But that's not all! LDM can access banked user registers. As a special case, this disables base register updates. LDM can copy SPSR to CPSR, causing an except

But that's not all! LDM can access banked user registers. As a special case, this disables base register updates. LDM can copy SPSR to CPSR, causing an exception return with register banking. This is a way to go from kernel code to user code.