bug in arm_cpu_lowlevel_init ??

My cpu is at91rm9200

When start barebox at reset time by burn it in Nor flash, all things Ok.

But when start it by my first stage boot program, It's crash. And Execption process code which install by my boot program, report Undef instruction detected.

The only diff is my boot program change the cpu to svc mode already.

I try the flowwing patch:

------------------------------------------------

arch/arm/cpu/lowlevel.S +2 -2

@@ -4,6 +4,7 @@
 
 .section ".text_bare_init_","ax"
 ENTRY(arm_cpu_lowlevel_init)
+       mov     r2, lr
        /* set the cpu to SVC32 mode */
        mrs     r12, cpsr
        bic     r12, r12, #0x1f

@@ -35,5 +36,5 @@ ENTRY(arm_cpu_lowlevel_init)
 
        mcr     p15, 0, r12, c1, c0, 0
 
-       mov     pc, lr
+       mov     pc, r2
 ENDPROC(arm_cpu_lowlevel_init)
------------------------------------------------

The problem dispeared, All things worked!!

I'm not very familiar with asm code,

Anybody tell me is this a bug, Or my boot program has strange behavior?

but maybe something will help article below:
http://www.heyrick.co.uk/armwiki/The_Status_register

My cpu is at91rm9200

When start barebox at reset time by burn it in Nor flash, all things Ok.

But when start it by my first stage boot program, It's crash. And Execption process code which install by my boot program, report Undef instruction detected.

The only diff is my boot program change the cpu to svc mode already.

I try the flowwing patch:

------------------------------------------------

arch/arm/cpu/lowlevel.S +1 -0

@@ -4,6 +4,7 @@
 
 .section ".text_bare_init_","ax"
 ENTRY(arm_cpu_lowlevel_init)
+       mov     r2, lr
        /* set the cpu to SVC32 mode */
        mrs     r12, cpsr
        bic     r12, r12, #0x1f

The lr (r14) register has different instances, one for each mode. It could be that once we switch to a different mode in arm_cpu_lowlevel_init we see another instance of r14. So to me the patch looks correct, we shouldn't rely on lr as return address but rather use another register for storing the address.
The above only happens though when the CPU is not in SVC32 mode already. What first stage loader are you using? Could you analyze in which mode the CPU is when the loader jumps to barebox?

Quoted 10 lines

The lr (r14) register has different instances, one for each mode. It could be that once we switch to a different mode in arm_cpu_lowlevel_init we see another instance of r14. So to me the patch looks correct, we shouldn't rely on lr as return address but rather use another register for storing the address.
The above only happens though when the CPU is not in SVC32 mode already. What first stage loader are you using? Could you analyze in which mode the CPU is when the loader jumps to barebox?

The first stage loader was written by myself longlong ago. So forgot the details. I just look the code closer, Found the flowwing line just before jumps to barebox.

  asm ("msr CPSR_c, %0" : :"i"(ARM_MODE_SYS|I_BIT|F_BIT));

So it seems the cpu is in system mode when run barebox. Your explanation is right.