Cortex M3/M4

PNJ
The Cortex-M3 Embedded Systems:
The Cortex-M3 Processor Basics
Refer to Chapter 1, 2, and 3 in the reference book
“The Definitive Guide the ARM Cortex-M3”
 History about ARM Processers
ARM company is known as the Advanced
RISC Machine, born in 1990
 ARM does not manufacture processors or sell chips directly.
They license their process design to semiconductor
companies, known as intellectual property (IP) licensing.

 Make over 2 billion ARM processors being shipped

each year possible
 As of 2009, ARM processors account for
approximately 90% of all embedded 32-bit RISC
processors
History about ARM Processers

ARM instructions are

32-bit

Thumb instructions are

16-bit
Thumb-2 instructions
are 32-bit
 Cortex R, A and M profiles
• Cortex A profile :- Application profile
• 32 bit and 64 bit registers
• Virtual memory support
• Runs rich operating systems
• The A profile is designed for high-performance open
application platforms
• Application processors that are designed to handle
complex applications such as high-end embedded
operating systems (OSs) (e.g., iOS,
• Android, Linux, and Windows).
 A profile

• These applications require the highest

• processing power, virtual memory system
support with memory management units
(MMUs), and, optionally, enhanced Java
support and a secure program execution
environment.
• Example products include high-end
smartphones,tablets, televisions, and even
computing servers.
 R profile
• Cortex R profile :- Real time applications
• 32 bit registers
• ARM and Thumb instruction set
• Protected memory support
• Runs Real Time OS (RTOS)
• Eg:- ABS systems, air bags in cars etc
 R profile
• Real-time, high-performance processors
targeted primarily at the higher end of the
real-time market these are applications,
• such as hard drive controllers, baseband
controllers for mobile communications, and
automotive systems, in which high processing
power and high reliability are essential and for
which low latency and determinism are
important.
 M profile
• Cortex-M: Processors targeting smaller scale
applications
• where criteria like low cost, low power, energy
efficiency, and low interrupt latency are important.
• At the same time, the processor design has to be
easy to use and able to provide deterministic
behavior as required in many real-time control
systems.
The M profile is designed for deeply embedded
microcontroller-type systems.
 Overview of Cortex-M3 processor

-M
C
o
x
e

3
rt

m
P

S
ro

o
o

y
ce

re

e
ss

st
r

Trace Interface
Register

Interrupt Controller

Instruction
Fetch unit
Bank

Decoder
Debug

(NVIC)
Interrupts System Trace
ALU

m
M

In
o

a
ry
e

te

ce
rf
Memory

D
B

B
In

n
io
ru

u
a
ta
s

s
st
ct

Protection
Unit

Debug
Debug
B
In

n
n
o
u

te

e
rc
s

ct

Interface

Code Memory System Private Optional

Meomory and Peripherals Peripherals

A Simplified View of the Cortex-M3

 Overview of Cortex-M3 processor
 32-bit microprocessor: 32-bit data path, 32-bit registers, 32-
bit memory interfaces.
 Harvard architecture: separate instruction bus and data bus,
which allows instructions and data accesses to take place at
the same time.
 4GB Memory space
 Registers: Registers (R0 to R15) and special registers.
 Two operation modes: thread mode and handler mode
 Two access levels: privileged level and user level.
 Overview of Cortex-M3 processor
 Interrupts and Exceptions: a built-in Nested Vectored
Interrupt Controller, supporting 11 system exceptions plus 240
external IRQs.
 MPU: an optional Memory Protection Unit allows access rules
to be set up for privileged access and user program access.
 The Instruction Set: Thumb-2 instruction set allows 32-bit
instructions and 16-bit instructions to be used together; no
ARM instructions allowed
 Fixed internal debugging components: provide debugging
operation supports and features such as breakpoints, single
step.
 Features of Cortex-M3 Processors
 Greater performance efficiency, allowing more work to be done without
increasing the frequency or power requirements
 Low power consumption, enabling longer battery life
 Enhanced determinism, guaranteeing that critical tasks and interrupts are
serviced in a known number of cycles
 Improved code density, ensuring that code fits in even the smallest
memory
 Ease of use, providing easier programmability and debugging
 Lower-cost solutions, reducing 32-bit-based system costs at less than
US$1 for the first time
 Wide choice of development tools, from low-cost or free compilers to
full-featured development suites
 Cortex-M3 Processors vs Cortex-M3-
 Based
The Cortex-M3 processor is the MCUs
central processing unit (CPU) of a microcontroller chip
 After chip manufacturers license the Cortex-M3 processor, they can put the Cortex-M3
processor in their silicon designs, adding memory, peripherals, input/output (I/O), and
other features.
 Cortex-M3 processor based chips from different manufacturers will have different
memory sizes, types, peripherals, and features
 ARM Processors: Instruction State
Switches
 In the ARM state, the instructions are 32-bit and can
execute all supported instructions with very high
performance
 In the Thumb state, the instructions are 16-bit, so there is a
much higher instruction code density

Can we combine them to achieve the best of both worlds?

Any cost?
1) overhead of state
switches
2) complex software
development
 Instruction Set of Cortex-M3
 Cortex-M3 supports only the Thumb-2 (including the
traditional Thumb) instruction set

Advantages:
1) No state switching overhead, saving
both execution time and instruction
space
2) No need to separate ARM code and
Thumb code source files, making
software development and maintenance
easier
 Operation Modes in Cortex-M3
 Two modes and two privilege levels
 Cortex-M3 Basics: Registers
Name Functions (and Banked Registers) Name Functions

R0 General-Purpose Register xPSR Program Status Registers

R1 General-Purpose Register PRIMASK

Interrupt Mask
R2 General-Purpose Register FAULTMASK Registers
Special Registers

R3 General-Purpose Register BASEPRI

Low Register
R4 General-Purpose Register
CONTROL Control Register

R5 General-Purpose Register

R6 General-Purpose Register

R7 General-Purpose Register

R8 General-Purpose Register

R9 General-Purpose Register

R10 General-Purpose Register High Register

R11 General-Purpose Register

R12 General-Purpose Register

R13(MSP) R13(PSP) Main Stack Pointer(MSP),Process Stack Pointer(PSP)

R14 Link Register(LR)

R15 Program Counter(PC)

 Cortex-M3 Basics: Registers
General-Purpose Registers
 R0~R7 (low registers)
 Can be accessed by all 16-bit Thumb instructions and all 32-bit
Thumb-2 instructions
 reset value is unpredictable
 R8~R12 (high registers)
 Accessible by all Thumb-2 instructions but not by all 16-bit Thumb
instructions
 reset value is unpredictable
Stack Pointer R13
 Two stack pointers are banked so that only one is visible at a time.
 Main Stack Pointer (MSP) : This is the default stack pointer, used by the OS
kernel, exception handlers, and privileged-mode programs
 Process Stack Pointer (PSP) : Used by the user application code
 Stack and Its Pointer
Stack: a first-in last-out buffer
The stack pointers are used for accessing stack memory with PUSH and POP
For example, to store register contents to stack memory at the start of a subroutine
and then restore the registers from stack at the end of the subroutine.

Stack PUSH operation to back Stack POP operation to

up register contents restore register contents

Register Register
contents contents restored
PUSH Data Processing POP
(Original register contents
destroyed)

SP

Memory Memory
 Stack in Cortex-M3
 Cortex-M3 uses a full-descending stack arrangement
 The stack pointer decrements when new data is pushed in the stack
 The assembly language syntax is as follows:
PUSH {R0} ; R13=R13-4, then Memory[R13]=R0
POP {R0} ; R0=Memory[R13], then R13=R13+4
 Either R13 or SP can be used in your program codes (referring to the current
stack pointer you are using, either MSP or PSP)
 A particular stack pointer (MSP/PSP) can be accessed using special register
access instructions (MRS/MSR)
 Since PUSH and POP operations are always word aligned, the stack pointer
R13 bit 0 and bit 1 are hardwired to zero and always read as zero (RAZ)
 Cortex-M3 Basics: Registers
Link Register R14
 R14 is the link register (LR), used to store the return program counter
when a subroutine or function is called.
e.g., when using the BL (Branch with Link) instruction:
 Cortex-M3 Basics: Registers
Program Counter R15
 When you read this register you will find that the value is different than the
location of the executing instruction by 4, due to the pipelining of the
processor
Example:
0x1000 : MOV R0, PC ; R0 = 0x1004
 When reading the PC, the LSB (bit 0) is always 0.
Why?
 When writing to the PC, it will cause a branch. The LSB must be set to 1 to
indicate the Thumb state operations (setting to 0 implies to switch to the
ARM state, which will result in a fault exception in Cortex-M3)
Can you write to the PC in 8086? Why to set LSB of R15 (and R14) since
all instructions are half-word or word aligned?
 Cortex-M3 Basics: Registers
Special Registers
 The special registers in the Cortex-M3 processor
include:
 Program Status Registers (PSRs)
 Interrupt Mask Registers (PRIMASK, FAULTMASK, and BASEPRI)
 Control Register (CONTROL)

 Can only be accessed via MSR and MRS instructions

MRS <reg>, <special_reg> ; Read special register
MSR <special_reg>, <reg> ; write to special register

Note: MSR and MRS cannot have memory addresses,

only registers are allowed
 Special Registers
Program Status Registers (PSRs)
 The program status registers are subdivided into three status registers:
1. Application PSR (APSR), 2. Interrupt PSR (IPSR), 3. Execution PSR (EPSR)

 When they are accessed as a collective item, the name xPSR is used (PSR used
in program codes).
EPSR and IPSR are read-only:
MRS R0, APSR ; Read Flag state into R0
MRS R0, IPSR ; Read Exception/Interrupt state
MRS R0, EPSR ; Read Execution state
MSR APSR, R0 ; Write Flag state

Accessing xPSR:
MRS R0, PSR ; Read the combined program status word
MSR PSR, R0 ; Write combined program state word
 Bit Fields in Cortex-M3 Program Status Registers

Bit Description
N Negative
Z Zero
C Carry/borrow
V Overflow
Q Sticky saturation flag
ICI/IT Interrupt-Continuable Instruction (ICI) bits, IF-THEN
instruction status bit
T Thumb state, always 1; trying to clear this bit will cause a
fault exception
Exception Number Indicates which exception the processor is handling
 Cortex-M3 Interrupt Mask Registers

PRIMASK, FAULTMASK and BASEPRI Registers

 The PRIMASK, FAULTMASK, and BASEPRI registers are used to disable
exceptions.

Register Name Description

PRIMASK A 1-bit register. When this is set, it allows NMI and the hard
fault exception; all other interrupts and exceptions are
masked; default is 0 (no masking)
FAULTMASK A 1-bit register. When this is set, it allows only the NMI, and
all interrupts and fault handling exceptions are disabled;
default is 0
BASEPRI A register of up to 9 bits. It defines the masking priority level.
When this is set, it disables all interrupts of the same or lower
level (larger priority value); default is 0
To access the PRIMASK, FAULTMASK, and BASEPRI registers, the MRS and
MSR instructions are used.
Example:
MRS R0, BASEPRI ; Read BASEPRI register into R0
MRS R0, PRIMASK ; Read PRIMASK register into R0
MRS R0, FAULTMASK ; Read FAULTMASK register into R0
MSR BASEPRI, R0 ; Write R0 into BASEPRI register
MSR PRIMASK, R0 ; Write R0 into PRIMASK register
MSR FAULTMASK, R0 ; Write R0 into FAULTMASK register
PRIMASK and BASEPRI are useful for temporarily disabling interrupts in
timing-critical tasks; FAULTMASK is used by the OS kernel which cleans up a
crashed task
The PRIMASK, FAULTMASK, and BASEPRI registers cannot be set in the user
access level.
 Special Registers
The Control Register
 The Control register is used to define the privilege level and the stack
pointer selection. This register has two bits.
 CONTROL[1]
In Cortex-M3, the CONTROL[1] bit is always 0 (MSP) in handler mode. However,
in the Thread mode, it can be either 0 or 1.
This bit is writable only when the core is in Thread mode and privileged.

CONTROL[0]
The CONTRL[0] bit is writable only in privileged level.

 To access the Control register, the MRS and MSR instructions are used:
MRS R0, CONTROL ; Read CONTROL register into R0
MSR CONTROL, R0 ; Write R0 into CONTROL register
 Cortex-M3 Basics: Operation Mode
 Two modes and two privilege levels.

Operation Modes and Privilege Levels in Cortex-M3

Privileged Level User Level

When running an exception privileged Handler

Mode
When running main program privileged Thread User Thread Mode
Mode
 Cortex-M3 Basics: Operation Mode
 When the processor exits reset, it is in Thread mode with privileged
access level
 In the user access level (Thread mode), access to the System Control
Space (SCS, a memory block for configuration registers and debugging
components) is blocked.
 In the user access level, access to special registers (except the APSR) is
also blocked. Fault exception will occur when trying to access SCS or
special registers
 Software in a privileged access level can switch the program into the user
access level by setting CONTROL[0]=1
 When an exception occurs, the processor will automatically switch to
privileged state and return to the previous state when exiting the
exception handler
 Therefore, in order to change to privileged level, a user program has to go
through an exception/interrupt handler which can set the CONTROL
register before returns.
When the CONTROL[0]=0, only the processor mode changes when an
exception takes place.

Interrupt
Exit
Interrupt Service
Routine(ISR)
Interrupt
Event

Main
Program
Stacking Unstacking Time

Thread Mode Handler Mode Thread Mode

(Privileged) (Privileged) (Privileged)

Switching Processor Mode at Interrupt

When CONTROL[0] = 1, both processor mode and access level change when an
exception takes place.

Interrupt
Exit
Interrupt Service
Routine(ISR)
Interrupt
Event
Main
Program
Stacking Unstacking Time

Thread Mode Handler Mode Thread Mode

(User) (Privileged) (User)

Switching Processor Mode and Privilege Level at Interrupt

 Reprogram Control
register[0]=0
Switch to user mode
Privileged by writing to Control Exception Exception
Handler Register[0]=1 handler handler

Privileged Starting Privileged

Thread code thread
Exception Exception

User Thread User User

mode mode

Switching of Operation Mode by Programming the Control Register or by

Exceptions
 Cortex-M3: Exceptions and Interrupts
 The Cortex-M3 supports a fixed number of system exceptions and a number
of interrupts (called IRQ), and a NMI input signal (e.g., connected to a
watchdog timer or a voltage-monitoring block)
 Cortex-M3 Basics: Vector Table
 The vector table is an array of word data, with each representing the
starting address of the ISR for one exception/interrupt type.
 The base address of the vector table is re-locatable (set the relocation
register in the NVIC); initially, the base address is 0x0.
 The word stored at address 0x00000000 is used as the starting value for
the MSP.
 Note that the LSB of all vectors in the table must be set to 1 (indicating
the exception will be executed in Thumb state)

Example:
The reset is exception type 1. The address of the reset vector is 1 times 4,
which equals 0x00000004; and NMI vector (type 2) is located in 2 * 4 =
0x00000008
Vector Table Definition After Reset
 Cortex-M3: Stack Memory Operations
 Multiple registers can be pushed and popped in one
instruction, using comma to separate
PUSH {reglist} ;push the largest numbered register first
POP {reglist} ; pop the lowest numbered registers first

 If a POP instruction includes PC in its reglist, a branch to

this location is performed when the POP instruction has
completed.
 Note that Bit[0] of the value read for the PC must be 1 (used to update the
APSR T-bit)

Example:
PUSH {R0-R7, LR} ; Save registers
…
POP {R0-R7, PC} ; Restore registers
 Cortex-M3: Stack Implementation
 The stack pointer (SP) points to the last data pushed to the stack memory,
and the SP decrements first in a new PUSH operation.
R0 0x12345678 PUSH {R0}

high Occupied Occupied

Occupied Occupied
Memory
Last pushed data SP Occupied
address Stack
-- 0x12345678 SP growth
-- --
low

 For POP operations, the data is read from the memory location pointer by
SP, then the stack pointer is incremented. The contents in the memory
location are unchanged.

Occupied POP {R0} Occupied

Occupied Occupied
Memory
Occupied Occupied SP
address
0x12345678 SP 0x12345678

-- --

R0 -- R0 0x12345678
 Cortex-M3: The Two-Stack Model
 The Cortex-M3 has two stack pointers: the Main Stack Pointer (MSP) and
the Process Stack Pointer (PSP).
 The SP register to be used is controlled by the CONTROL register bit 1.
 Control [1] = 0, both Thread mode and Handler mode use MSP (main
program and handlers share the same stack memory region)

Interrupt
Exit
Interrupt Service
Interrupt Routine(ISR)
Event
Main
Program Unstacking
Stacking Time

Thread Mode Handler Mode Thread Mode

(Use MSP) (Use MSP) (Use MSP)
 Cortex-M3: The Two-Stack Model
 Control [1] = 1, the PSP is used in Thread mode and the MSP is used in
handler mode (main program and handlers have separate stack
memory regions)
Interrupt
Exit
Interrupt Service
Routine(ISR)
Interrupt
Event
Main
Program Unstacking
Stacking Time

Thread Mode Handler Mode Thread Mode

(Use PSP) (Use MSP) (Use PSP)

Which stack will the automatic stacking and unstacking mechanism use?
 Cortex-M3: Reset Sequence
 After the processor exits reset, it will read two words
from memory:
 Address 0x00000000: default value of R13 (MSP)
 Address 0x00000004: Reset vector (the starting address of startup
program)

Fetch Initial Fetch Reset Instruction

SP Value Vector Fetch

Address= Address= Address=

Reset
0x00000000 0x00000004 Reset Vector

Time
 Initial Stack Pointer Value and Initial Program Counter (PC) Value Example

Other Memory Initial SP Value

0x20008000 0x20008000
0x20007FFC 1st Stacked Item
2nd Stacked Item Stack
0x20007FF8 grows
Stack
Memory downward

0x20007C00 Assume that the stack memory

Other Memory range from 0x20007C00 to
0x20007FFF

Flash

Boot Code
0x00000100
Other Exception Reset
Vectors Vector

0x00000004 0x00000101

0x00000000 0x20008000