xPSR change itself when branching

I am writing an embedded operating system targeting arm cortexm 4... I am working on context switching .. I can switch the kernel into user program and go back. but SVC call seems not work well.

syscall:
    svc SYSCALL_SVC_NUMBER
    bx lr

when calling svc it trigger interrupt, I can see the control flow go back to kernel. The hard fault arise when it gets back to user program.

around here --> bx lr

I've checked that all the registers are correctly loaded, except that xPSR lacks of thumb bit. That's why the hard fault comes.

But I have no idea why xPSR is clear to zero...

(the input to activate function is the pointer to the top of user stack)

.global activate
activate:
/* save kernel state in ip register */
mrs ip, psr
push {r4, r5, r6, r7, r8, r9, r10, r11, ip, lr}

/* switch to process stack */
msr psp, r0

mov ip, #2
msr control, ip

ldr ip, [sp, #0x38]
msr psr_nzcvq, ip

/* load user state */
pop {r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, lr}
add sp, #0x8
ldr ip, [sp, #-0x8]
/* this line can branch correctly */
bx ip