Index: kernel/arch/arm32/src/exc_handler.S
===================================================================
--- kernel/arch/arm32/src/exc_handler.S	(revision 5c16ce7d84b3d7c69d23984697eca2bb7af2473c)
+++ kernel/arch/arm32/src/exc_handler.S	(revision dfd735a17f05114b7c3cfafef153c4894f4737cb)
@@ -96,5 +96,7 @@
 	ldmfd r3!, {r4-r7}
 	stmfd r13!, {r4-r7}
-	stmfd r13, {r13, lr}^
+	mov r4, r13
+	stmfd r4, {r13, lr}^
+	nop			/* Cannot access r13 immediately after stm(2) */
 	sub r13, r13, #8
 	stmfd r13!, {r2}
@@ -138,5 +140,7 @@
 
 	# return to user mode
-	ldmfd r13, {r13, lr}^
+	mov r0, r13
+	ldmfd r0, {r13, lr}^
+	nop			/* Cannot access r13 immediately after ldm(2) */
 	add r13, r13, #8
 	b 2f
Index: kernel/arch/arm32/src/userspace.c
===================================================================
--- kernel/arch/arm32/src/userspace.c	(revision 5c16ce7d84b3d7c69d23984697eca2bb7af2473c)
+++ kernel/arch/arm32/src/userspace.c	(revision dfd735a17f05114b7c3cfafef153c4894f4737cb)
@@ -98,4 +98,5 @@
 		"msr spsr_c, %[user_mode]\n"
 		"ldmfd sp, {r0-r12, sp, lr}^\n"
+		"nop\n"		/* Cannot access sp immediately after ldm(2) */
 		"add sp, sp, #(15*4)\n"
 		"ldmfd sp!, {pc}^\n"