Cannot find the caller of the main function in a disassembled firmware

Question

I am looking at an unstripped ARM elf firmware file using IDA Pro. There is an init() function and a main() function. From my understanding of the logic, it's probably structured like this:

init()
while (1) {
   main();  
}

or the main() itself contains a super loop. However, the strange things are 1) I am not able to find any calling references for the main(). 2) Nor can I identify a super loop structure inside main().

The main() is like this:

  B1: PUSH    {R3-R7,LR}
  ...
RN_end_of_main:
  B2: POP     {R3-R7}
  B3: POP     {R3}
  B4: BX      R3
  (end of main)

The init() is like this (directly following main()):

  A1: PUSH    {R3-R7,LR}
      ...
  A2: LDR     R0, main+1    # This is the only place that references main()
  A3: B       RN_end_of_main
  (end of init)
  (data)

A1, A2, .. B3 are line numbers added by myself here for easier explanation.

First off, IDA Pro shows "Three are no refs to main()" when using "Jumps to xrefs to operand..." function. And line A2 is the only place in the whole firmware disassembly that references main(). However , it put address main+1 to R0 which I don't understand. It looks like R0 is not used after jumping to RN_end_of_main, and the init() will just return using the originally pushed LR which will go nowhere.

Anything missing in my understanding of this code? And is there some hidden way that main() can be called?

Answer 1

Finally I think I might have one explanation for this.

The ARM elf format firmware file is further converted to a hex bin file which is used by the boot loader to program into the on board flash. So my speculation is that both init and main probably are actually called by the boot loader code.

This speculation is possible because the elf file is still fully relocatable. The elf-->bin step might do a relocation process to make it callable by the already-present bootloader.

With this speculation, the init function doesn't call the main actually. Both just are called and returned normally by the bootloader.