Two Physical Stack Pointers in Cortex-M

Every ARM Cortex-M processor contains two separate, independent stack pointer registers: the Main Stack Pointer (MSP, also called SP_main) and the Process Stack Pointer (PSP, also called SP_process). At any given moment the processor exposes only one of them as the architectural “SP” (R13), but both registers exist in silicon and hold their values simultaneously.

This dual-pointer design was motivated by real-time operating systems. In an RTOS each task (thread) has its own PSP-backed stack. The RTOS itself and all interrupt handlers share the MSP-backed stack. This physical separation makes it impossible for a misbehaving task to overflow into ISR stack space, improving fault isolation without any software overhead.

Stack Placement in SRAM: Type 1 vs Type 2

The linker script determines where the stack lives in SRAM. There are two common arrangements for embedded applications, each with different trade-offs for overflow detection and memory utilisation.

Type 1 — Stack in the Middle of RAM

Type 2 — Stack at the Top of RAM (Recommended)

STM32F411 default linker script (Type 2)

/* From the default STM32F411 linker script (STM32F411RETx_FLASH.ld) */
_estack = ORIGIN(RAM) + LENGTH(RAM);   /* = 0x20000000 + 0x20000 = 0x20020000 */

MEMORY
{
  RAM  (xrw) : ORIGIN = 0x20000000, LENGTH = 128K
  FLASH (rx) : ORIGIN = 0x08000000, LENGTH = 512K
}

/* SP is initialised to _estack = 0x20020000 (one past the last RAM byte) */
/* The vector table word 0 contains this value, loaded by hardware at reset */

On STM32F411 with 128 KB SRAM, RAM runs from 0x20000000 to 0x2001FFFF. The initial SP is set to 0x20020000 — one word past the top of RAM. The first PUSH decrements SP to 0x2001FFFC and writes to that address, which is valid SRAM.

Partitioning SRAM for MSP and PSP

In bare-metal applications, the MSP uses the full SRAM stack region. When introducing an RTOS or a bare-metal dual-stack design, SRAM is split between the two stack pointers. A common partition gives each stack an equal fixed size.

MSP/PSP summary — 4 key rules

• There are exactly 2 physical stack pointer registers in every Cortex-M processor (MSP and PSP).
• MSP is the default after reset; it is used by all exception/IRQ handlers and by Thread mode code when CONTROL[1]=0.
• PSP is an alternate stack pointer, available only in Thread mode, typically used for application tasks in RTOS environments.
• After power-up, hardware automatically initialises MSP by reading word 0 of the vector table (address 0x00000000). PSP is not initialised by hardware — software must set it before switching.

Switching Between MSP and PSP

The active stack pointer in Thread mode is controlled by bit 1 (SPSEL) of the CONTROL register. Writing CONTROL[1]=1 makes the processor use PSP as SP in Thread mode. This must be done carefully — the switch takes effect after the pipeline is flushed, and SP must point to valid stack memory before the switch.

Method 1: Direct assembly with MSR/MRS

/* Read current CONTROL value, set SPSEL, write back, flush */
void switch_to_psp_asm(uint32_t psp_top)
{
    uint32_t ctrl;

    /* Step 1: initialise PSP before switching to it */
    __asm volatile ("MSR PSP, %0" : : "r"(psp_top) : "memory");

    /* Step 2: set SPSEL bit in CONTROL */
    __asm volatile ("MRS %0, CONTROL" : "=r"(ctrl));
    ctrl |= (1U << 1);   /* SPSEL = 1 → use PSP */
    __asm volatile (
        "MSR CONTROL, %0\n\t"
        "ISB\n\t"          /* instruction sync barrier — required after CONTROL write */
        : : "r"(ctrl) : "memory"
    );
    /* From this point SP (R13) refers to PSP */
}

Method 2: Naked function in C

A naked function is a C function decorated with __attribute__((naked)). The compiler emits no prologue (PUSH) or epilogue (POP PC) for naked functions — only the inline assembly body appears. This is essential for SP-switching code because a normal C function’s prologue would PUSH to the stack using whatever SP is currently active, potentially corrupting either MSP or PSP data during the switch.

/* Naked function: compiler generates NO prologue/epilogue */
__attribute__((naked)) void switch_sp_to_psp(void)
{
    __asm volatile (
        /* R0 contains the first argument (psp_value) on entry */
        "MSR PSP, R0       \n\t"   /* load PSP with the provided stack top */
        "MRS R0, CONTROL   \n\t"   /* read CONTROL */
        "ORR R0, R0, #0x02 \n\t"   /* set bit 1 (SPSEL) */
        "MSR CONTROL, R0   \n\t"   /* write CONTROL */
        "ISB               \n\t"   /* flush pipeline */
        "BX  LR            \n\t"   /* return — now running on PSP */
    );
}

/* Caller: */
#define PSP_STACK_SIZE  1024U
static uint8_t psp_stack[PSP_STACK_SIZE] __attribute__((aligned(8)));

void setup_psp(void)
{
    uint32_t psp_top = (uint32_t)(psp_stack + PSP_STACK_SIZE);
    switch_sp_to_psp(psp_top);
    /* All code from here uses PSP */
}

Method 3: Reading current PSP/MSP values

static inline uint32_t get_msp(void)
{
    uint32_t val;
    __asm volatile ("MRS %0, MSP" : "=r"(val));
    return val;
}

static inline uint32_t get_psp(void)
{
    uint32_t val;
    __asm volatile ("MRS %0, PSP" : "=r"(val));
    return val;
}

static inline void set_msp(uint32_t val)
{
    __asm volatile ("MSR MSP, %0" : : "r"(val) : "memory");
}

static inline void set_psp(uint32_t val)
{
    __asm volatile ("MSR PSP, %0" : : "r"(val) : "memory");
}

Full bare-metal dual-stack initialisation

/* linker symbols from STM32 ld file */
extern uint32_t _estack;          /* top of RAM = initial MSP */

/* Dedicate bottom 1 KB of the stack region to PSP */
#define MSP_SIZE   1024U
#define PSP_SIZE   1024U

/* In the linker script, _estack = RAM_END.
   MSP uses RAM_END down to (RAM_END - MSP_SIZE).
   PSP uses (RAM_END - MSP_SIZE) down to (RAM_END - MSP_SIZE - PSP_SIZE). */

static const uint32_t MSP_START = (uint32_t)&_estack;
static const uint32_t PSP_START = (uint32_t)&_estack - MSP_SIZE;

__attribute__((naked)) void init_psp_stack(void)
{
    __asm volatile (
        "LDR R0, =PSP_START\n\t"   /* load PSP_START address */
        "LDR R0, [R0]      \n\t"   /* dereference to get the value */
        "MSR PSP, R0       \n\t"   /* set PSP */
        "MRS R0, CONTROL   \n\t"
        "ORR R0, R0, #0x02 \n\t"   /* SPSEL = 1 */
        "MSR CONTROL, R0   \n\t"
        "ISB               \n\t"
        "BX  LR            \n\t"
    );
}

int main(void)
{
    init_psp_stack();
    /* Thread code now uses PSP.
       MSP is reserved for fault handlers and ISRs. */
    while (1) { /* application loop */ }
}

Mode, Privilege, and SP Selection Table

Automatic SP Switch on Exception Entry and Exit

One of the most elegant Cortex-M hardware features is automatic, transparent MSP/PSP switching on exception entry and return. The programmer’s RTOS code doesn’t have to manually switch stacks for IRQ servicing.

Exception entry sequence

1. Interrupt fires while Thread code runs on PSP.
2. Hardware stacks exception frame (R0-R3, R12, LR, PC, xPSR) onto the PSP (the current stack).
3. Hardware switches SP to MSP and sets EXC_RETURN = 0xFFFFFFFD in LR.
4. ISR executes entirely using MSP. It can freely PUSH/POP on MSP.

Exception return sequence

1. ISR executes BX LR (or POP {PC}). LR = 0xFFFFFFFD.
2. Hardware detects the magic EXC_RETURN value (bits 31:4 = 0xFFFFFFF).
3. Bit 2 of EXC_RETURN = 1 → return to Thread mode using PSP.
4. Hardware pops the exception frame from PSP, restoring R0-R3, R12, LR, PC, xPSR.
5. Processor resumes Thread code execution on PSP exactly where it left off.

Frequently Asked Questions