This document describes the system startup process for Cortex-M series processors. Upon reset, the processor will fetch the main stack pointer (MSP) and reset handler address from the vector table located at address 0x0. The reset handler will then execute in privileged thread mode. Interrupts are initially disabled. The MPU is also disabled initially, allowing access to all memory regions. The document then discusses setting up the vector table and performing additional initialization steps like MPU configuration in the reset handler.

1. System Startup for Cortex-M
Series Processors

2. Coming Out of Reset
Processor will be in thread mode with privileged operation
Processor will use main stack
Core will fetch the MSP and PC from the vector table
– Vector table will be located at address 0x0 (generally non-volatile memory)
– PSP (if used) can be set later in reset handler using MRS instruction
2
AAME TechCon 2013
TC005v02
– PSP (if used) can be set later in reset handler using MRS instruction
All interrupts are disabled
– Vector table must contain valid value for NMI Handler and Hard Fault
Handler
– PRIMASK, FAULTMASK and BASEPRI are cleared
MPU is disabled
– Default memory map is used

3. ARMv7-M Vector Table
First entry contains initial Main SP
All other entries are addresses for exception
handlers
– Must always have LSBit = 1 (for Thumb)
Table has up to 496 external interrupts
– Implementation-defined
– Maximum table size is 2048 bytes
16 + N
…
16
15
14
13
Debug Monitor
Reserved
PendSV
SysTick
External 0
…
External N0x40 + 4*N
…
0x40
0x3C
0x38
0x34
Address Exception #
3
AAME TechCon 2013
TC005v02
Table may be relocated
– Use Vector Table Offset Register
– Still require minimal table entries at 0x0 for
booting the core
Each exception has an exception number
– Used in Interrupt Control and State Register
to indicate the active or pending exception
type
Table can be generated using C code
– Example provided later
Reserved (x4)
Usage Fault
Mem Manage Fault
Hard Fault
NMI
Reset
Initial Main SP
0x1C to 0x28
0x18
0x14
0x10
0x0C
0x08
0x04
0x00
12
11SVC
Debug Monitor
Bus Fault
0x30
0x2C
7-10
6
5
4
3
2
1
N/A

4. Reset Behavior
Reset Handler
4
3
Main
5
4
AAME TechCon 2013
TC005v02
1. A reset occurs (Reset input was asserted)
2. Load MSP (Main Stack Pointer) register initial value from address 0x00
3. Load reset handler vector address from address 0x04
4. Reset handler executes in Thread Mode
5. Optional: Reset handler branches to the main program
0x04
0x001 Initial value of MSP
Reset Handler Vector
r13 (MSP)
2

5. Booting a Cortex-M0 Processor
Cortex-M0 usually requires the following to work
correctly
– Setup of the vector table
– Contains the stack pointer
– Vector entries to the handler routines
5
AAME TechCon 2013
TC005v02
Optionally the following tasks can be performed
– Recommended to initialize programmers registers
– Setup of the NVIC
– Priorities
– Enable/Disable interrupts
– SysTick timer
– Manage ROM/RAM remapping

6. Vector Table Setup – Basic Setup
Entries in the table need to be initialized
– Initial value of MSP
– Reset Handler Vector
<Reset Handler Vector>
Reset Handler
6
AAME TechCon 2013
TC005v02
No other exceptions can be handled – not recommended !!
Reset Handler Vector
Initial value of MSP
0x04
0x00
Not Initialized

7. Vector Table Setup – Full Setup
Fully populated table
– Exceptions can be handled
Exception vectors pointing to the handlers
Interrupt #31 Handler Vector
…
Interrupt #0 Handler Vector
0xBF
-
0x40
IRQ #0 Handler
7
AAME TechCon 2013
TC005v02
SysTick Handler Vector
PendSV Handler Vector
reserved
SVCall Handler Vector
reserved
HardFault Handler Vector
NMI Handler Vector
0x3C
0x38
-
0x2C
-
0x0C
0x08
NMI Handler
HardFault Handler

8. Example Vector Table
Fully populated table
vect_t vecttable[]
__attribute__ ((section("vectors"))) = {
(vect_t)(ARMIKMCU_STACKTOP), // Top of Stack
(vect_t)__main, // Reset Handler
(vect_t)NMI_Handler, // NMI Handler
(vect_t)HardFault_Handler, // Hard Fault Handler
Place the table in
“vectors” section
used by the Linker
Branch to __main
after reset
8
AAME TechCon 2013
TC005v02
(vect_t)HardFault_Handler, // Hard Fault Handler
0, 0, 0, 0, 0, 0, 0, // Reserved
(vect_t)SVC_Handler, // SVCall Handler
0, 0, // Reserved
(vect_t)PendSV_Handler, // PendSV Handler
(vect_t)SysTick_Handler, // SysTick Handler
(vect_t)Default_IRQHandler,
:
: // External Interrupts 1 – 32
:
(vect_t)Default_IRQHandler };
“Reserved” locations
maintained for
compatibility
Branch to a Default
IRQ Handler

9. LOAD_REGION 0x0 0x00200000
{
;; Maximum of 256 exceptions (256*4bytes == 0x400)
VECTORS 0x0 0x400
{
exceptions.o (exceptions_area, +FIRST)
}
Placing the Exception Table
9
AAME TechCon 2013
TC005v02
CODE +0
{
* (+RO)
}
:
}
+FIRST ensures that this section is placed first in this region and that it
does not get removed by the linker (because it appears to be unused)

10. Vector Table Offset Register (VTOR)
012345678910111213141516171819202122232425262728293031
TBLOFF
10
AAME TechCon 2013
TC005v02
VTOR specifies the base address of the vector table
– Offset from address 0x0
At reset the TBLOFF field is fixed to 0x00000000 unless an implementation
includes configuration input signals that determine the reset value

11. Reset and Initialization
Cortex-M series cores start up in Privileged Thread mode
For ARMv7-M architecture-based cores, you need to consider
which mode your main application will run in
– Privileged vs. Unprivileged mode
– Note that ARMv6-M architecture-based cores (Cortex-M0 and Cortex-M1) do not
have Unprivileged mode
11
AAME TechCon 2013
TC005v02
System initialization can only be executed in Privileged mode
– Need to carry out privileged operations e.g. setup MPU, enable interrupts
Before entering main application, typically need to:
– Setup and enable MPU (ARMv7-M cores only)
– Enable hardware enforcement of 8-byte stack alignment for exception handlers
– Complete any memory (Flash/RAM) remapping
– Enable interrupts
– (Last) Change Thread mode to Unprivileged – if required

12. Default C Library
ANSI C
input/ error
stack &
heap other
Functions called by
your application
eg: fputc()
Device driver level.
Use semihosting eg:
C Library
12
AAME TechCon 2013
TC005v02
input/
output
error
handling
heap
setup
other
Semihosting Support
Use semihosting eg:
_sys_write()
Implemented by
debugging
environment
Debug
Agent
Target-dependent C library functionality is supported “out-of-the-box” by
a device driver level that makes use of debug target semihosting support

13. By default code is linked to load and execute at
0x8000
The heap is placed directly above the data
region
Provided by
debugging
environmentStack
Default Memory Map
13
AAME TechCon 2013
TC005v02
The stack base location is read from the
debugging environment by C library startup
code
RO
RW
ZI
0x8000
Decided at
link time
Heap

14. __main
• copy code
• copy/decompress RW
data
• zero uninitialized data
C Library User Code
Application Startup
main( )
Image Entry
Point
14
AAME TechCon 2013
TC005v02
__rt_entry
set up application
stack and heap
initialize library
functions
call top-level
constructors (C++)
Exit from application
main( )
causes the linker to pull
in library initialization
code

15. Initialization Steps
C Library User Code
__main
copy code and
decompress data
zero uninitialized data
Image Entry
Point
__user_setup_stackheap( )
reset handler
initialize stack pointers
configure MPU
1
2
15
AAME TechCon 2013
TC005v02
__rt_entry
initialize library functions
call top-level constructors
(C++)
Exit from application
main( )
tells linker to link in library
initialization code
__user_setup_stackheap( )
set up stack & heap
$Sub$$main( )
enable interrupts
2
3
4
5
6

16. MPU Initialization
Before using the MPU, it is important to have knowledge of:
– Different memory regions that exist in the device
– Which regions the program or application tasks need to (and are allowed to) access
Systems without an embedded OS will typically use a static configuration
Systems with an embedded OS will typically offer a dynamic configuration
– The memory map is changed on each context switch
– A static configuration may still be preferred
16
AAME TechCon 2013
TC005v02
– A static configuration may still be preferred
There is no need to setup memory region for Private Peripheral Bus (PPB) address
ranges (including System Control Space, SCS) and the Vector table
– Accesses to PPB (including MPU, NVIC, SysTick, ITM) are always allowed in privileged
state, and vector fetches are always permitted by the MPU
HardFault and MemManage (ARMv7-M only) fault handlers must be defined
– When the MPU has been initialized the MemManage exception can be enabled
by setting the MEMFAULTENA bit in the System Handler and Control State
Register
– SCB->SHCSR |= SCB_SHCSR_MEMFAULTENA_Msk; // Set bit 16

17. MPU Initialization Example
__DMB(); /* Force any outstanding transfers to complete before disabling MPU */
/* Disable MPU */
MPU->CTRL = 0;
/* Configure region 0 as a 4GB background region (Unprivileged, XN, No Access) */
MPU->RBAR = 0x00000000 | REGION_Valid | 0;
MPU->RASR = REGION_Enabled | NORMAL | REGION_4G | NO_ACCESS;
/* Configure region 1 to cover 512KB Flash (Normal, Non-Shared, Executable, RO) */
MPU->RBAR = 0x00000000 | REGION_Valid | 1;
MPU->RASR = REGION_Enabled | NORMAL | REGION_512K | RO;
/* Configure region 2 to cover CPU 32KB SRAM (Normal, Non-Shared, Executable, Full Access) */
17
AAME TechCon 2013
TC005v02
MPU->RBAR = 0x20000000 | REGION_Valid | 2;
MPU->RASR = REGION_Enabled | NOT_EXEC | NORMAL | REGION_32K | FULL_ACCESS;
/* Configure region 3 to cover Stack and Heap (Not Executable, Read-Write) */
MPU->RBAR = 0x20100000 | REGION_Valid | 3;
MPU->RASR = REGION_Enabled | NOT_EXEC | NORMAL | REGION_16K | FULL_ACCESS;
/* Configure other regions, if necessary, for example:
GPIO, Peripherals, other memory, etc. */
MPU>CTRL |= 1; /* Enable the MPU */
__DSB(); /* Force memory writes before continuing */
__ISB(); /* Flush and refill pipeline with updated permissions */

18. MPU Initialization Optimization
The Region Base Address Register and Region Attribute and
Size Register are aliased
– This means up to four regions can be programmed at once using a memcpy
uint32_t mpu_config_table_1[] {
/* Configure region 0 as a background region (Unprivileged, XN, No Access) */
(REGION_Enabled | NORMAL_OUTER_INNER_NON_CACHEABLE_NON_SHAREABLE | REGION_512K | RO),
(0x00000000 | REGION_Valid | 0),
/* Configure region 1 to cover 512KB Flash (Normal, Non-Shared, Executable, Read-only) */
18
AAME TechCon 2013
TC005v02
/* Configure region 1 to cover 512KB Flash (Normal, Non-Shared, Executable, Read-only) */
(0x10000000 | REGION_Valid | 1),
(REGION_Enabled | NOT_EXEC | NORMAL | REGION_32K | FULL_ACCESS),
/* Configure region 2 to cover CPU 32KB SRAM (Normal, Non-Shared, Executable, Full Access) */
(0x20000000 | REGION_Valid | 2),
(REGION_Enabled | NOT_EXEC | NORMAL | REGION_32K | FULL_ACCESS),
/* Configure region 3 to cover Stack and Heap (Not Executable, Read/Write) */
(0x20100000 | REGION_Valid | 3),
(REGION_Enabled | DEVICE_NON_SHAREABLE | REGION_16K | FULL_ACCESS)
};
/* other tables */
mpu_setup()
{
:
memcpy((void*)&( MPU->RBAR), mpu_config_table_1, sizeof(mpu_config_table_1));
:
}

19. 8-byte Stack Alignment in Handlers
The ABI requires the stack to be 8-byte aligned at all interfaces
Including within interrupt handlers
But application code might not maintain 8-byte stack alignment internally
For example: if an interrupt occurs in a leaf function where the stack was not
aligned
Cortex-M3 rev1 or later allows 8-byte stack alignment to be enforced by
hardware whenever an exception occurs
19
AAME TechCon 2013
TC005v02
:
SCS.MPU.Ctrl |= 1; /* Enable the MPU */
* If we are using Cortex-M3 rev1 or later, enable hardware stack alignment */
#if defined __TARGET_CPU_CORTEX_M3 && !defined __TARGET_CPU_CORTEX_M3_REV0
SCS.ConfigCtrl |= 0x200;
#endif
__dsb(0xf); /* Force Memory Writes before continuing */
__isb(0xf); /* Flush and refill pipeline with updated permissions */
:
hardware whenever an exception occurs
Enabled by setting STKALIGN (bit 9) in Config Ctrl register

20. Change Thread Mode to Unprivileged
Simple applications without an embedded OS will typically not
require Thread mode to be unprivileged
– The whole application is privileged and uses MSP
Applications that use an embedded OS will typically set Thread
mode to unprivileged access level
– CONTROL.SPSEL = 1 and CONTROL.nPRIV = 1
Software running at unprivileged level cannot switch itself back to
privileged access level
20
AAME TechCon 2013
TC005v02
privileged access level
– Untrusted applications run at unprivileged access level
– This is essential in order to provide a basic security usage model
– A Supervisor Call (SVC) instruction may be used to request a privileged operation
The CONTROL register can be accessed using CMSIS-CORE
functions
/* Change Thread mode to unprivileged and use PSP */
__set_CONTROL(0x3);
/* Flush and refill pipeline with unprivileged permissions */
__ISB();
MOVS r0,#3
MSR CONTROL,r0
ISB

21. processor
Inter-
Remap
RAM
<address>
;change address map
STR <remap>
before
remap
after
Device
Normal
DSB
LDR <address>
ISB
Memory Remapping
21
AAME TechCon 2013
TC005v02
Ordering between Device and Normal memory is not defined
If the order is important a Data Synchronization Barrier (DSB) must be used
Instruction Synchronization Barrier (ISB) is also needed if code area is remapped
processor
connect
RAM
<address>
after
remap

22. There are five main components to CMSIS:
CMSIS-CORE API for Cortex-M processor and core peripherals
CMSIS-DSP DSP Library with 61 function types for Cortex-M
CMSIS-SVD XML system view description for peripherals
CMSIS-RTOS API for RTOS integration
CMSIS-DAP API for debug and trace integration (not shown in diagram)
CMSIS Structure
22
AAME TechCon 2013
TC005v02

23. Using CMSIS-CORE
To use the CMSIS-CORE the following files are added to the embedded
application:
Startup File startup_<device>.s with reset handler and exception vectors
System Configuration Files system_<device>.c and system_<device>.h with
general device configuration (clock setup)
Device Header File <device.h> gives access to processor core and all peripherals
23
AAME TechCon 2013
TC005v02
Silicon vendors create these device-specific CMSIS-CORE files based on
template files provided by ARM

24. CMSIS-CORE System and Clock
Config
ARM provides a template file system_device.c
that must be adapted by the silicon vendor to
match their actual device
The silicon vendor must provide:
– A device-specific system configuration function, SystemInit()
24
AAME TechCon 2013
TC005v02
– A device-specific system configuration function, SystemInit()
– Essential for configuring the clock system of the device
– A global variable that contains the system frequency called
SystemCoreClock
The silicon vendor may optionally provide:
– A function called SystemCoreClockUpdate() that updates the
variable SystemCoreClock and must be called whenever the core
clock is changed during program execution

25. CMSIS Startup and Initialization
CMSIS-CORE provides the following files for an embedded
application:
– Startup File startup_<device>.s with reset handler and exception vectors
– System Configuration Files system_<device>.c and system_<device.h> with
general device configuration (i.e. for clock and BUS setup)
– Device Header File <device.h> gives access to processor core and all peripherals
For any existing device, ARM recommends including CMSIS-
CORE startup and system initialization code from the device
25
AAME TechCon 2013
TC005v02
CORE startup and system initialization code from the device
vendor
– If this is not available, startup and system initialization code will have to be created
manually or by using an alternative, non-CMSIS compliant solution
When designing a new device, ARM recommends that the device
vendor:
– Creates a CMSIS-SVD description to automatically generate CMSIS compliant device
header files
– Formalizes the programmer’s view for device-specific peripherals
– Adapts the system initialization and startup template files to their device

26. CMSIS-CORE: Startup File
The Startup File startup_<device>.s contains the following:
– Vector table
– Exception vectors of the Cortex-M processor
– Interrupt vectors that are device specific
– Weak functions that implement default routines
– Reset handler
26
AAME TechCon 2013
TC005v02
– Reset handler
– calls SystemInit followed by __main
– Stack and heap configuration
– __user_initial_stackheap when using the standard C library
– __initial_sp, __heap_base and __heap_limit when using microlib
– discussed in more detail later …
The file exists for each supported toolchain and is the only toolchain
specific CMSIS file

27. CMSIS-CORE: Vector Table
; Vector Table Mapped to Address 0 at Reset
AREA RESET, DATA, READONLY, ALIGN=8
EXPORT __Vectors
EXPORT __Vectors_End
EXPORT __Vectors_Size
__Vectors DCD __initial_sp
DCD Reset_Handler
DCD NMI_Handler
DCD HardFault_Handler
DCD MemManage_Handler
DCD BusFault_Handler
DCD UsageFault_Handler
27
AAME TechCon 2013
TC005v02
DCD UsageFault_Handler
DCD 0, 0, 0, 0
DCD SVC_Handler
DCD DebugMon_Handler
DCD 0
DCD PendSV_Handler
DCD SysTick_Handler
; External Interrupts
; ToDo: Add here the vectors for the device specific external interrupts handler
DCD <DeviceInterrupt>_IRQHandler ; 0: Default
__Vectors_End
__Vectors_Size EQU __Vectors_End - __Vectors

28. CMSIS-CORE: Exception Handlers
; Reset Handler
Reset_Handler PROC
EXPORT Reset_Handler [WEAK]
IMPORT SystemInit
IMPORT __main
LDR R0, =SystemInit
BLX R0
LDR R0, =__main
BX R0
ENDP
:
:
28
AAME TechCon 2013
TC005v02
:
:
; Dummy Exception Handlers (infinite loops which can be modified)
NMI_Handler PROC
EXPORT NMI_Handler [WEAK]
B .
ENDP
HardFault_Handler PROC
EXPORT HardFault_Handler [WEAK]
B .
ENDP

29. Possible Initialization Sequence (1)
C Library User Code
__main
copy code and
decompress data
zero uninitialized data
Reset_Handler
calls SystemInit and
then calls __main
CMSIS Startup Code
1
Image Entry Point
29
AAME TechCon 2013
TC005v02
__rt_entry
set up application stack
and heap
initialize library
functions
call top-level
constructors (C++)
Exit from application
main()
tells linker to link in
library initialization code
2
3
4

30. Possible Initialization Sequence (2)
C Library User Code
__main
copy code and
decompress data
zero uninitialized data
Reset_Handler
calls SystemInit and
then calls __main
CMSIS Startup Code
1
Image Entry Point
30
AAME TechCon 2013
TC005v02
__rt_entry
set up application stack
and heap
initialize library
functions
call top-level
constructors (C++)
Exit from application
main()
tells linker to link in
library initialization code
2
3
$Sub$$main()
enable system features,
e.g., NVIC, MPU
4
5

31. Possible Initialization Sequence (3)
C Library User Code
__main
copy code and
decompress data
zero uninitialized data
Reset_Handler
calls SystemInit and
then calls __main
CMSIS Startup Code
1
Image Entry Point
31
AAME TechCon 2013
TC005v02
__rt_entry
initialize library
functions
call top-level
constructors (C++)
Exit from application
main()
tells linker to link in
library initialization code
2
3
$Sub$$main()
enable system features,
e.g., NVIC, MPU
4
5
__user_setup_stackheap()
set up stack & heap
3

32. CMSIS-CORE: Stack and Heap
Setup
; <h> Stack Configuration
; <o> Stack Size (in Bytes) <0x0-0xFFFFFFFF:8>
; </h>
Stack_Size EQU 0x00000400
AREA STACK, NOINIT, READWRITE, ALIGN=3
Stack_Mem SPACE Stack_Size
__initial_sp
continued …
; User Initial Stack & Heap
IF :DEF:__MICROLIB
EXPORT __initial_sp
EXPORT __heap_base
EXPORT __heap_limit
32
AAME TechCon 2013
TC005v02
; <h> Heap Configuration
; <o> Heap Size (in Bytes) <0x0-0xFFFFFFFF:8>
; </h>
Heap_Size EQU 0x00000C00
AREA HEAP, NOINIT, READWRITE, ALIGN=3
__heap_base
Heap_Mem SPACE Heap_Size
__heap_limit
:
:
:
EXPORT __heap_limit
ELSE
IMPORT __use_two_region_memory
EXPORT __user_initial_stackheap
__user_initial_stackheap PROC
LDR R0, = Heap_Mem
LDR R1, =(Stack_Mem + Stack_Size)
LDR R2, = (Heap_Mem + Heap_Size)
LDR R3, = Stack_Mem
BX LR
ENDP

33. System Startup for Cortex-M
Series Processors