AVR Freaks

Sure, you are calling a loop, just one RCALL with two RET... without the first return address at the stack, it will return to any value at the stack, that for coincidence is the begging of your code.

For example:

START:
   RCALL GO

GO:
   LD R19, 5
   RCALL DEMO

DEMO:
   DEC R19
   BRNE PC-1
   RET

Stack Empty

The RCALL on START label pushes its return address into the stack, the return address is exactly at the GO label, and then it jumps to GO label.

STACK $3FF   GO-ADDRESS-LOW

STACK $3FE   GO-ADDRESS-HIGH

On the GO label, it loads R19 with 5 and RCALL DEMO.

The GO label return address stays in the stack, and right below it writes the return address after the RCALL DEMO, that is exactly the DEMO label, and jumps to DEMO.

STACK $3FF   GO-ADDRESS-LOW

STACK $3FE   GO-ADDRESS-HIGH

STACK $3FD   DEMO-ADDRESS-LOW

STACK $3FC   DEMO-ADDRESS-HIGH

On DEMO, it decrements R19 (5 steps) until zero and RETURN to the address saved on 3FC:3FD

But Returns where?  To the address pointed by the Stack Pointer 3FC:3FD, it is exactly the last above, the DEMO routine address.

So it "returns" to DEMO, Stack Pointer increments two address, and jumps and runs DEMO again, decrements R19 (now 256 steps) to zero, and RETURN

STACK $3FF   GO-ADDRESS-LOW

STACK $3FE   GO-ADDRESS-HIGH

But Returns where? Now the Stack Pointer is pointing to the return address pointed to 3FE:3FF to GO.

So it "returns" to GO, Stack Pointer again increments two address, and jumps to GO

STACK EMPTY

On GO, it loads R19 with 5 and RCALL DEMO, so the return address of the next instruction of RCALL DEMO is also the DEMO label address, this address is stored into the Stack and Stack Pointer is decremented by 2.

STACK $3FF   DEMO-ADDRESS-LOW

STACK $3FE   DEMO-ADDRESS-HIGH

On DEMO, it decrements R19 (5 steps) until zero and RETURN to the address saved on 3FE:3FF that is the beginning of the DEMO routine.  This is the first time it runs DEMO on this call.

At the DEMO return instruction, it will return to the beginning of DEMO routine, that address in on 3FE:3FF at stack, stack pointer is incremented by 2, and it executes the DEMO by the second time in this call.

STACK EMPTY

At the end of this second run on DEMO, it will return, to where? nobody knows, since stack is empty, there is no valid address to jump to.

No one knows what is in the memory position $400:401, may be some data pushed before, but uncertain.

The above, and also your routine lacks the stack to have something to return after the second embedded RET.

There are situations where you use this feature in your favor.  

For example, having a 100us timer, and needing to have also a 200us timer, you don't need to have a second routine.

T200US: 
          RCALL T100US
T100US:
          CLR R19
          DEC R19
          BRNE PC-1
          RET

The T100US is a trivial loop of decrementing R19 from 256 to zero and return, in a AVR core running at 8MHz will give you aproximately 100us.

But, if you call it twice, will have 2 x 100us, so if you use a RCALL for the next address that happens to be the T100us, that is exactly what happens.

Routine X calls the T100US and after 100us the RET instructions comes back to the next instruction of what called T100US.

Routine Y calls the T200US it calls the T100US, the RET send PC back to the next instructions of what called T100US, that is exactly the T100US label, so T100US runs again, its second return will jumps back to the next instruction after what called T200US, 200us after the call. 

T400US:
          RCALL T200US
T200US: 
          RCALL T100US
T100US:
          CLR R19
          DEC R19
          BRNE PC-1
          RET

The above created another time delay of 400us just making a second loop, calling T200 that calls T100, ending running 200us and calling it again ending in 400us delay.

T500US:
          RCALL T100US
T400US:
          RCALL T200US
T200US: 
          RCALL T100US
T100US:
          CLR R19
          DEC R19
          BRNE PC-1
          RET

The above uses T500US label on top, that calls first the 100us, then the 400us, totaling 500us.

But always need to respect an EVEN count of RCALL and RET, if not you will have a ROGUE return, computer crazy.

There is a pretty and nice way to create a program, where the Stack never received the return address from a CALL or RCALL, instead you put manually the return address by pushing registers into Stack with the return stack.

That, of course, you will need to know the addresses of the labels you are jumping to.

Suppose some routine defined that it needs to jump to label TUMB1, and TUMB1 is documented to be exactly at address $1A40 (in the code).

That routine can prepare the jump doing this:

    LDI  R16, 0x20
    PUSH R16
    LDI  R16, 0x0D
    PUSH R16
    RET

Both PUSH R16 will put the value 0x0D20 into the stack (big-endian scheme).

The RET instruction will jump to this address, that is in fact 0x0D20 x 2 = 0x1A40 in bytes.

Remember, instructions use 2 bytes (word), so the stack also use words addressing, the real bytes address / 2.

In sumary, RCALL always store into the STACK the number of the next INSTRUCTION to be executed upon RETURN, not addresses exactly.

So, the instruction located at address 0x1A40 is exactly the possible instruction # 0x0D20 in the program.

Can you imagine if the value of R16 above is the result of some crazy decription calculation to jump to an address that is created on fly (but valid routine start address), and not literally written in the code?

A hacker making reverse engineering will become crazy trying to understand where the values of R16 came from to the jump, and where this routine goes now...

This is somehow equivalent to the IJMP instruction, that jumps to the address value contained in the Z register, R31:R30 registers.

ICALL also CALLS a routine with address stored in the Z register.

The IJMP and ICALL is not available in all devices.