How a Boot ROM Works

When a chip powers on, everything is garbage — registers, RAM, no operating system. A CPU can do exactly one thing: fetch the instruction at an address and execute it. So designers hard-wire one question into the silicon: "At reset, which address do I fetch my first instruction from?"

That fixed address is the reset vector, and the code there is the Boot ROM — a small, read-only, immutable memory (a mask ROM patterned into the chip at the foundry). It's the first code that ever runs, and because it can't be changed, it's the trusted starting point for the whole system.

Here's a toy 8-bit CPU. At reset, the silicon forces PC = 0x00 — that's the reset vector. The Boot ROM at 0x00 sets up the stack, prints two characters over UART, then jumps to RAM (the "loaded app"). Press Step to advance one instruction, or Run to watch it boot.

In a real chip, the last step wouldn't just print “HI” — it would copy a bootloader from flash/SD into RAM and jump to it. Same idea, bigger payload.

A Cortex-M makes this even cleaner. At address 0x0000_0000 it doesn't place an instruction — it places a vector table. The hardware automatically loads the first two entries on reset, so the stack and entry point are set before a single line of your code runs:

So on a Cortex-M the boot sequence's first two steps are literally done by the silicon: SP ← [0x0], then PC ← [0x4] and off it runs.

A real SoC boot-ROM reset handler then does roughly this:

void Reset_Handler(void) {
    init_clocks();                 // PLL, set core frequency
    copy_data_section();           // init .data from flash → RAM
    zero_bss();                    // clear .bss
    sec = read_boot_pins();        // boot source? SD / eMMC / UART
    load_next_stage(sec, 0x20000000); // DMA bootloader into RAM
    verify_signature(0x20000000);  // secure boot: is it authentic?
    jump(0x20000000);              // hand control to the bootloader
}

Each stage is bigger and more capable than the last — but only the Boot ROM is immutable, so the chain of trust is anchored there:

Related: Cache Simulator · FSM Designer · Digital Electronics · Transistor Evolution