title: R7 and R11 relation with Link Register in ARM architecture (thumb/arm) calling convention
body: <p>I was looking at a arm assembly code generated by gcc, and I noticed that the GCC compiled a function with the following code:</p>
  
  <pre><code>   0x00010504 &lt;+0&gt;: push    {r7, lr}
     0x00010506 &lt;+2&gt;: sub sp, #24
     0x00010508 &lt;+4&gt;: add r7, sp, #0
     0x0001050a &lt;+6&gt;: str r0, [r7, #4]
  =&gt; 0x0001050c &lt;+8&gt;: mov r3, lr
     0x0001050e &lt;+10&gt;:    mov r1, r3
     0x00010510 &lt;+12&gt;:    movw    r0, #1664   ; 0x680
     0x00010514 &lt;+16&gt;:    movt    r0, #1
     0x00010518 &lt;+20&gt;:    blx 0x10378 &lt;printf@plt&gt;
     0x0001051c &lt;+24&gt;:    add.w   r3, r7, #12
     0x00010520 &lt;+28&gt;:    mov r0, r3
     0x00010522 &lt;+30&gt;:    blx 0x10384 &lt;gets@plt&gt;
     0x00010526 &lt;+34&gt;:    mov r3, lr
     0x00010528 &lt;+36&gt;:    mov r1, r3
     0x0001052a &lt;+38&gt;:    movw    r0, #1728   ; 0x6c0
     0x0001052e &lt;+42&gt;:    movt    r0, #1
     0x00010532 &lt;+46&gt;:    blx 0x10378 &lt;printf@plt&gt;
     0x00010536 &lt;+50&gt;:    adds    r7, #24
     0x00010538 &lt;+52&gt;:    mov sp, r7
     0x0001053a &lt;+54&gt;:    pop {r7, pc}
  </code></pre>
  
  <p>The thing which was interesting for me was that, I see the GCC uses R7 to pop the values to PC instead of LR. I saw similar thing with R11. The compiler push the r11 and LR to the stack and then pop the R11 to the PC. should not LR act as return address instead of R7 or R11. Why does the R7 (which is a frame pointer in Thumb Mode) being used here? 
  If you look at apple ios calling convention it is even different. It uses other registers (e.g. r4 to r7) to PC to return the control. Should not it use LR?</p>
  
  <p>Or I am missing something here?</p>
  
  <p>Another question is that, it looks like that the LR, R11 or R7 values are never an immediate value to the return address. But a pointer to the stack which contain the return address. Is that right?</p>
  
  <p>Another weird thing is that compiler does not do the same thing for function epoilogue. For example it might instead of using pop to PC use bx LR, but Why?</p>