I'm debugging an ARM cortex M4 (STM32F4) running FreeRTOS.
Inside the assembly FreeRTOS function
vPortSVCHandler, there's a branch instruction
using GDB, I step through instruction by instruction and find that r14 (lr) contains the value
0xfffffffd (not a valid address) immediately before the bx instruction is executed.
For some reason, GDB doesn't follow the
bx instruction with
si (hangs), but I'm still able to
step via openOCD. I find that the function that's branched to is in fact a valid function at address
From the ARM docs on
bx, its argument should be a register containing an address to branch to.
Clearly, I'm misunderstanding or looking at the wrong docs.
I tried tweaking
lr with GDB just before the branch instruction. Changing it to
0xfffffff7 results in a hard fault shortly after the branch.
How does this branch instruction, when called with a value of
0xfffffffd, result in branching to a valid function at