[ARMv7-A] Data abort exception LR

[garyv]

The lowest 1MB address range [0x0000 ~ 0xFFFFF] has been mapped for application(PL 0).
The other 1MB address range [0x100000 ~ 0x1FFFFF] has not been mapped by MMU.
To make the data abort exception, I write the following code:

Code: Select all

00000000     ldr sp, =0x100000
00000004     add sp, sp, #8
00000008     push {r0}     /* access un-mapped area, cause Data abort exception */
0000000C     push {r1}
00000010     ............

In the related kernel PL1 data exception handler:

Code: Select all

dabort_handler:
    sub lr, lr, 8  /* according to the ARMv7-A TRM */
    ldr r0, =str_dabort
    mov r1, lr
    bl  printf
      .....

str_dabort:
    .string   "Data abort exception, LR = 0x%x\r\n"

--------------------
After testing I got the following debug info:

Data abort exception, LR = 0x100000

According to ARMv7-A TRM, the LR should contain the address of the instruction which causes the exception. And it can be used as the exception return address. If so, LR should be 0x00000008, why?