the main program was interrupted).

If the main program runs in Handler mode, LR=0xFFFFFFF1 in the service program (LR is automatically pushed into the stack before the main program is interrupted). This is the so-called "main program", which is more likely to be the interrupt service program that is preempted. In fact, when nested, the LR seen by the deeper ISR is always 0xFFFFFFF1.

[The value of LR is set to EXC_RETURN during an exception (thread mode uses the main stack)]

[The value of LR is set to EXC_RETURN during an exception (thread mode uses the process stack)]

【Notice】

The value of LR is automatically set by the CPU when entering an interrupt, so there is no mistake. Why is it possible that the value of LR becomes illegal when exiting an interrupt? There is only one reason: the interrupt routine modifies the value of LR and makes a wrong change.

From the format of EXC_RETURN, we can see that we cannot use the address between 0xFFFFFFF0 and 0xFFFFFFFF as any return address. In fact, there is no need to worry about making a mistake, because Cortex-M3 has marked this range as "instruction fetching unavailable area".