I am attempting to run FreeRTOS under qemu-system-arm 0.12. I am compiling from source. At the current time arm-test works fine. It uses a boot loader with the expectation that the PC=0 after Reset is de-asserted.
The CORTEXT-M3 reference states: NVIC resets, holds core in reset NVIC clears most of its registers. The processor is in Thread mode, priority is privileged, and the stack is set to Main.
NVIC releases core from reset NVIC releases core from reset. Core sets stack Core reads the start SP, SP_main, from vector-table offset 0. Core sets PC and LR Core reads the start PC from vector-table offset. LR is set to 0xFFFFFFFF.
Reset routine runs NVIC has interrupts disabled, and NMI and Hard Fault are not disabled.
My translation of this is that the NVIC vector table is located at 0x0. Therefore SP=Word at location 0 of physical memory. LR=0xFFFFFFFF, and PC=Word at location 4 of physical memory.
This matches what I see in the LM3S811 example code from TI, it also matches what I see in the FreeRTOS code.
In looking at target-arm/helper.c I did not see anything that seemed to set the PC, SP or LR. I added some code to the reset functions and moved what I think is the PC set.