About the location and redirection of STM32 interrupt vector table

From stm32f10x.s, we can see that a lot of interrupt response functions have been defined. This is the interrupt vector table. The label __Vectors indicates the entry address of the interrupt vector table, for example:
AREA RESET, DATA, READONLY; Define the read-only data segment, which is actually in the CODE area (assuming that STM32 is started from FLASH, the starting address of this interrupt vector table is 0x8000000)
                EXPORT __Vectors
                IMPORT OS_CPU_SysTickHandler
                IMPORT OS_CPU_PendSVHandler

__Vectors DCD __initial_sp; Top of Stack
                  DCD Reset_Handler; Reset Handler
                  DCD NMI_Handler; NMI Handler
                  DCD HardFault_Handler; Hard Fault Handler
                  DCD MemManage_Handler; MPU Fault Handler
                  DCD BusFault_Handler; Bus Fault Handler
                  DCD UsageFault_Handler; Usage Fault The writing of the Handler

vector table is particular. It corresponds to the hardware one by one and cannot be written randomly. The CPU relies on it to find the entry address. The beginning of the bin file is their address. The arrangement can be seen in Section 10.1.2 of the reference manual RM0008.

Let's combine the characteristics of CORTEX-M3. After it is powered on, it determines the PC position according to the boot pin. For example, if the boot is set to flash startup, the PC jumps to 0x08000000 after startup. At this time, the CPU will first take 2 addresses, the first is the top address of the stack, and the second is the reset exception address, so there is the above writing method, so it jumps to reset_handler.

So what is the actual address of this reset_handler? What is the address of the following pile of Nmi_handler? How does an interrupt run to this address? Let's explain them one by one.

1. We can know these entry addresses by reverse. You can see it by checking the map file under the project. This address is closely related to the target->flash start address set in keil. In fact, we don't need to care too much. Let the compiler allocate it. The interrupt vector table puts their addresses.
2. Compared with ARM7/ARM9 cores, the Cortex-M3 core has a fixed interrupt vector table location and a variable start address.
3. After entering the C language, NVIC will be configured first. In NVIC_SetVectorTable(), the start address and offset of the interrupt vector table can be configured. It mainly tells the CPU whether the vector table is located in Flash or Ram, and what the offset is. For example, if it is set to be located in Flash, the offset is the address of the program burned in, which can be set in the Keil target. In this way, the CPU knows the entry address.

4. After an interrupt occurs, the CPU finds the interrupt vector table address, and then finds the interrupt address based on the offset (matching the number), so it jumps to the interrupt address.
Let's take a screenshot to illustrate the map file:

The corresponding bin file, see if it is placed at the above address:

Obviously, 200039c0 is the top address of the stack, and 08006F21 is the reset_handler address!

How to locate? Take 0x20000000 as an example

1. Keil sets the RAM start to 0x20000100. We put the interrupt vector table at 0x20000000~0x20000100, and the rest is for the program.

2. Set NVIC_SetVectorTable(NVIC_VectTab_FLASH,0);

3. When jumping to C, copy the interrupt vector table to 0x20000000