ARM assembly: Strange instruction pattern (endless loop?)

Question

I noticed a strange instruction pattern. First the value of PC is moved into LR and then a register value is moved into PC.

Here some examples:

.text:00001488                 MOV             LR, PC
.text:0000148C                 MOV             PC, R2
 ...
.text:000304E8                 MOVNE           LR, PC
.text:000304EC                 MOVNE           PC, R3

If this pattern corresponds to a call instruction, wouldn't this result in an endless loop? If this does not correspond to a call, what is this ?

Answer 1

I'm not pretty sure if it is a call pattern, but this code is OK because of pipeline and will not create the endless loop. As people quoting here from here

on page A2-11 (Section A2.3) of the manual (ARM Architecture Reference Manual ARMv7-A and ARMv7-R edition) it's been said that:

PC, the program counter

• When executing an ARM instruction, PC reads as the address of the current instruction plus 8.
• When executing a Thumb instruction, PC reads as the address of the current instruction plus 4.
• Writing an address to PC causes a branch to that address.

Most Thumb instructions cannot access PC. The ARM instruction set provides more general access to the PC, and many ARM instructions can use the PC as a general-purpose register. However, ARM deprecates the use of PC for any purpose other than as the program counter. See Writing to the PC on page A2-46 for more information. Software can refer to PC as R15

Answer 2

This was actually the correct way to perform indirect calls in ARM before the introduction of the BLX instruction (ARMv5 IIRC). ARM(32-bit version) is special in that the value of PC is pointing two instructions ahead when you read it (so +8 in ARM mode and +4 in Thumb mode). So, taking your example:

.text:00001488                 MOV             LR, PC

here, the PC value will be 1488+8 = 1490, so LR=0x1490

.text:0000148C                 MOV             PC, R2

here, the PC will be set to the value in R2 and the processor will start fetching instructions from that address. Most likely it will be a function which ends with a return instruction - MOV PC, LR (IDA shows it as RET), so the execution will resume at the value of LR（0x1490) which happens to be just after the original MOV PC, R2 instruction (0148C+4=0x1490), so in effect that sequence of instruction is equivalent to BLX R2 in the newer processors.