CMSIS Part 3: Startup Code, Linker Scripts & Vector Table

Vector Table

The vector table is an array of 32-bit addresses stored at a known location (typically the start of flash). Entry 0 is the initial stack pointer; entries 1 onward are exception/interrupt handler addresses. The NVIC uses this table to determine where to jump when an exception fires.

Vector Table in C with Weak Default Handlers

/*
 * Vector table definition in C — placed in .isr_vector section.
 * __attribute__((weak)) allows application code to override any handler
 * by simply defining a function with the same name.
 * __attribute__((alias)) makes unimplemented handlers fall through to
 * the infinite-loop default, avoiding hard-to-find silent faults.
 */

/* Default handler — catches any unimplemented IRQ */
void Default_Handler(void) {
    /* Optionally: capture IPSR to identify which interrupt fired */
    volatile uint32_t active_irq = __get_IPSR() & 0x1FFU;
    (void)active_irq;
    for (;;) {}
}

/* Weak aliases: override by defining the function in application code */
void NMI_Handler(void)       __attribute__((weak, alias("Default_Handler")));
void HardFault_Handler(void) __attribute__((weak));          /* defined separately */
void MemManage_Handler(void) __attribute__((weak, alias("Default_Handler")));
void BusFault_Handler(void)  __attribute__((weak, alias("Default_Handler")));
void UsageFault_Handler(void)__attribute__((weak, alias("Default_Handler")));
void SVC_Handler(void)       __attribute__((weak, alias("Default_Handler")));
void PendSV_Handler(void)    __attribute__((weak, alias("Default_Handler")));
void SysTick_Handler(void)   __attribute__((weak, alias("Default_Handler")));
/* Device-specific IRQs */
void USART1_IRQHandler(void) __attribute__((weak, alias("Default_Handler")));
void TIM2_IRQHandler(void)   __attribute__((weak, alias("Default_Handler")));

/* The actual vector table */
extern uint32_t __StackTop;  /* Defined by linker script */

__attribute__((section(".isr_vector"), used))
const void * const g_pfnVectors[] = {
    (void *)&__StackTop,   /* Initial MSP                     */
    Reset_Handler,         /* Reset Handler                   */
    NMI_Handler,
    HardFault_Handler,
    MemManage_Handler,
    BusFault_Handler,
    UsageFault_Handler,
    0, 0, 0, 0,            /* Reserved                        */
    SVC_Handler,
    DebugMon_Handler,
    0,                     /* Reserved                        */
    PendSV_Handler,
    SysTick_Handler,
    /* Device interrupts */
    WWDG_IRQHandler,
    USART1_IRQHandler,
    TIM2_IRQHandler,
    /* ... */
};

Relocating the Vector Table to SRAM via SCB->VTOR

/*
 * VTOR (Vector Table Offset Register) — allows relocating the vector
 * table anywhere in memory, aligned to the table size (next power of 2
 * above number-of-vectors * 4, minimum 128 bytes on Cortex-M3+).
 *
 * Use cases:
 * - Bootloader: application relocates its own vector table to its start
 * - SRAM execution: copy vector table to SRAM for faster ISR dispatch
 * - RAM-patching: override individual vectors at runtime
 */

#define SRAM_BASE       0x20000000U
#define VECTOR_TABLE_SIZE  (256U * 4U)  /* 256 entries * 4 bytes */

/* Extern: vector table defined in startup file or linker symbol */
extern const void * const g_pfnVectors[];

void RelocateVectorTable(void) {
    /* Copy flash vector table to SRAM */
    uint32_t *src = (uint32_t *)g_pfnVectors;
    uint32_t *dst = (uint32_t *)SRAM_BASE;

    for (uint32_t i = 0; i < (VECTOR_TABLE_SIZE / 4U); i++) {
        dst[i] = src[i];
    }

    /* Point VTOR to SRAM copy — requires alignment to power of 2 */
    __DSB();
    SCB->VTOR = SRAM_BASE;
    __DSB();
    __ISB();  /* Flush pipeline to ensure VTOR change takes effect */
}

/*
 * Patching a single vector at runtime (useful for bootloader jump):
 */
void PatchVectorEntry(uint32_t irq_index, void (*handler)(void)) {
    uint32_t *vtor_base = (uint32_t *)SCB->VTOR;
    vtor_base[irq_index + 16U] = (uint32_t)handler | 0x1U; /* Thumb bit */
    __DSB();
}

Linker Scripts & Scatter Files

The linker script is the control file that tells the GNU linker (ld) exactly where to place every section of your program in the target's address space. Every embedded project has one — and understanding it is essential for advanced memory management, bootloaders, and performance optimisation.

MEMORY Block — Defining Address Regions

/* STM32F407VGT6 GCC Linker Script — complete example
 * Flash: 1 MB at 0x08000000
 * SRAM1: 112 KB at 0x20000000
 * SRAM2: 16 KB at 0x2001C000
 * CCM RAM: 64 KB at 0x10000000 (core-coupled, zero latency)
 */

MEMORY {
    FLASH  (rx)  : ORIGIN = 0x08000000, LENGTH = 1024K
    SRAM   (rwx) : ORIGIN = 0x20000000, LENGTH = 112K
    SRAM2  (rwx) : ORIGIN = 0x2001C000, LENGTH = 16K
    CCMRAM (rwx) : ORIGIN = 0x10000000, LENGTH = 64K
}

/* Stack and heap sizes — referenced by startup code */
_Min_Heap_Size  = 0x400;   /* 1 KB minimum heap  */
_Min_Stack_Size = 0x800;   /* 2 KB minimum stack */

SECTIONS Block — Placing Code and Data

SECTIONS {
    /* ── .isr_vector: Vector table at very start of flash ── */
    .isr_vector : {
        . = ALIGN(4);
        KEEP(*(.isr_vector))  /* KEEP prevents garbage collection */
        . = ALIGN(4);
    } >FLASH

    /* ── .text: Code and read-only data ── */
    .text : {
        . = ALIGN(4);
        *(.text)           /* .text sections from all object files */
        *(.text*)          /* .text.funcname (from -ffunction-sections) */
        *(.glue_7)         /* ARM/Thumb interworking glue               */
        *(.glue_7t)
        *(.eh_frame)
        KEEP(*(.init))
        KEEP(*(.fini))
        . = ALIGN(4);
        _etext = .;        /* Symbol used by startup: end of .text in Flash */
    } >FLASH

    /* ── .rodata: Read-only data (string literals, const arrays) ── */
    .rodata : {
        . = ALIGN(4);
        *(.rodata)
        *(.rodata*)
        . = ALIGN(4);
    } >FLASH

    /* ── .data: Initialised global/static variables ── */
    /* LMA (load address) is in Flash; VMA (runtime address) is in SRAM */
    .data : {
        . = ALIGN(4);
        __data_start__ = .;     /* Used by Reset_Handler data copy loop */
        *(.data)
        *(.data*)
        . = ALIGN(4);
        __data_end__ = .;
    } >SRAM AT>FLASH           /* Run in SRAM, stored in Flash */

    /* __etext = load address of .data in Flash */
    __etext = LOADADDR(.data);

    /* ── .bss: Uninitialised global/static variables ── */
    .bss : {
        . = ALIGN(4);
        __bss_start__ = .;
        *(.bss)
        *(.bss*)
        *(COMMON)
        . = ALIGN(4);
        __bss_end__ = .;
    } >SRAM

    /* ── ._user_heap_stack: Heap and stack size check ── */
    ._user_heap_stack : {
        . = ALIGN(8);
        PROVIDE(end = .);
        PROVIDE(_end = .);
        . = . + _Min_Heap_Size;
        . = . + _Min_Stack_Size;
        . = ALIGN(8);
    } >SRAM

    /* ── .ccmram: Time-critical code in zero-latency CCM RAM ── */
    .ccmram : {
        . = ALIGN(4);
        _sccmram = .;
        *(.ccmram)
        *(.ccmram*)
        . = ALIGN(4);
        _eccmram = .;
    } >CCMRAM AT>FLASH

    /* Discard unwanted sections */
    /DISCARD/ : {
        libc.a(*)
        libm.a(*)
        libgcc.a(*)
    }
}

Boot Process: Reset to main()

Understanding the complete boot sequence lets you diagnose startup failures, implement proper clock configuration, and safely use global variables.

/*
 * Minimal SystemInit() for STM32F407 — configure HSE PLL to 168 MHz.
 * In practice you would use the vendor's clock configuration tool,
 * but understanding this code demystifies the entire clock tree.
 */
void SystemInit(void) {
    /* Enable FPU — must be done before any FP instruction */
    SCB->CPACR |= ((3UL << 10*2) | (3UL << 11*2)); /* CP10, CP11 full access */
    __DSB();
    __ISB();

    /* Enable HSI (16 MHz internal oscillator) — already on after reset */
    RCC->CR |= RCC_CR_HSION;
    while (!(RCC->CR & RCC_CR_HSIRDY)) {}  /* Wait for HSI ready */

    /* Reset RCC configuration to safe defaults */
    RCC->CFGR = 0x00000000U;

    /* Configure PLL: HSI (16 MHz) * (N=168) / (M=8) / P=2 = 168 MHz */
    RCC->PLLCFGR = (8U  << RCC_PLLCFGR_PLLM_Pos) |  /* M = 8  */
                   (168U << RCC_PLLCFGR_PLLN_Pos) |  /* N = 168 */
                   (0U   << RCC_PLLCFGR_PLLP_Pos) |  /* P = 2 (0b00) */
                   (7U   << RCC_PLLCFGR_PLLQ_Pos);   /* Q = 7 for USB */

    /* Enable PLL and wait for lock */
    RCC->CR |= RCC_CR_PLLON;
    while (!(RCC->CR & RCC_CR_PLLRDY)) {}

    /* Configure Flash: 5 wait states + instruction cache + prefetch */
    FLASH->ACR = FLASH_ACR_LATENCY_5WS | FLASH_ACR_ICEN | FLASH_ACR_PRFTEN;

    /* Switch system clock to PLL */
    RCC->CFGR |= RCC_CFGR_SW_PLL;
    while ((RCC->CFGR & RCC_CFGR_SWS) != RCC_CFGR_SWS_PLL) {}

    /* Update CMSIS global SystemCoreClock variable */
    SystemCoreClock = 168000000U;
}

Bootloaders & Firmware Update Strategies

A bootloader is a small program that runs first after reset, validates the application firmware, and jumps to it. Understanding startup code and vector table relocation is prerequisite to writing a bootloader.

/*
 * Minimal 2nd-stage bootloader: validates application and jumps to it.
 * Application starts at APP_START_ADDR (must match app linker script).
 *
 * STM32F4: Bootloader at 0x08000000, Application at 0x08010000 (64 KB offset)
 */
#define APP_START_ADDR  0x08010000U
#define FLASH_END_ADDR  0x080FFFFFU

/* Type for a function pointer with no arguments/return (reset handler type) */
typedef void (*AppEntry_t)(void);

/* Simple CRC32 validation — replace with SHA-256 for production */
static bool validate_firmware(uint32_t start, uint32_t length) {
    uint32_t stored_crc  = *(uint32_t *)(start + length - 4U);
    uint32_t computed_crc = crc32_calculate((uint8_t *)start, length - 4U);
    return (stored_crc == computed_crc);
}

void bootloader_jump_to_app(uint32_t app_address) {
    /* Read app stack pointer (first word in vector table) */
    uint32_t app_sp = *(uint32_t *)app_address;

    /* Validate stack pointer is within SRAM range */
    if (app_sp < 0x20000000U || app_sp > 0x20020000U) {
        /* Invalid firmware — stay in bootloader or signal error */
        Error_Handler();
        return;
    }

    /* Read app reset vector (second word) — this is the entry point */
    AppEntry_t app_reset = (AppEntry_t)(*(uint32_t *)(app_address + 4U));

    /* Relocate vector table to application start */
    __disable_irq();
    SCB->VTOR = app_address;
    __DSB();
    __ISB();

    /* Set stack pointer to application's initial SP */
    __set_MSP(app_sp);

    /* Enable interrupts and jump to application Reset_Handler */
    __enable_irq();
    app_reset();  /* Never returns */
}

int main(void) {
    /* Check if bootloader entry is forced (e.g., button held or magic word) */
    if (is_bootloader_entry_forced() || !validate_firmware(APP_START_ADDR, APP_SIZE)) {
        /* Stay in bootloader — receive firmware via UART/USB/CAN */
        firmware_update_receive();
    } else {
        bootloader_jump_to_app(APP_START_ADDR);
    }
    for (;;) {}  /* Should never reach here */
}

/*
 * Application linker script must set origin offset:
 * FLASH (rx) : ORIGIN = 0x08010000, LENGTH = 960K
 * Application must also set VTOR in its SystemInit():
 * SCB->VTOR = 0x08010000U;
 */

Exercises

Memory Layout Designer

Use this tool to document your project's memory layout configuration — flash regions, SRAM regions, stack/heap sizing, and custom sections. Download as Word, Excel, PDF, or PPTX for design review or project documentation.

Conclusion & Next Steps

In this article we have traced the complete journey from power-on reset to the first instruction of main():

• The startup assembly is the bridge between raw hardware and the C runtime — it sets up the stack, copies initialised data from flash to SRAM, zero-fills BSS, configures clocks via SystemInit(), and calls main().
• The vector table is a flat array of 32-bit handler addresses. Weak aliases allow application code to override any handler; the __attribute__((section(".isr_vector"))) attribute places it at the correct flash address.
• The linker script exports the symbols (__data_start__, __etext, __bss_start__) that the startup code reads at runtime — startup and linker script must agree exactly on symbol names.
• VTOR relocation via SCB->VTOR enables bootloaders to hand off to applications cleanly, and applications to patch individual interrupt vectors at runtime.
• Dual-bank flash combined with firmware signature verification is the correct foundation for production OTA update systems.