1 — What Is a Task’s Execution Context (State)?

Imagine you are reading a book, then someone pauses you mid-sentence and asks another person to continue reading. For the second person to pick up exactly where you left off, they would need to know your page number, the word you were on, and every thought you were holding in your head. In an embedded processor, that information is the execution context.

For a task running on an ARM Cortex-M processor, the execution context is the complete snapshot of the CPU register file at the moment the task is interrupted. If you save all those registers somewhere and reload them later, the task resumes without any idea it was ever paused.

2 — Which CPU Registers Form the Task State

The ARM Cortex-M4 processor core contains the following register groups. All of them together represent the full execution context of a task:

The 16-Register Task Context at a Glance

3 — Step-by-Step Context Switch Procedure

A context switch has two halves: saving the outgoing task (T1) and restoring the incoming task (T2). Here is exactly what happens in order, from the moment SysTick fires to the moment T2’s first instruction runs.

4 — Hardware Stacking: What Happens on Exception Entry

Every time the Cortex-M processor takes any exception (SysTick, PendSV, IRQ, SVC, etc.), it performs an automatic stacking operation before running the handler. This is the hardware’s contribution to context saving — you get it for free.

1. Exception recognised The processor finishes the current instruction (or abandons it cleanly) and decides to take the exception.
2. Stack pointer selected If Thread mode was active with SPSEL=1, the PSP is used as the stack for the frame. If Thread mode used MSP, or we were already in Handler mode, the MSP is used.
3. Eight registers pushed — in order The CPU pushes: r0, r1, r2, r3, r12, LR, PC, xPSR. The stack grows downward; SP decrements by 32 bytes (8 × 4 bytes).
4. LR loaded with EXC_RETURN LR is overwritten with the EXC_RETURN value (e.g. 0xFFFFFFFD). This encodes the information needed to undo the stacking when the handler returns.
5. PC loaded with handler address The CPU jumps to the exception handler (SysTick_Handler, PendSV_Handler, etc.). The handler now runs in Handler mode using MSP.

Stack State During Exception Handler

5 — Hardware Unstacking: What Happens on Exception Exit

When an exception handler executes a BX LR instruction and LR holds an EXC_RETURN value (a value with bits[31:5] all set to 1, e.g. 0xFFFFFFFD), the processor does not jump to a function — it performs exception return, which includes automatic unstacking.

1. CPU detects EXC_RETURN The BX LR at the end of the handler passes 0xFFFFFFFD to the PC. The processor recognises the EXC_RETURN pattern and begins exception return.
2. Stack pointer selected from EXC_RETURN Bit 2 of EXC_RETURN says which stack to unstack from. 0xFFFFFFFD (bit 2 = 1) → use PSP. 0xFFFFFFF9 (bit 2 = 0) → use MSP.
3. Eight registers popped — in reverse order The CPU pops xPSR, PC, LR, r12, r3, r2, r1, r0 from the selected stack. SP increments by 32 bytes.
4. Execution resumes at restored PC The PC register now holds the address that was saved when the task was interrupted. The task continues from that exact instruction with all its register values intact.
5. Mode switches back to Thread mode The processor exits Handler mode and returns to Thread mode using PSP (because EXC_RETURN = 0xFFFFFFFD specifies this).

6 — The Full Stack Frame Picture

After PendSV has pushed r4–r11 and the hardware has pushed the exception frame, the complete layout of a suspended task’s stack looks like this:

7 — Implementing Context Save & Restore

Now that you understand exactly what must be saved and where, here is the complete PendSV context switch implementation alongside a C-side helper to verify the saved frame.

PendSV Handler (ASM)

    .syntax unified
    .thumb

    /* C functions to get/set PSP values stored in the TCB array */
    .extern get_current_psp    @ uint32_t get_current_psp(void)
    .extern save_current_psp   @ void     save_current_psp(uint32_t psp)
    .extern get_next_psp       @ uint32_t get_next_psp(void)
    .extern advance_task       @ void     advance_task(void)

    .global PendSV_Handler
    .type   PendSV_Handler, %function

PendSV_Handler:

    @ ════════════════════════════════════════════════════════
    @ PHASE 1: SAVE OUTGOING TASK CONTEXT
    @ At this point hardware has ALREADY pushed:
    @   xPSR, PC, LR, r12, r3, r2, r1, r0  onto PSP
    @ We only need to push r4-r11 manually.
    @ ════════════════════════════════════════════════════════

    mrs   r0, psp               @ r0 = current PSP value of outgoing task
    isb                         @ instruction sync barrier (good practice)

    stmdb r0!, {r4-r11}         @ push r4-r11 BELOW the hardware frame
                                @   STMDB = store multiple, decrement before
                                @   r0 is decremented as registers are stored
                                @   r11 is stored first (highest addr), r4 last (lowest)

    @ r0 now points to the TOP of the complete saved frame (where r4 lives)
    @ Save this value into the TCB
    push  {lr}                  @ preserve EXC_RETURN — bl will overwrite LR
    bl    save_current_psp      @ save_current_psp(r0) — stores r0 in TCB

    @ Advance the scheduler round-robin index
    bl    advance_task          @ current_task = (current_task + 1) % TASK_COUNT
    pop   {lr}                  @ restore EXC_RETURN

    @ ════════════════════════════════════════════════════════
    @ PHASE 2: RESTORE INCOMING TASK CONTEXT
    @ ════════════════════════════════════════════════════════

    push  {lr}
    bl    get_next_psp          @ r0 = next task's saved PSP (top of its context)
    pop   {lr}

    ldmia r0!, {r4-r11}         @ pop r4-r11 from incoming task's stack
                                @   LDMIA = load multiple, increment after
                                @   r4 loaded first (lowest addr), r11 last
                                @   r0 is incremented — now points to hardware frame

    msr   psp, r0               @ update PSP: CPU will unstack hardware frame from here
    isb

    @ EXC_RETURN in LR = 0xFFFFFFFD:
    @   → Return to Thread mode
    @   → Use PSP
    @   → No FP extension
    @ CPU will now automatically pop r0,r1,r2,r3,r12,LR,PC,xPSR from PSP
    bx    lr

Stack Inspection (C)

#include <stdint.h>
#include <stdio.h>
#include "scheduler.h"

/*
 * Layout of a fully saved task stack frame.
 * The PSP stored in the TCB points to the START of this struct
 * (i.e. to the r4 field).
 *
 * Stack grows downward, so r4 is at the lowest address.
 */
typedef struct {
    /* Manually pushed by PendSV (lower addresses = pushed last) */
    uint32_t r4, r5, r6, r7, r8, r9, r10, r11;

    /* Auto-pushed by hardware on exception entry (higher addresses) */
    uint32_t r0, r1, r2, r3, r12;
    uint32_t lr;     /* LR at time of preemption (task's return address) */
    uint32_t pc;     /* PC — where the task will resume */
    uint32_t xpsr;   /* Program status — Thumb bit must be 1 */
} task_frame_t;

/* Print the saved register values for a given task */
void dump_task_frame(uint32_t saved_psp, uint8_t task_id)
{
    task_frame_t *frame = (task_frame_t *)saved_psp;

    printf("\n=== Task %d saved context ===\n", task_id);

    /* Manually saved */
    printf("  r4  = 0x%08lX\n", frame->r4);
    printf("  r5  = 0x%08lX\n", frame->r5);
    printf("  r6  = 0x%08lX\n", frame->r6);
    printf("  r7  = 0x%08lX\n", frame->r7);
    printf("  r8  = 0x%08lX\n", frame->r8);
    printf("  r9  = 0x%08lX\n", frame->r9);
    printf("  r10 = 0x%08lX\n", frame->r10);
    printf("  r11 = 0x%08lX\n", frame->r11);

    /* Hardware saved */
    printf("  r0  = 0x%08lX\n", frame->r0);
    printf("  r1  = 0x%08lX\n", frame->r1);
    printf("  r2  = 0x%08lX\n", frame->r2);
    printf("  r3  = 0x%08lX\n", frame->r3);
    printf("  r12 = 0x%08lX\n", frame->r12);
    printf("  LR  = 0x%08lX\n", frame->lr);
    printf("  PC  = 0x%08lX  <-- task resumes here\n", frame->pc);
    printf("  PSR = 0x%08lX  (Thumb bit: %s)\n",
           frame->xpsr,
           (frame->xpsr & (1U << 24)) ? "SET (OK)" : "CLEAR (FATAL!)");
}

/* Call from a debug task or fault handler to inspect all tasks */
void dump_all_tasks(void)
{
    for (int i = 0; i < TASK_COUNT; i++) {
        dump_task_frame(get_task_psp(i), i + 1);
    }
}

Output & Verification

Expected Output from dump_task_frame()

// Called after first SysTick fires — Task 1 has been suspended once

=== Task 1 saved context ===
r4 = 0x00000004 <– init value from fake frame
r5 = 0x00000005
r6 = 0x00000006
r7 = 0x00000007
r8 = 0x00000008
r9 = 0x00000009
r10 = 0x0000000A
r11 = 0x0000000B
r0 = 0x00000000
r1 = 0x00000000
r2 = 0x00000000
r3 = 0x00000000
r12 = 0x00000000
LR = 0xFFFFFFFD <– EXC_RETURN
PC = 0x080001A4 <– task1_handler entry addr
PSR = 0x01000000 (Thumb bit: SET (OK))

🧠 Quick Knowledge Check

Frequently Asked Questions