Architecture & Programmer's Model

• The default 32-bit MCU ISA. Virtually every major MCU vendor (ST, NXP, Nordic, Silicon Labs, Renesas, Microchip, Infineon, TI, Ambiq, GigaDevice, Raspberry Pi) ships Cortex-M silicon.
• Volume. Arm-based microcontrollers ship at tens of billions of units per year; Cortex-M is the largest slice.
• Span. One family from a $0.10 Cortex-M0 to a 600 MHz cache-equipped Cortex-M85 — same toolchain, same CMSIS headers.
• Ubiquity. Also lives inside bigger chips: as a secure enclave (Cortex-M33), a wake-up controller, or a peripheral offload engine in many A-profile SoCs.

Instruction set

• Thumb subset: ~56 instructions.
• No integer divide — software emulation.
• No bit-field ops, no saturating arithmetic.
• 32×32→32 multiply (1-cycle or 32-cycle by option).
• IT block present but limited (only 32-bit BL, SVC, MRS/MSR, DSB/DMB/ISB are 32-bit encodings).

System features

• No bit-banding.
• No BASEPRI — only PRIMASK for IRQ masking.
• Max 32 external IRQs, 4 priority levels.
• MPU optional on M0+ (8 regions) — not on M0/M1.
• Single vector table; no VTOR on M0 (relocation via remap-to-SRAM trick on some SoCs); VTOR on M0+.

v7-M (M3)

• Full Thumb-2 (~200 instructions).
• Hardware divide (SDIV/UDIV, 2–12 cycles).
• Bit-field: BFI, BFC, UBFX, SBFX.
• Exclusive access: LDREX/STREX (word, half, byte).
• Bit-banding, NVIC, full MPU option.
• Up to 240 IRQs, 8-bit priority field (implementations expose 3–8 bits).

v7E-M adds (M4, M7)

• DSP extension: SSAT/USAT, QADD/QSUB, QADD8/QADD16, SMLAD, SMLAL, SMMUL etc.
• Packed-operand SIMD on 32-bit registers (2×16-bit or 4×8-bit lanes).
• Optional single-precision FPU (FPv4-SP on M4, FPv5-SP or FPv5-DP on M7).

v8-M Baseline (M23)

• Armv6-M + TrustZone (the "hardware security" part).
• Adds SG, BXNS, BLXNS, MOVW/MOVT, hardware divide.
• Keeps the small area footprint of M0+/M23.

v8-M Mainline (M33, M35P)

• Superset of v7-M + TrustZone.
• Introduces stack-limit registers (MSPLIM, PSPLIM) — HW-enforced stack overflow detection.
• Co-processor interface (ACI) for vendor-specific instructions.
• Separate S/NS banks for SP, PSPLIM, MSPLIM, CONTROL, FAULTMASK, BASEPRI, PRIMASK.

The idea

• Cortex-M runs only in Thumb state — no A32 (ARM state), no A64.
• Most common instructions encode in 16 bits → excellent code density.
• Less-common or wider-immediate variants use a 32-bit encoding, distinguishable by the top-5 bits of the half-word.
• Result: ≈ ARM 32-bit performance at ≈ ARM code size divided by 1.3.

Encoding at a glance

; 16-bit encodings (common case)
  MOV   r0, #42        ; 0x202A
  ADD   r0, r1         ; 0x1840
  LDR   r0, [r1, #4]   ; 0x6848

; 32-bit encodings (wider imm, etc.)
  MOVW  r0, #0x1234    ; F240 0234
  BL    some_func      ; F7FF FFFE
  UDIV  r0, r1, r2     ; FBB1 F0F2
  SMLAL r0,r1,r2,r3    ; FBC2 0103

Decoder inspects the first half-word: bits[15:11] = 11101, 11110, or 11111 → 32-bit instruction.

Arm A32 condition codes on every instruction — Thumb-2 instead uses a lightweight IT instruction to predicate the next 1–4 instructions.

; if (r0 < r1) r2 = r0; else r2 = r1;
  CMP   r0, r1
  ITE   LT          ; If Then Else
  MOVLT r2, r0      ; IF branch
  MOVGE r2, r1      ; ELSE branch

• Encodes "T" and "E" for up to 4 following instructions.
• Avoids short branches; predictable timing → good for ISRs.

Interview gotchas

• An IT block is architectural — the CPU tracks ITSTATE in EPSR. You cannot branch into the middle of one.
• An exception taken inside an IT block is fine — hardware saves xPSR (which includes ITSTATE) on stack and restores it on return.
• v8-M Mainline deprecates IT blocks of more than one instruction; v8.1-M adds branch-future alternatives for the same purpose.

AAPCS calling convention

• Args in R0–R3, then stack.
• Return value in R0 (or R0:R1 for 64-bit).
• R4–R11, LR preserved across calls.
• Stack 8-byte aligned at public interfaces.

Why two stacks?

• MPU can restrict user-task stacks to their own PSP region without blocking the kernel's MSP.
• A rogue task that blows its stack cannot corrupt kernel state above — at worst it hits MemManage on its own PSPLIM.
• Exception always stacks on the currently-active SP, then switches to MSP for the handler. On return, CPU restores the previous SP selection from EXC_RETURN.

; typical RTOS switch to Unpriv Thread w/ PSP
  LDR   r0, =task_stack_top
  MSR   PSP, r0
  MOVS  r0, #0b011       ; SPSEL=1, nPRIV=1
  MSR   CONTROL, r0
  ISB
  BX    lr               ; return to task

• Hardware pushes exactly the caller-saved set. The handler may compile as an ordinary C function with no prologue tricks.
• Stack is aligned to 8 bytes (AAPCS) — CPU inserts padding and flags it in bit 9 of the stacked xPSR.
• If FPU is enabled and context has been touched (CONTROL.FPCA=1), an extended frame of 26 words is used.
• Lazy stacking (v7E-M, v8-M): space is reserved but S0-S15/FPSCR are not actually written until the handler itself executes an FP instruction. Typical 17-cycle saving.

On exception entry, LR is loaded with a value where bits [31:4] = 0xFFFFFFF. Bits [3:0] encode how to return:

; v7-M EXC_RETURN values

  0xFFFFFFF1   Handler → Handler   MSP   Basic
  0xFFFFFFF9   Handler → Thread    MSP   Basic
  0xFFFFFFFD   Handler → Thread    PSP   Basic

  0xFFFFFFE1   Handler → Handler   MSP   Extended (FP)
  0xFFFFFFE9   Handler → Thread    MSP   Extended
  0xFFFFFFED   Handler → Thread    PSP   Extended

Executing BX lr with any of these forces an exception-return sequence: unstack the frame, restore xPSR / IPSR, resume.

v8-M extensions

• Extra bit [6] distinguishes Secure vs Non-Secure exception return.
• Extra bit [0] (S) and bit [5] (DCRS) control whether integrity signature / additional context was stacked during a cross-domain exception.
• Attempting BX lr with an invalid EXC_RETURN in Thread mode → UsageFault.

Endianness

• Cortex-M supports either little- or big-endian — chosen at reset by a strap pin (BIGEND).
• Every shipping silicon implementation is little-endian. Big-endian exists in the architecture but you will not see it in the wild.
• Data endianness only — instructions are always stored little-endian by the linker.
• REV, REV16, REVSH, RBIT instructions for byte/bit swaps.

Alignment

• v7-M / v7E-M / v8-M: unaligned word & half-word loads/stores supported in Normal memory (split into aligned beats, several cycles).
• v6-M: unaligned access always faults (UsageFault on M3/M4 too if CCR.UNALIGN_TRP=1).
• Device & Strongly-Ordered memory: unaligned always faults.
• Stack must be 8-byte aligned at exception entry; hardware enforces.

; atomic increment of *p
try:
    LDREX  r1, [r0]      ; tag exclusive
    ADDS   r1, r1, #1
    STREX  r2, r1, [r0]  ; r2=0 ok, 1 fail
    CMP    r2, #0
    BNE    try
    DMB

• Single-core architectural primitive — maps to a local monitor in each Cortex-M.
• Any exception, context switch, or write to the tagged address clears the monitor → retry.
• Used by FreeRTOS (on M3+) and C11 atomics.
• v8-M adds byte/half-byte variants (LDREXB, LDREXH) and clearer ordering rules.
• M0 / M0+ / M23 lack LDREX/STREX — they use cpsid i / PRIMASK critical sections instead.

What the CPU does out of reset

1. Read 32-bit word at address 0x00000000 → load into MSP.
2. Read 32-bit word at address 0x00000004 → load into PC (reset vector).
3. Enter Privileged Thread mode, MSP selected, T-bit = 1.
4. All NVIC IRQs disabled, VTOR = 0, SCB/MPU unconfigured.

Typical startup code

Reset_Handler:
  LDR    r0, =_sidata    ; .data init
  LDR    r1, =_sdata
  LDR    r2, =_edata
copy: CMP r1, r2
  ITT    LT
  LDRLT  r3, [r0], #4
  STRLT  r3, [r1], #4
  BLT    copy

  LDR    r0, =_sbss      ; .bss zero
  LDR    r1, =_ebss
  MOVS   r2, #0
zero: CMP r0, r1
  ITT    LT
  STRLT  r2, [r0], #4
  BLT    zero

  BL     SystemInit      ; PLLs, caches, VTOR
  BL     __libc_init_array
  BL     main

• CMSIS-CORE — C headers for registers, intrinsics (__WFI, __DMB), NVIC/SCB/MPU inline functions. Every Cortex-M vendor ships this.
• CMSIS-DSP — fixed/float DSP kernels; uses DSP & FPU instructions when available, scalar fallback when not.
• CMSIS-NN — int8/int16 NN primitives optimised for M4 DSP and M55/M85 Helium.
• CMSIS-RTOS v2 — thin API spec; FreeRTOS/Zephyr/RTX implement it.
• CMSIS-Pack — device description files, used by Keil µVision, VS Code embedded tools, Arm Clang.

/* Portable: same on any Cortex-M */
#include "cmsis_compiler.h"

void enter_critical(void)
{
    __disable_irq();          /* cpsid i */
    __DMB();
}

uint32_t atomic_load(uint32_t *p)
{
    uint32_t v = __LDREXW(p);
    __CLREX();                /* drop monitor */
    return v;
}