diff --git a/.cargo/config b/.cargo/config
index deffdfc51e..ad2c02499b 100644
--- a/.cargo/config
+++ b/.cargo/config
@@ -1,6 +1,7 @@
 [target.'cfg(all(target_arch = "arm", target_os = "none"))']
 runner = "gdb-multiarch -q -x openocd.gdb"
 rustflags = [
+    "-C", "link-arg=--nmagic",
     "-C", "link-arg=-Tlink.x",
 # The target (below) defaults to cortex-m4
 # There currently are two different options to go beyond that:
diff --git a/Cargo.lock b/Cargo.lock
index 5e48b40520..4aa5c801b7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -102,6 +102,12 @@ dependencies = [
  "rustc_version",
 ]
 
+[[package]]
+name = "cc"
+version = "1.0.67"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c69b077ad434294d3ce9f1f6143a2a4b89a8a2d54ef813d85003a4fd1137fd"
+
 [[package]]
 name = "cfg-if"
 version = "1.0.0"
@@ -147,18 +153,15 @@ dependencies = [
 [[package]]
 name = "cortex-m-rt"
 version = "0.6.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "980c9d0233a909f355ed297ef122f257942de5e0a2cb1c39f60684b65bcb90fb"
+source = "git+https://github.com/rust-embedded/cortex-m-rt.git?rev=a2e3ad5#a2e3ad54478c6b98e519a1b0946395d790c0b6c7"
 dependencies = [
  "cortex-m-rt-macros",
- "r0",
 ]
 
 [[package]]
 name = "cortex-m-rt-macros"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4717562afbba06e760d34451919f5c3bf3ac15c7bb897e8b04862a7428378647"
+version = "0.6.11"
+source = "git+https://github.com/rust-embedded/cortex-m-rt.git?rev=a2e3ad5#a2e3ad54478c6b98e519a1b0946395d790c0b6c7"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -580,12 +583,6 @@ dependencies = [
  "proc-macro2",
 ]
 
-[[package]]
-name = "r0"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2a38df5b15c8d5c7e8654189744d8e396bddc18ad48041a500ce52d6948941f"
-
 [[package]]
 name = "rand"
 version = "0.8.3"
@@ -730,6 +727,7 @@ version = "0.5.0"
 dependencies = [
  "ad9959",
  "asm-delay",
+ "cc",
  "cortex-m 0.6.7",
  "cortex-m-log",
  "cortex-m-rt",
diff --git a/Cargo.toml b/Cargo.toml
index fe2f6ad37f..806600c496 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -54,6 +54,13 @@ rev = "61933f857a"
 features = ["stm32h743v", "rt", "unproven", "ethernet", "quadspi"]
 version = "0.9.0"
 
+[build-dependencies]
+cc = "1.0"
+
+[patch.crates-io.cortex-m-rt]
+git = "https://github.com/rust-embedded/cortex-m-rt.git"
+rev = "a2e3ad5"
+
 [patch.crates-io.miniconf]
 git = "https://github.com/quartiq/miniconf.git"
 rev = "314fa5587d"
diff --git a/build.rs b/build.rs
new file mode 100644
index 0000000000..3f9eaf9868
--- /dev/null
+++ b/build.rs
@@ -0,0 +1,9 @@
+fn main() {
+    println!("cargo:rerun-if-changed=memory.x");
+
+    cc::Build::new()
+        .file("src/startup.S")
+        .compile("startup");
+    println!("cargo:rerun-if-changed=src/startup.S");
+}
+
diff --git a/memory.x b/memory.x
index c1569ceddf..d87640af97 100644
--- a/memory.x
+++ b/memory.x
@@ -13,10 +13,6 @@ MEMORY
 }
 
 SECTIONS {
-  .itcm : ALIGN(8) {
-    *(.itcm .itcm.*);
-    . = ALIGN(8);
-    } > ITCM
   .axisram (NOLOAD) : ALIGN(8) {
     *(.axisram .axisram.*);
     . = ALIGN(8);
@@ -33,4 +29,18 @@ SECTIONS {
     *(.sram3 .sram3.*);
     . = ALIGN(4);
     } > SRAM3
-} INSERT AFTER .bss;
+  .itcm : ALIGN(8) {
+    . = ALIGN(8);
+    __sitcm = .;
+    *(.itcm .itcm.*);
+    . = ALIGN(8);
+    __eitcm = .;
+  } > ITCM AT>FLASH
+  __siitcm = LOADADDR(.itcm);
+} INSERT AFTER .uninit;
+
+ASSERT(__sitcm % 8 == 0 && __eitcm % 8 == 0, "
+BUG(cortex-m-rt): .itcm is not 8-byte aligned");
+
+ASSERT(__siitcm % 4 == 0, "
+BUG(cortex-m-rt): the LMA of .itcm is not 4-byte aligned");
diff --git a/src/bin/dual-iir.rs b/src/bin/dual-iir.rs
index 6d12be9159..0225175aa1 100644
--- a/src/bin/dual-iir.rs
+++ b/src/bin/dual-iir.rs
@@ -116,6 +116,8 @@ const APP: () = {
     /// Because the ADC and DAC operate at the same rate, these two constraints actually implement
     /// the same time bounds, meeting one also means the other is also met.
     #[task(binds=DMA1_STR4, resources=[adcs, digital_input1, dacs, iir_state, settings], priority=2)]
+    #[inline(never)]
+    #[link_section = ".itcm.process"]
     fn process(c: process::Context) {
         let adc_samples = [
             c.resources.adcs.0.acquire_buffer(),
diff --git a/src/hardware/mod.rs b/src/hardware/mod.rs
index d3e5711a45..8eed38d56b 100644
--- a/src/hardware/mod.rs
+++ b/src/hardware/mod.rs
@@ -71,11 +71,11 @@ fn panic(_info: &core::panic::PanicInfo) -> ! {
 }
 
 #[cortex_m_rt::exception]
-fn HardFault(ef: &cortex_m_rt::ExceptionFrame) -> ! {
+unsafe fn HardFault(ef: &cortex_m_rt::ExceptionFrame) -> ! {
     panic!("HardFault at {:#?}", ef);
 }
 
 #[cortex_m_rt::exception]
-fn DefaultHandler(irqn: i16) {
+unsafe fn DefaultHandler(irqn: i16) {
     panic!("Unhandled exception (IRQn = {})", irqn);
 }
diff --git a/src/startup.S b/src/startup.S
new file mode 100644
index 0000000000..3a5b6ea2d7
--- /dev/null
+++ b/src/startup.S
@@ -0,0 +1,44 @@
+.cfi_sections .debug_frame
+
+# .thumb
+.section .text.pre_init, "ax"
+.globl __pre_init
+.type __pre_init,%function
+.thumb_func
+.cfi_startproc
+__pre_init:
+
+  # Enable ITCM and DTCM
+  ldr r0, =1
+  ldr r1, =0xE000EF90
+  ldr r2, [r1]
+  # Set ITCMCR.EN
+  orr r2, r2, r0
+  str r2, [r1]
+  ldr r1, =0xE000EF94
+  ldr r2, [r1]
+  # Set DTCMCR.EN
+  orr r2, r2, r0
+  str r2, [r1]
+  dsb
+  isb
+
+  # Analogous to cortex-m-rt Reset code for .data copying.
+  # Initialise .itcm code. `__sitcm`, `__siitcm`, and `__eitcm` come from the
+  # linker script. Copy from r2 into r0 until r0 reaches r1.
+  ldr r0,=__sitcm
+  ldr r1,=__eitcm
+  ldr r2,=__siitcm
+1:
+  cmp r1, r0
+  beq 2f
+  # load 1 word from r2 to r3, inc r2
+  ldm r2!, {r3}
+  # store 1 word from r3 to r0, inc r0
+  stm r0!, {r3}
+  b 1b
+2:
+  dsb
+  isb
+  bx lr
+.cfi_endproc