title: Are ARM Cortex-M0 Stacking Registers Saved On $psp or $msp During Hardfault?
body: <p>I have an issue where my Cortex-M0 is hard faulting, so I am trying to debug it. I am trying to print the contents of the ARM core registers that were pushed to the stack when the hard fault occurred.</p>
  
  <p>Here is my basic assembly code:</p>
  
  <pre><code>__attribute__((naked)) void HardFaultVector(void) {
      asm volatile(
          // check LR to see whether the process stack or the main stack was being used at time of exception.
          "mov r2, lr\n"
          "mov r3, #0x4\n"
          "tst r2, r3\n"
          "beq _MSP\n"
  
          //process stack was being used.
          "_PSP:\n"
          "mrs r0, psp\n"
          "b _END\n"
  
          //main stack was being used.
          "_MSP:\n"
          "mrs r0, msp\n"
          "b _END\n"
  
          "_END:\n"
          "b fault_handler\n"
      );  
  }  
  </code></pre>
  
  <p>The function <code>fault_handler</code> will print the contents of the stack frame that was pushed to either the process stack or the main stack. Here's my question though:</p>
  
  <p>When I print the contents of the stack frame that supposedly has the saved registers, here is what I see:</p>
  
  <pre><code>Stack frame at 0x20000120:
   pc = 0xfffffffd; saved pc 0x55555554
   called by frame at 0x20000120, caller of frame at 0x20000100
   Arglist at unknown address.
   Locals at unknown address, Previous frame's sp is 0x20000120
   Saved registers:
    r0 at 0x20000100, r1 at 0x20000104, r2 at 0x20000108, r3 at 0x2000010c, r12 at 0x20000110, lr at 0x20000114, pc at 0x20000118, xPSR at 0x2000011c
  </code></pre>
  
  <p>You can see the saved registers, these are the registers that are pushed by the ARM core when a hard fault occurs. You can also see the line <code>pc = 0xfffffffd;</code> which indicates that this is the <code>LR</code>'s <code>EXC_RETURN</code> value. The value <code>0xfffffffd</code> indicates to me that the process stack was being used at the time of the hard fault. </p>
  
  <p>If I print the <code>$psp</code> value, I get the following:</p>
  
  <pre><code>gdb $ p/x $psp
  $91 = 0x20000328
  </code></pre>
  
  <p>If I print the <code>$msp</code> value, I get the following: </p>
  
  <pre><code>gdb $ p/x $msp
  $92 = 0x20000100
  </code></pre>
  
  <p>You can clearly see that the <code>$msp</code> is pointing to the top of the stack where supposedly the saved registers are located. <strong>Doesn't this mean that the main stack has the saved registers that the ARM core pushed to the stack?</strong></p>
  
  <p>If I print the memory contents, starting at the <code>$msp</code> address, I get the following:</p>
  
  <pre><code>gdb $ x/8xw 0x20000100
  0x20000100 &lt;__process_stack_base__&gt;:    0x55555555  0x55555555  0x55555555  0x55555555
  0x20000110 &lt;__process_stack_base__+16&gt;: 0x55555555  0x55555555  0x55555555  0x55555555
  </code></pre>
  
  <p>It's empty...</p>
  
  <p>Now, if I print the memory contents, starting at the <code>$psp</code> address, I get the following:</p>
  
  <pre><code>gdb $ x/8xw 0x20000328
  0x20000328 &lt;__process_stack_base__+552&gt;:    0x20000860  0x00000054  0x00000054  0x20000408
  0x20000338 &lt;__process_stack_base__+568&gt;:    0x20000828  0x08001615  0x1ad10800  0x20000000
  </code></pre>
  
  <p>This looks more accurate. <strong>But I thought the saved registers are supposed to indicate where in flash memory they are located? So how does this make sense?</strong></p>