LDMFD affects R13 oddly

Question

We are using arm9 with ucos. The OS_CPU_ARM_ExceptHndlr_BrkTask common porting function's last instrument has strange behavior in our system.

Instrument: LDMFD SP!,{R0-R12,LR,PC}^

Let's suppose the SP is 0x10002000, and the following 15 DWORDs (which will be copied to R0-R12, LR, PC) have values from 1 to 15. We find the PC (R15) is changed and jumps to 15, but the SP (R13) is changed to a strange value (an address far outside the stack memory space). I expected it would become 0x1000203C (0x10002000+4*15).

Why is R13 changed this way?

Answer 1

This instruction loads r14, like the other registers, from the stack. Write to PC causes the jump. This is not a branch and link that would set the return address to the link register.

Additionally, this instruction is actually an exception return (Because of the ^). So depending on the mode you are returning from, r14 might be banked. So after the exception return, you might see a different r14 than the one that was loaded from memory.